Privacy policy

DGV Solutions d.o.o., Cesta Zore Perello-Godina 2, 6000 Koper, Slovenia is the controller for its own user accounts, business administration and analytics. Contact: info@minotask.si. We normally act as processor for customer documents; where the customer itself acts as processor, we may be a subprocessor. Actual purposes and instructions determine the role.

• Accounts, login and subscriptions: email, identifiers and user details; contract performance or pre-contractual steps where you are a contracting party. For a customer’s business contacts, our basis is the legitimate interest in managing the business relationship.
• Offers, manual invoicing and business communication: contact and billing details; contract or the legitimate interest in business communication, and applicable accounting obligations.
• Support and security: messages, optional screenshots, logs, IP and technical identifiers; the legitimate interest in solving problems, preventing abuse and protecting the service, or applicable obligations.
• Product analytics and performance measurement: usage events, pseudonymous identifiers and technical data; consent for non-essential analytics.

Customer documents may contain personal data about suppliers, buyers, sole traders and contacts alongside commercial line items, values and quantities. The customer determines the lawful basis and notices for those people; we process documents for the agreed service, not on the assumption that they consented through registration. Account details and documents are needed for the functions you request; without them we cannot provide those functions. Analytics is optional.

PDF invoices are stored in Supabase Storage; extracted data and processing state are stored in the database. Complete PDFs are sent to Google Gemini for recognition and extraction. We use a project with active paid billing. After processing we request deletion from Gemini Files; this does not mean all provider safety logs are immediately removed. Under the paid Gemini service terms, Google does not use submitted content to improve its products; limited safety logging is separate processing.

OpenAI receives selected extracted fields for tariff suggestions and estimates, such as product description, part number, quantity, weight information and an invoice identifier. This path does not send the complete PDF. Providers may retain requests, responses and safety logs according to the services and settings used. We do not claim zero retention.

For the public tariff finder, OpenAI receives the product description and optional details you enter to prepare the suggestion you request. Do not enter personal or confidential information. This processing is separate from optional product analytics.

We may retain company-specific descriptions, identifiers and confirmed corrections for that company’s future reports. This memory is separate from individual reports and is not automatically erased when a report is deleted. Review AI results before use; Minotask does not make final legally binding decisions about individuals.

Google Gemini terms and data handling

OpenAI API data controls and retention

• Railway: backend and worker hosting. Supabase: authentication, database and file storage. Vercel: website hosting, analytics and performance measurement.
• Google: optional Google account login and, separately, Gemini extraction. OpenAI: tariff classification and estimation using selected fields.
• PostHog: consent-based product analytics; automatic capture and session replay are disabled. Events exclude email, document content, filenames and company/report identifiers.
• Langfuse: AI observability, currently for the public tariff finder. That flow records model, usage, duration and status, not the user’s product description. Other flows depend on enabled configuration.
• Resend and the receiving mailbox provider: support-message delivery and optional attachments to authorised staff.

We do not sell personal data. Online-payment providers are not part of the current payment processes listed here; contracts and invoices are handled manually. We will update notices and necessary agreements before adding new processing.

Checks on October 15, 2026 confirmed the Supabase project’s primary storage in Paris, France, and active Railway backend and worker deployments in Amsterdam, the Netherlands. The PostHog project uses the EU service; Langfuse is configured for its EU service endpoint. These primary configuration details do not establish that all support services, subprocessors and logs remain in the EU. Where processing involves a transfer outside the EEA, an appropriate mechanism and necessary safeguards must apply. Request details of recipients, locations and safeguards from info@minotask.si.

Supabase DPA

Langfuse Cloud: Data Processing Addendum

We retain the following periods as service commitments. Deletion requests are handled manually; individual removal steps are not fully automated.

• Account and company data, including separate company memory: account lifetime and up to 90 days after closure.
• PDF invoices, reports and exports: during the account lifetime or until deletion on request, in any event no more than 24 months from creation or upload.
• Failed-processing artifacts: up to 90 days.
• Technical/security logs and AI logs/traces: up to 12 months.

Deleting a report in the application hides it immediately. Routine permanent deletion is scheduled after a 30-day period; actual completion depends on running the process and resolving failures. This is not a guarantee of permanent deletion exactly on day 30, and does not erase separate company memory or provider copies. For all related data or company-memory requests, contact info@minotask.si.

Specific legal duties, such as those covering our own billing records, may require different retention. We do not automatically apply these duties to every invoice uploaded by a customer. Applicable legal periods, justified exceptions, provider copies and backups are assessed separately; we explain the reason and scope when handling a request.

The public finder may temporarily keep generated results in process memory, indexed by a hash of the input. The default result reuse period is 24 hours; this is not a guarantee of physical deletion at that deadline. Entries are removed when expired validity is checked, by cache eviction or on restart. The cache holds the generated result rather than the raw request object; AI-provider retention is separate.

Subject to applicable conditions, you may request access, correction, erasure, restriction, portability and object to processing. Withdraw analytics consent through Cookie settings. Withdrawal does not affect the lawfulness of earlier processing. Send requests to info@minotask.si; we may verify identity and authority to protect data. For documents processed for a customer, we route the request to the relevant controller and assist them.

We act on valid requests without undue delay and normally inform you of the action taken within one month. Complexity or the number of requests may justify up to two additional months; we notify you and explain the reasons within the first month. We explain any applicable limitations or legal exceptions when handling your request. Portability is provided in an appropriate machine-readable format to the extent required by law.

You may complain to Slovenia’s Information Commissioner. Our decisions on requests handled as controller include reasons and information about remedies under ZVOP-2. Under ZVOP-2, the decision also includes information about the right to appeal to the supervisory authority within 15 days of receiving the decision.

Information Commissioner of the Republic of Slovenia

We use authentication, document-access checks, data separation by user or workspace permissions, and restricted file access. These measures do not guarantee perfect security or end-to-end encryption, because OCR requires provider processing. Do not upload special-category personal data unnecessary for the agreed purpose. Contact info@minotask.si about security, processing or a DPA.