MobiArve privacy policy
This policy explains what personal data is processed when you use the MobiArve app (iPhone and Android), the web app app.mobiarve.ee and the website www.mobiarve.ee, why and for how long, who receives it and what rights you have. The Estonian version is the governing version; this English text is a translation.
1. Controller
Snackster OÜ (registry code 12977527, address Riia 130b, Tartu), hereinafter MobiArve or we. For questions about personal data, write to support@mobiarve.ee.
MobiArve is the controller of users' account, company and subscription data and of website visitors' data. For the data users enter on their invoices and in their customer records, the user is the controller and MobiArve is the processor (see section 9).
2. What data we process
| Data | Examples | Source |
|---|---|---|
| Account | e-mail address, password (hashed, we cannot see it), account creation and sign-in times, user ID | you |
| Company | name, registry code, VAT number, address, e-mail, website, bank and account number, logo, accountant's e-mail, invoice settings | you |
| Invoices and customers | invoices and their PDFs, customers (name, registry code, address, e-mail), items, payments, reminders, e-invoices | you |
| Subscription | plan, validity, purchase history and purchase confirmation from the App Store or Google Play (we do not receive card details) | the store and RevenueCat |
| Connections | Billberry API key and ErplyBooks API key (kept on the server only), sync status | you |
| Mail and usage | time and recipient of sent e-mails, number of mails per hour, invoices per month (for plan limits), e-mail design | your use of the service |
| Support | your messages to us and our replies | you |
| Website | cookie consent choice, colour theme choice; Meta Pixel data only with consent | your device |
When you search for a customer, the search text you type is sent directly from your device to the public search of the Estonian business register. Reminder notifications in the app are created on your device.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating the account, signing in, creating, storing and sending invoices, reports, e-invoices, the ErplyBooks connection | performance of a contract (GDPR Art. 6(1)(b)) |
| Checking the plan and limits, linking the subscription to the account | performance of a contract |
| Security, preventing abuse and spam (e.g. sending limits), fixing errors | legitimate interest (Art. 6(1)(f)) – keeping the service secure and working |
| User support, account administration (e.g. granting a plan manually, suspending an account after a breach) | performance of a contract and legitimate interest |
| Improving the service based on aggregated statistics (e.g. how many invoices are made per month in total) | legitimate interest |
| Important notices about the service (e.g. changes to the terms, security notices, major updates) | performance of a contract and legitimate interest |
| Marketing e-mails | consent, or where the law allows it for existing customers about similar services; you can opt out of every mail |
| Measuring website visits and targeting ads with the Meta Pixel | consent (Art. 6(1)(a)), which you can withdraw at any time |
| Legal obligations (e.g. accounting, requests from authorities) | legal obligation (Art. 6(1)(c)) |
We do not sell personal data and do not make automated decisions about you that have legal or similarly significant effects.
4. Who receives data
We use reliable service providers who process data on our instructions under a contract:
| Provider | Purpose | Location |
|---|---|---|
| Google (Firebase: authentication, database, server functions, file storage) | storing the account, data and PDFs; server-side operations | USA |
| MailerSend | sending invoice and reminder e-mails | European Union |
| RevenueCat | managing subscriptions and plans | USA |
| Virtuaal (virtuaal.com) | hosting the website and web app | Estonia |
Data is also passed on:
- on your instruction – to the e-mail recipient (the customer on the invoice, the accountant or yourself), to the e-invoice operator Billberry (if you use e-invoices) and to ErplyBooks (if you have connected it). These services process data under their own terms;
- to Apple and Google – when you buy a subscription, they process payment data as independent controllers under their own terms;
- to Meta (Meta Platforms Ireland) – on the website only if you have accepted the Meta Pixel;
- to authorities – where the law requires it.
5. Transfers outside the European Economic Area
Some providers (Google, RevenueCat) are located in the USA or may process data there. Transfers rely on safeguards approved by the European Commission: the EU-US Data Privacy Framework and/or the Commission's standard contractual clauses.
6. How long we keep data
- Account, company, invoice and customer data – for as long as your account exists. When you delete your account (in the app settings or by writing to us), we delete this data and the files without delay. Remnants may stay in technical logs and backups for a short time until they are removed in the normal cycle.
- Connection keys (Billberry, ErplyBooks) – until you disconnect or delete the account.
- Sending-limit counters – hourly, without mail contents.
- Subscription data – at RevenueCat and in the stores under their rules, and as long as needed for accounting and settling disputes.
- Support correspondence – up to 3 years after your last message.
- Website cookie consent choice – 12 months.
Remember that by law you must keep your invoices for at least seven years. Download them before deleting your account.
7. How we protect data
- All traffic uses encrypted connections (HTTPS).
- Database rules let each user see only their own data.
- Passwords are stored hashed. Connection keys are kept on the server and cannot be read from the app.
- Only the service administrator can access other users' data, for support and account administration; administrative actions are logged.
- E-mails can only be sent to the invoice customer, the accountant and the account owner.
8. Your rights
You have the right to:
- get information about how your data is processed and access your data;
- have incorrect data corrected (you can change most of it yourself in the app);
- have your data deleted (delete your account in the app settings);
- restrict processing or object to processing based on legitimate interest;
- receive your data in a portable form (invoices as PDF, reports as CSV in the app or through us);
- withdraw consent at any time (e.g. in the website's cookie settings);
- complain to the Estonian Data Protection Inspectorate or a court if you think your rights have been violated.
Write to us at support@mobiarve.ee. We reply within one month. We may ask you to confirm your identity first so that data does not reach the wrong person.
9. MobiArve as processor
When you enter personal data of your customers, their contact persons or other people into MobiArve (for example a sole-proprietor customer's name and address on an invoice), you are the controller of that data and MobiArve is the processor within the meaning of GDPR Article 28. This section sets out our obligations to you; it forms part of the terms of use.
- Subject matter. We store, display, calculate, create PDFs and transmit data (e-mail, e-invoices, ErplyBooks) only to provide the service and on the instructions you give by using the app. Data subjects are your customers and their contact persons; data categories are names, registry and contact details, addresses and invoice data.
- Confidentiality. Only people who need access to provide the service and are bound by confidentiality can access the data.
- Security. We apply the measures described in section 7.
- Sub-processors. You accept the use of the providers listed in section 4. We announce new sub-processors by updating this policy, and you have the right to object or stop using the service.
- Assistance. We help you, to a reasonable extent, respond to data subject requests and meet your data protection obligations.
- Breaches. We notify you without undue delay if we become aware of a personal data breach affecting your data.
- End of processing. When the account is deleted, we delete the data as described in section 6. You can download the data before that.
- Information and audits. We give you, to a reasonable extent, the information needed to show that these obligations are met.
10. Cookies and data stored on your device
- The website www.mobiarve.ee uses the cookie
fb_consent, which remembers your cookie choice (12 months), and stores your colour theme choice in your browser. The Meta Pixel and its cookies (e.g._fbp) are loaded only if you accept. You can change your choice under "Cookie settings" in the website footer. - The web app app.mobiarve.ee stores your sign-in state and settings (e.g. selected company, language, theme) in the browser. These are needed for the service to work.
- The mobile app stores your sign-in state, settings and reminder notifications on your device.
11. Children
The service is meant for businesses and is not aimed at people under 18. We do not knowingly collect children's data.
12. Changes
We may update this policy. We will announce significant changes by e-mail or in the app. The current version is always at www.mobiarve.ee/en/privacy.
13. Contact
Snackster OÜ, Riia 130b, Tartu. E-mail: support@mobiarve.ee.