Privacy notice
Updated 3 November 2026
Pivanta is a service for small businesses by Veru Oy: invoicing, customers, products and stock. Here we explain which personal data we handle, why and for how long.
Controller
Veru Oy (business ID 3451504-5), Koivuviita 2 A, 02130 Espoo, Finland.
Privacy matters: [email protected]
What data we handle
- Your account: email address, language, and your name or phone number if you give them. The password is stored only as a hash and two-step login details are encrypted.
- Your company details that you give: name, business ID, VAT number, address, email and phone.
- Your company's users and invitations: the email addresses and roles of the people you invite.
- Sign-ins and events: sign-in attempts (time, IP address and browser), sessions, and the company's audit log (who did what and when, IP address).
- Beta testers: when you joined and your optional message.
- Server logs: IP address, time and the page asked for.
When your company stores data about its own customers or other people in the service, your company is the controller of that data and Veru Oy processes it on your company's behalf.
Why we handle it
- To provide the service: your account, signing in, company details and the emails the service sends, such as confirmation and sign-in links. Legal basis: contract.
- To keep the service secure and prevent misuse: sign-in attempts, the audit log, server logs and the robot check. Legal basis: legitimate interest.
- Beta testing: we tell you when the beta opens and ask for feedback. Legal basis: consent. You can leave the group at any time on the front page.
We do not sell data or use it for advertising. We make no automated decisions and no profiling.
Who handles data for us
- Hetzner Online GmbH (Germany): servers in Helsinki and encrypted backups in Germany.
- Cloudflare, Inc. (United States): delivering and protecting web traffic, name service, and the robot check on the sign-up form.
- Namecheap, Inc. (United States): the mail server through which the service sends its emails.
Data leaves the EU and EEA only under the standard contractual clauses approved by the European Commission or the EU–US Data Privacy Framework.
How long we keep it
- Account and company details, and the audit log: as long as the account is in use. When you close your company's account, you first get your data, and then it is deleted.
- An account whose email address is never confirmed: deleted after 7 days.
- Sign-in attempts: 90 days. Sessions: at most 30 days.
- Server logs: 14 days.
- Beta group: until you leave it or beta testing ends.
- Backups: deleted data stays in encrypted backups for at most a year, then it disappears by itself.
Cookies
We use only the cookies the service needs to work: the session and your language, staying signed in if you choose it, and form protection. We use no analytics or advertising cookies.
Security
Connections are encrypted, passwords are stored only as hashes and backups are encrypted. Two-step login is available to everyone. Access to the servers is restricted.
Your rights
You can ask to see your data and to have it corrected, deleted or moved. You can ask us to restrict its use, and object to use based on legitimate interest. You can withdraw your consent at any time.
Send your request to [email protected]. We answer within a month.
You can also complain to the Finnish Data Protection Ombudsman (tietosuoja.fi).
Changes
If we change this notice in an important way, we tell you in the service.