# LYVO shared recognition: operating policy and customer addendum

Version `lyvo-shared-2026-10-v1`. Effective 10 October 2026. Applies equally to invoices, delivery notes / avize de însoțire a mărfii, and credit notes.

## All-account testing amendment — 10 October 2026

This amendment takes precedence over the participation and source-approval requirements below **only while the explicit all-account testing mode is active**. The platform owner instructed LYVO to enable automatic learning and reuse for every account without account opt-in, permission acknowledgements or operator rights approval, and to review participation and permissions later. Authorization reference: `owner-chat-2026-10-10-no-acknowledgements`. No customer consent or independent legal approval is inferred or created.

During this mode, complete physical product facts from posted invoices, delivery notes and credit notes can be learned and reused automatically. Exact, compatible supplier identifiers can establish a testing namespace without operator setup; this identity is labelled as document-derived and awaiting review. Names alone, ambiguous divisions, conflicting packs, private text, prices and incomplete evidence are not used to establish shared facts. New source records carry `owner_testing` / `testing`, with no reviewer, permission certificate or customer participation decision. Existing consent records are left unchanged. Account participation controls are deferred and the settings screen displays the active testing mode.

This mode does not revive explicitly revoked knowledge or erased sources. Source/account deletion, restricted provenance, retention limits, private tenant isolation and stock-posting safeguards continue to apply. Switching the mode off makes testing-derived knowledge ineligible immediately for new decisions and unposted automatic mappings. The existing testing review deadline of 9 November 2026 remains. Provider and legal review remain pending. This operational instruction is not a statement of GDPR compliance.

**Română:** Pe durata modului explicit de testare pentru toate conturile, învățarea și reutilizarea automată sunt active fără activarea contribuției, confirmarea permisiunilor sau aprobarea drepturilor asupra sursei de către operator. Proprietarul platformei a cerut amânarea acestor verificări. Identificatorii exacți și compatibili din documente pot crea automat o identitate de furnizor marcată pentru testare, fără a pretinde verificare independentă. Nu se inventează consimțăminte sau aprobări juridice. Prețurile și datele private sunt excluse din catalog; ștergerea surselor/conturilor, limitele de păstrare și verificările de corectitudine rămân active. Opțiunile de participare sunt amânate în timpul testării. Dezactivarea modului oprește utilizarea datelor provenite din testare pentru decizii noi. Revizuirea juridică și a furnizorilor rămâne în așteptare, cu termenul de testare existent: 9 noiembrie 2026. Amendamentul are prioritate față de cerințele de participare și aprobare de mai jos numai în acest mod.

## Authorization and review record

The platform owner instructed Codex on 10 October 2026 to write the policies, exclude prices and enable testing for **all accounts**, with policy review afterward. Operating authorization reference: `owner-chat-2026-10-10-all-accounts`. This records that instruction; it is not a lawyer's opinion, a provider contract, or an assertion of GDPR compliance. Legal/provider review remains **pending**. New customer contribution is time-limited to 9 November 2026 at 23:59:59 UTC, after which collection and reuse of customer-derived knowledge fail closed until a reviewed policy is implemented. Separately cleared catalog use is independent of customer participation.

## Purpose, roles and lawful processing

The purpose is recognition of supplier products and document layouts, not comparison of customer purchasing activity, prices, margins, order volumes or stock choices. LYVO processes private account documents on the customer's instructions. The customer remains responsible for its lawful collection of document data and statutory accounting duties. LYVO determines the purpose of the optional shared-recognition catalog and must assess its controller obligations separately; a processor contract alone does not authorize this distinct purpose.

An owner's voluntary authorization is a contractual instruction for reviewing permitted business information, not blanket GDPR consent on behalf of every person named in a document. Do not rely on that authorization to publish personal data, sole-trader identifiers, confidential terms, copyrighted source pages or third-party material without rights. The allowed supplier identity is a verified company identity. An actual source-rights record and a current permission are required for each contribution. Source-rights approval remains independent. Deterministic physical facts from eligible completed documents can pass the automatic validation procedure below; changes, ambiguity and unsupported facts require publication review. The reviewer must check the actual rights evidence; an arbitrary UUID or a box tick is not evidence of a licence. A lawful-basis assessment is required if personal data is still involved in restricted provenance. None has been falsely recorded as completed for this testing release.

## Shared content boundary

Allow only verified company supplier identity, exact supplier SKU and variant identity, non-personal product description, physical pack facts, and typed document-layout rules. A layout rule can label a price column; it cannot contain an observed price. Reject unknown fields rather than silently dropping them. Exclude all prices, discounts, VAT amounts, financial totals, purchased quantities, payment details, customer identities, invoice/credit/delivery references, images, OCR source text/rows, file hashes, account/shop/document IDs and private stock IDs/names. Private accounting retains prices and quantities; owner exports include those private values.

Customer-linked provenance remains restricted personal data where linkable. Do not call it anonymous merely because prices were removed. Reliable product-pack knowledge can automatically establish a private mapping or create a private stock item within the receiving account and location, subject to its automation settings. Ambiguous existing products and explicit private choices are not overwritten. The receiving customer does not have to contribute or confirm every known line. Variable-weight products always use the measured quantity on the private document.

## Automated processing amendment — 10 October 2026

The owner clarified that routine recognition must require neither customer nor operator setup for each product. This amendment changes the validation workflow, not the purpose, shared data categories, source-rights requirements, participation choice, retention schedule or pending legal/provider review.

Verified supplier identifiers can bind a customer's private supplier to exactly one existing verified company/division. Names alone, unknown identifier semantics and multiple divisions do not establish that link. An explicit unlink is respected. A newly recognised exact SKU can apply its supported pack and resolve or create the receiving customer's private item automatically; this is recorded as a system decision, never as a human confirmation. Current-document pack conflicts and unresolved reading evidence still stop automatic receipt. Credits reuse existing items and retain their separate evidence about whether stock actually leaves.

A bounded background worker examines historical and newly completed documents. It requires owner participation, an independently approved current permission for that account and supplier, and a verified supplier namespace. It never creates rights permissions. The product description passes the strict shared schema and additional private-text screening; the document must explicitly support the full physical pack, agree with the successful private conversion and have no unresolved reading issue. Shared-derived facts are not recycled as independent evidence. First publication and restricted source provenance are committed atomically, with the current private binding rechecked, and marked `automatic_physical_v1`. Existing versions, conflicts and revoked records are not replaced by this worker. Templates and manually proposed changes retain their existing publication review.

The worker calls no AI or OCR provider and exports no document rows, prices, bought quantities, customer identities or private inventory IDs. Withdrawal and deletion fence automatically learned facts through the same permission, participation and source lifecycle as reviewed contributions. Unposted automatic decisions recheck current knowledge before stock posting. Completed private accounting is not rewritten.

## Customer terms addendum — English

1. Catalog use does not require contribution and does not give other customers access to your documents, prices, stock mappings or account.
2. Contribution starts off. Only the real account owner may enable it after reading the versioned notice. Managers, staff, device sessions and support impersonation cannot opt in. The decision is recorded with policy version, actor, time and an idempotent operation reference.
3. By opting in you instruct LYVO to review only information that you are entitled to contribute for this stated purpose. You grant no right to publish personal information or confidential commercial values. Source-rights approval remains mandatory. Eligible completed documents can teach physical facts automatically after deterministic checks; unsupported or conflicting facts need review.
4. You may withdraw in Settings → Data & recognition, including with a locked subscription. Withdrawal blocks collection and reuse immediately, cancels queued work and removes dependent shared revisions through a retryable process. It does not erase private accounting.
5. Deleting a document or source line withdraws contributions associated with it; deleting an account fences contributions before any dependency is removed. A permission reused across several documents is conservatively withdrawn as a whole. Only separately sourced and approved facts survive. LYVO does not invent independent support to retain customer-derived material.
6. Historic private accounting snapshots remain unchanged. If deletion removes relevant pack history, recognition returns to review instead of assuming that today's pack always applied.
7. Export is available to the owner without a paid-plan gate. The ZIP includes tenant inventory records, participation, bindings, candidates, permissions and retained private files/evidence; credentials and internal support identities are removed. Other tenants' data is excluded. The legacy temperature-series export is limited to 50,000 rows and identifies this limitation; larger series require a separate export. This is not a claim that every possible access request is automatically satisfied by the ZIP.
8. Requests for access, correction, objection, restriction and erasure follow the privacy contact in LYVO's main notice. Subscription cancellation and account erasure are distinct. The hard-delete process begins 30 days after the erasure request and retries failures; any documented hold must specify its scope, authority, record and expiry.

## Anexa pentru clienți — Română

1. Folosirea catalogului nu impune contribuția și nu oferă altor clienți acces la documentele, prețurile, asocierile de stoc sau contul tău.
2. Contribuția este dezactivată implicit. Doar proprietarul real al contului o poate activa după citirea informării cu versiune. Managerii, personalul, dispozitivele și sesiunile de asistență în numele clientului nu pot activa contribuția. Se înregistrează versiunea politicii, autorul, momentul și referința unică a deciziei.
3. Prin activare, instruiești LYVO să verifice numai informațiile pe care ai dreptul să le contribui în scopul declarat. Nu se acordă dreptul de a publica informații personale sau valori comerciale confidențiale. Aprobarea drepturilor asupra sursei rămâne obligatorie. Documentele eligibile finalizate pot furniza automat date despre ambalaje după verificări deterministe; informațiile nesusținute sau contradictorii necesită verificare.
4. Poți retrage contribuția din Setări → Date și recunoaștere, inclusiv cu abonamentul blocat. Retragerea oprește imediat colectarea și reutilizarea, anulează lucrările în așteptare și elimină versiunile comune dependente printr-un proces cu reîncercări. Contabilitatea privată se păstrează.
5. Ștergerea unui document sau a unui rând-sursă retrage contribuțiile asociate; ștergerea contului blochează contribuțiile înaintea eliminării dependențelor. Dacă o permisiune este folosită pentru mai multe documente, se retrage conservator întreaga permisiune. Pot rămâne numai informațiile aprobate separat din surse independente. LYVO nu inventează dovezi independente pentru păstrarea contribuțiilor.
6. Copiile istorice din contabilitatea privată nu se modifică. Dacă ștergerea elimină istoricul relevant al ambalajelor, produsul revine la verificare, fără presupunerea că ambalajul actual s-a aplicat întotdeauna.
7. Proprietarul poate exporta fără condiția unui abonament plătit. Arhiva include datele de inventar ale contului, participarea, legăturile, candidații, permisiunile și fișierele/dovezile private păstrate. Credențialele și identitățile interne ale personalului de asistență sunt eliminate. Datele altor conturi sunt excluse. Exportul existent de temperaturi are limita declarată de 50.000 de rânduri; seriile mai mari necesită export separat. Arhiva nu este prezentată ca îndeplinind automat orice cerere posibilă de acces.
8. Cererile de acces, rectificare, opoziție, restricționare și ștergere se transmit contactului din politica principală. Anularea abonamentului și ștergerea contului sunt distincte. Ștergerea definitivă începe după 30 de zile de la cerere și reîncearcă operațiunile eșuate. Orice excepție documentată trebuie să precizeze domeniul, autoritatea, evidența și expirarea.

## Retention schedule and rationale

These are selected operational periods, not legally prescribed periods and not substitutes for a customer-specific accounting schedule. Cleanup runs every minute in bounded batches; failures remain pending and do not restore reuse eligibility.

| Record | Period / event | Reason and handling |
|---|---|---|
| Pending candidate / customer-derived reuse | At most 30 days, and never past source permission or pilot deadline | Short review window; publication does not create perpetual reuse rights |
| Rejected or cancelled candidate | 7 days after rejection/cancellation | Brief correction/diagnostic window; then withdraw and remove associated payload |
| Restricted provenance and terminal publication receipts | 180 days after withdrawal | Investigate disputes and demonstrate withdrawal; no source image or price in the journal |
| Shared operational audit | 90 days | Access/security investigation; actor ID and action only, no email/IP/source payload |
| Participation decision history | 365 days | Show instruction and withdrawal history; latest current preference remains until changed or account erasure |
| Erasure/restore-denial records | 180 days after completion, plus a verified backup-destruction checkpoint | Prevent resurrecting erased contributions. A missing checkpoint is an explicit operational exception requiring owner review, not an invented confirmation that backups have expired |
| Private documents and retained Azure evidence | Account/document lifecycle; not copied into catalog | Opt-out alone does not remove accounting; source deletion removes working/original images and retained reader responses before row deletion |
| Legal hold | Maximum 90 days per documented review | Restricted evidence only; named record and scope required; expiry/release permits cleanup; never permits reuse |

Hold APIs are restricted to back-office admins: `POST /api/admin/shared-recognition/privacy/holds` and `POST /api/admin/shared-recognition/privacy/holds/:id/release`. A hold is not created automatically for every account. Renewals require a new documented decision. No indefinite general compliance hold is implied.

## Processor and provider record — English / Română

VPS inspection run `38060265699`, 10 October 2026, confirmed Azure Document Intelligence configured, OpenAI configured, Anthropic not configured, R2 storage configured, and raw invoice-read logging enabled before this release. Activation disables new raw invoice-read logs. Existing provider/PM2 logs and external backups require separate inventory; this release does not falsely claim to have erased historical provider copies.

Inspecția VPS a confirmat Azure Document Intelligence, OpenAI și stocarea R2; Anthropic nu era configurat. Activarea oprește noile jurnale brute de citire a documentelor. Copiile istorice din jurnalele furnizorilor, PM2 și copiile de siguranță externe necesită inventariere separată; această versiune nu afirmă că le-a șters.

| Provider / Furnizor | Actual role / Rol | Evidence limits / Limite |
|---|---|---|
| Microsoft Azure Document Intelligence | Private OCR/document analysis / Analiza privată a documentelor | Azure region is not declared in deployed environment; no verified account DPA, region or transfer review record supplied / Regiunea și evaluarea contractuală nu sunt confirmate |
| OpenAI API | Configured AI assistance; code defaults to OpenAI when its key is present / Asistență AI configurată | Account-specific retention, residency, DPA and transfer settings not inspected; do not claim zero retention / Nu se promite păstrare zero |
| Cloudflare R2 | Private document/evidence bytes / Fișiere și dovezi private | Bucket jurisdiction and provider contract review remain unverified / Jurisdicția bucketului și evaluarea contractului sunt neconfirmate |

The contribution outbox itself makes no external model/OCR calls. Existing private AI/document processing remains governed by its own provider configuration. Before extending testing beyond the review date, record the actual legal entity/controller details, source-rights procedure, lawful-basis assessment, signed DPAs/subprocessor terms, deployed jurisdictions, transfer mechanism and assessment where required, provider retention settings, and backup deletion inventory. Public provider documentation is evidence of general service terms, not evidence that LYVO purchased/configured a particular option.

Procesul de contribuție nu face apeluri externe AI/OCR. Prelucrarea privată existentă urmează propria configurație. Înaintea prelungirii testării, trebuie înregistrate entitatea juridică și rolurile, procedura drepturilor asupra surselor, temeiul legal, acordurile de prelucrare, jurisdicțiile instalate, mecanismele și evaluările transferurilor când sunt necesare, retenția furnizorilor și inventarul copiilor de siguranță. Documentația publică nu dovedește setările sau contractele contului LYVO.

## Sources checked on 10 October 2026

- [GDPR official text](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng/): purpose limitation, minimization, storage limitation, controller/processor duties and data-subject rights.
- [ICO storage limitation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/): retention needs justification; no universal duration is prescribed.
- [ICO erasure guidance](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/): backup handling must support erasure and prevent restored use.
- [Microsoft Document Intelligence FAQ](https://learn.microsoft.com/en-us/azure/ai-services/document-intelligence/faq?view=doc-intel-3.1.0): general document-analysis retention information; not a verification of this Azure resource's region or contract.
- [OpenAI API data controls](https://developers.openai.com/api/docs/guides/your-data): account/service retention settings matter; default abuse-monitoring retention can apply.
- [Cloudflare R2 localization](https://developers.cloudflare.com/data-localization/how-to/r2/) and [Cloudflare DPA](https://www.cloudflare.com/cloudflare-customer-dpa/): jurisdiction restrictions require appropriate configuration; no EU-only claim is inferred from using R2.