Your data, kept short.

• The app runs in Finland (Hetzner, Helsinki).
• The database is in Ireland (Convex, AWS eu-west-1). It holds everything except the PDFs.
• PDFs are stored in Cloudflare R2 with EU jurisdiction.
• Reading happens with Gemini on Vertex AI, in Google Cloud's EU multi-region.

Matching the read text to your Fields happens at TypeSafe in the United States, and sign-in emails go through Resend in the United States. See Who processes it.

• 30 days after sending by default. Your Admin can set anywhere from 1 to 365 days.
• Documents never approved are deleted 90 days after upload.
• Rejected Documents are deleted 30 days after rejection.
• Unsaved Form Proposals are deleted after 7 days, with their sample PDF.
• Deletion removes the PDF, what Vink read, all values and the Payload.
• We keep a short record (file name, who uploaded and approved it, dates, delivery status), never the document or its values.

An Admin can delete any Document right away, approved ones included. Pending retries for it are cancelled.

To close your account or Organisation, email us. We delete everything within 30 days.

Every party that handles your data, what for, where, and what it receives.

Transfers to the United States rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.

Each Organisation only sees its own Documents. Every request is checked against a Membership, and this is covered by automated tests.

There are two roles, Admin and Member. Only Admins can:

• invite and remove members, and change roles
• create and change Forms, including Auto-Send and the Review Threshold
• add, change and remove Integrations, and see their secrets
• change the Organisation's name and retention period
• delete Documents and send failed Deliveries again

Auto-Send is off by default. An Admin turns it on per Form, and it only sends Documents with no unsure values.

Sign-in is by email link, which expires after 5 minutes, or by password. Sessions last 7 days.

• HTTPS only, with HSTS.
• Links to a PDF expire after 5 minutes.
• Integration endpoints must use HTTPS.
• Integration secrets are encrypted (AES-256-GCM) with a key kept outside the database.
• Data at rest is encrypted by the providers.
• Payloads are signed with HMAC-SHA256, with one secret per Integration and a timestamp against replays. See Verify the signature.
• A test-send only sends example values or an approved Document.

Found a security problem? Email [email protected]. We read every report and reply to you directly. Our security.txt has the same details.

Questions about privacy, or need the DPA? Contact us.