How your bill is handled

Laskuviiva is a free tool run by a private individual. There is no company behind it. That person is the controller of the personal data described here.

A contact email is not published on this page yet. Until it is, the operator cannot receive privacy requests by email.

You upload a PDF bill. Laskuviiva reads the account number, reference, amount and due date, and draws a Finnish bank barcode. You pay in your own banking app. Laskuviiva does not make the payment and does not send it to a bank.

The PDF itself. It can contain your name and address, the payee, the IBAN, the reference, amounts and a due date, and anything else printed on the bill. A bill can reveal health care, a trade union or a religious community.

The file name stays in your browser. It is not recorded.

Technical logs of the request: the time, whether it succeeded or which error came back, and the file size. The bill's contents are not written to the logs. The host also records the IP address of the connection.

Sign-in is required. The PDF is never stored. There is no analytics and no advertising.

To make the barcode you asked for. The legal basis is Article 6(1)(b) of the GDPR: a service you requested.

To keep the service working and to look into abuse. The legal basis is Article 6(1)(f), legitimate interest. The logs are short-lived and do not contain the bill. That interest is not overridden by your rights, because the logs cannot be linked back to a bill.

If the bill contains sensitive details, the legal basis is your explicit consent, Article 9(2)(a). The upload form asks for it, and the box is not pre-ticked.

Vercel Inc., in the United States, hosts the site. The bill is handled in memory on a server in Stockholm. Vercel is certified under the EU–US Data Privacy Framework, and its data processing addendum includes the European Commission's standard contractual clauses. Vercel lists its own sub-processors at vercel.com/legal/sub-processors.

Firecrawl, operated by SideGuide Technologies, Inc., a Delaware company, in the United States. If the bill cannot be read from its text on our server, for example a scan, the PDF is sent to Firecrawl so it can read the payment details. Firecrawl publishes its sub-processors at trust.firecrawl.dev/subprocessors. A public reading of that page on 23 September 2026 named Google Cloud Platform, Supabase, Vercel and WorkOS. The page itself is the current list.

The hosting transfer to Vercel is covered by the EU–US Data Privacy Framework.

The transfer to Firecrawl is not. No data processing agreement is available on an ordinary Firecrawl account, and no EU–US Data Privacy Framework certification for Firecrawl could be confirmed. The PDF is sent only with your explicit consent under Article 49(1)(a).

The risks of that transfer: US law can allow authorities to access data held by a US company in ways that do not match EU law. Firecrawl's privacy policy does not give a date on which it deletes data sent to it. It says personal information is kept until you ask for it to be deleted, and that it has no set deletion schedule.

You can leave the box unticked and still upload. Without your agreement the bill is still read on our server. When that reading has the account and the reference, a barcode is made, and the amount is left open when it is missing. If it does not, no barcode is made and nothing is sent to Firecrawl. You can withdraw your agreement for future bills by leaving the box unticked. A transfer that already happened is not undone by that; for a file already sent, ask Firecrawl to delete it at help@firecrawl.com.

We do not store the PDF, the payment details or the barcode. They exist in the server's memory only until the response is sent, and in your browser until you leave the page.

Our logs do not contain the bill. Vercel keeps runtime logs for one day, or for 30 days if Observability Plus is enabled on the account. Either way, no longer than 30 days.

How long Firecrawl keeps a file it received is up to Firecrawl, as described above.

You can ask for access, correction, deletion or restriction, and you can object to processing based on legitimate interest. You can also withdraw the consent described above.

Because the bill is not kept, there is usually nothing to show or delete on our side. Say so in your request and it will be answered within one month.

You can lodge a complaint with the Office of the Data Protection Ombudsman in Finland: tietosuoja.fi.

The site does not set cookies.

Reading the bill is automatic, and Firecrawl uses a model to pull the payment details out of files it receives. Nothing is decided about you. You decide whether to pay, in your bank's app.