Document

Privacy Policy

Updated

Last updated April 25, 2026

Contact

jami@vantnod.com

On this page

17 sections

This is a careful working draft, not a substitute for review by qualified counsel. The payment-services, light-entrepreneur and Stripe Issuing/Connect provisions in particular should be confirmed with a Finnish-licensed lawyer before contractual use.

On this page

In force from April 25, 2026 – Controller

Controller: Impact Node Oy (Finnish limited company). Business ID 3624870-2. Registered office Espoo, Finland. Email jami@vantnod.com. Vantnod is a registered auxiliary business name (aputoiminimi) and proprietary software of Impact Node Oy.

1. Overview

This privacy policy describes how Vantnod processes personal data and financial-administration data when providing, maintaining, developing and securing the service, managing the customer relationship and meeting statutory obligations.

Vantnod processes personal data in accordance with the EU General Data Protection Regulation, the Finnish Data Protection Act and other applicable law. In Finland, compliance with data-protection law is supervised by the Office of the Data Protection Ombudsman.

2. Whose data we process

We may process personal data of the following groups:

Customers and users.
Company representatives, owners, board members, agents and contact persons.
Counterparties to invoices, receipts, payment transactions or accounting records.
Persons contacting customer support.
Visitors and users of the website and service.
Persons involved in investigating misuse, fraud or security incidents, where applicable.

3. Categories of personal data

We may process the following categories of data:

Basic and contact details: name, email, phone, address, language, username and customer number.
Company and billing data: company name, business ID, VAT identifier, billing address, payment method, order details and payment history.
Identification and compliance data: representation rights, roles, responsible persons, owner data and other information needed for know-your-customer, fraud prevention or partner requirements.
Financial-administration data: invoices, receipts, vouchers, payment transactions, account statements, balances, expense categories, accounting drafts, reports and other data the user enters into or retrieves via the service.
Technical data: IP address, device data, browser data, operating system, login data, cookies, log files, API calls, error reports and event data on service use.
Support data: messages, complaints, support requests, attachments and other material the user provides.
AI processing data: inputs, suggestions, user confirmations, corrections, feedback used by Noa and technical telemetry related to evaluating model performance.
Location-related data: location signals derived from payment events, logins or security incidents, such as IP-based location or merchant location associated with a card transaction, where received from partners.
Analytics demographics and interests: where the user has consented to analytics and marketing cookies, Google Analytics 4 may, via the Google signals feature, associate aggregated, non-identifying analytics data with statistical information about demographics, interests and cross-device behaviour. This information is sourced from end users' settings on their Google accounts, not from data Vantnod transmits.
Refined analytics location: where the user has consented to analytics cookies, Google Analytics may use city-level location based on IP address for analytics reporting.

4. Purposes of processing

We process personal data for the following purposes:

Providing the service and managing user accounts.
Billing, payment processing and order management.
Producing financial-administration features, automations and reports.
Producing AI-assisted suggestions.
Customer support and communication.
Security, fraud prevention and abuse detection.
Compliance with statutory obligations.
Meeting partner requirements, such as Stripe's.
Service analytics, maintenance, debugging and development.
Establishing, exercising and defending legal claims.
Marketing where permitted and not opted out by the user.

5. Legal bases

We rely on the following legal bases:

Performance of a contract: where processing is necessary to provide the service, manage the account, bill or provide support.
Legal obligation: where processing is necessary for accounting, tax, anti-money-laundering, regulatory requests, consumer protection or other legal obligations.
Legitimate interest: where processing is necessary for security, fraud prevention, service development, customer-relationship management, legal claims or protecting the business.
Consent: where processing relies on the user's specific consent, such as certain marketing activities, optional integrations or other consent-based features.

6. AI and automated processing

Vantnod's Noa may process the user's financial-administration material and other input data to produce suggestions, classifications, observations, reports or automations.

AI-produced suggestions should not be treated as final decisions. The user must review and approve material information before relying on it for accounting, tax, invoicing, payment or filings to public authorities.

Vantnod may use aggregated, pseudonymised or de-identified data to develop the service, automations and AI features. We do not claim that such material is always and irreversibly anonymous; the technique is chosen for the purpose at hand and applied in line with GDPR requirements.

If personal data were ever to be used to train AI in a way not based on contract, legal obligation or legitimate interest, Vantnod will obtain separate consent where required.

7. Data sources

We obtain data from the following sources:

The user themselves.
The user's organisation.
Use of the service.
Integrations connected by the user.
Stripe and other payment or identity partners.
Banks or open-banking providers under the user's authorisation.
Public authorities and registers, where necessary.
Technical systems such as logs, cookies and analytics.

8. Disclosures

We may disclose or transfer personal data to the following parties to the extent necessary:

Stripe and other payment, card, identity or banking partners.
Cloud, security, communications and customer-support providers.
Analytics partners, including Google Ireland Limited (Google Analytics 4), where the user has consented to analytics cookies.
Accounting, invoicing and financial-administration systems at the user's request.
Public authorities, courts and supervisory authorities where required by law.
Debt-collection agencies, advisors and legal counsel for collecting receivables or handling legal claims.
A purchaser or other party in connection with a sale, merger, transfer of business or other restructuring.

9. International transfers

We aim to store and process data primarily within the European Economic Area. Some providers or sub-processors may, however, process data outside the EEA.

Where personal data is transferred outside the EEA, we ensure an appropriate legal basis for the transfer, such as a European Commission adequacy decision, standard contractual clauses or another GDPR transfer mechanism.

10. Retention

We retain personal data only as long as necessary for the purposes described in this policy or as required by law.

Retention is influenced by, for example, the duration of the customer relationship, accounting and tax-law requirements, statute-of-limitation periods for payments and disputes, the needs of security and misuse investigations, user requests for deletion, and partner and regulatory requirements.

Accounting, billing and payment-transaction data may need to be retained for statutory minimum periods even if the user deletes their account.

11. Security

We protect personal data with technical and organisational measures, including access management, encryption, logging, backups, security monitoring, staff training, sub-processor reviews and limiting access to personnel with a job-related need.

No electronic service is fully without risk. The user is responsible for the security of their own devices, email, passwords, credentials and integrations.

12. Data subject rights

Under the GDPR the data subject has the following rights:

Access their data.
Request rectification of inaccurate data.
Request erasure.
Request restriction of processing.
Object to processing.
Receive their data in a portable form, where conditions are met.
Withdraw consent where processing relies on consent.
Lodge a complaint with a supervisory authority.

13. How to exercise rights and complain

Requests can be sent to jami@vantnod.com. Vantnod may ask for additional information to verify identity before acting on a request.

If the user believes their personal data has been processed unlawfully, they have the right to lodge a complaint with the competent data-protection authority. In Finland the supervisory authority is the Office of the Data Protection Ombudsman.

14. DPA for business customers

Where Vantnod processes personal data on behalf of a business customer about employees, customers, invoice recipients or persons appearing on receipts, Vantnod acts as processor and the business customer as controller. In that case the parties may enter into a separate Data Processing Agreement (DPA).

A DPA template is available on request from jami@vantnod.com.

15. Cookies and similar technologies

Vantnod may use cookies and similar technologies for service operation, login, security, analytics, user experience and marketing.

Strictly necessary cookies are required for the service and are always used. Non-essential cookies, such as analytics and marketing cookies, are used only with the user's express consent given via the cookie banner.

We use Google Analytics 4 (provided by Google Ireland Limited) for analytics. Google Analytics is configured with Google's Consent Mode v2 framework so that no personal-data processing occurs before the user accepts analytics cookies. IP addresses are anonymised and page views are not sent before consent is given.

Where the user has consented to analytics and marketing cookies, the following additional Google Analytics 4 features are active: Google signals (association with Google account demographics, interests and cross-device data), city-level location, ads personalization, and the capability to export audiences to linked Google Ads accounts where such links exist. Consent for advertising cookies (ad_storage, ad_user_data, ad_personalization) must be obtained explicitly, and no advertising data is processed unless the user selects ”Accept all”.

The user can change their consent at any time via the ”Cookie settings” link in the site footer. Withdrawing consent stops advertising-data processing immediately and disables previously placed advertising cookies.

16. Changes to this policy

We may update this policy as the service, law, processing or partners change. Material changes are announced in the service, by email or by another appropriate means.

One place to decide

Receipts to VAT

Leave cleanly

A direct line to the builder