Privacy Policy
Last updated: 2026-04-07
1. Identity of the data controller
The data controller responsible for processing your personal data is [ĮMONĖS PAVADINIMAS], registered at [REGISTRUOTAS ADRESAS], Lithuania. Contact: privacy@[yourdomain.com].
2. What personal data we collect
- Account data: name, email address, profile picture (from Google / Microsoft OAuth).
- Company assignment: which company account you belong to.
- Sign-in records: time, sign-in method (OAuth or administrator), IP address.
- Technical data: browser user-agent string, recorded at administrator sign-in.
3. How data is collected
- Directly from you: when you sign in via Google or Microsoft OAuth.
- Automatically: IP address and user agent are recorded at each sign-in for security purposes.
- From third parties: Google and Microsoft provide your name, email address and profile picture during authentication.
4. Why we process data (purpose and legal basis)
| Purpose | Legal basis |
|---|---|
| Authenticating you and maintaining your session | Performance of a contract |
| Assigning you to a company and managing access to tank trucks / data | Performance of a contract |
| Logging sign-ins to detect abuse and protect the platform | Legitimate interests (security) |
| Sending status notifications (account approved / rejected) | Performance of a contract |
5. Who we share data with
We do not sell your personal data. We share it only with:
- Google LLC — OAuth authentication provider (Google sign-in). Google Privacy Policy.
- Microsoft Corporation — OAuth authentication provider (Microsoft Entra ID). Microsoft Privacy Statement.
- Hosting infrastructure: our VPS provider processes data as a data processor under a data processing agreement.
6. International transfers
Google and Microsoft may process data outside the EEA. Both companies participate in the EU–US Data Privacy Framework and use Standard Contractual Clauses (SCCs) as a transfer safeguard. All other data is stored on servers located in the EU.
7. Retention periods
| Data category | Retention period |
|---|---|
| User account (name, email, status) | Duration of the contract + 30 days after account deletion |
| Sign-in logs (IP, time, user agent) | 90 days |
| Cookie consent record | 12 months |
8. Your rights
Under the GDPR you have the right to:
- Access — request a copy of your personal data.
- Rectification — correct inaccurate data.
- Erasure — request deletion of your data (“right to be forgotten”).
- Restriction — request that processing be temporarily suspended while a dispute is resolved.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interests.
To exercise any of these rights, email privacy@[yourdomain.com]. We will respond within 30 days.
9. Automated decision-making
We do not use automated decision-making or profiling that has legal or similarly significant effects on you. Access approval and company assignment are carried out manually by an administrator.
10. How we protect your data
- All data is transmitted over HTTPS (TLS 1.2+).
- Session tokens are cryptographically signed (HMAC-SHA256).
- Administrator sign-in is protected by a password and TOTP two-factor authentication.
- Rate limiting and IP-based abuse detection run on all authentication endpoints.
- The database is not publicly accessible — it is bound only to the internal Docker network.
11. How to lodge a complaint
You have the right to lodge a complaint with the Lithuanian supervisory authority:
State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI)
L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania
vdai.lrv.lt
12. Changes to this policy
Registered users will be notified of material changes by email at least 14 days before they take effect. The “Last updated” date at the top of this page always reflects the current version.
13. Contact
For privacy-related questions: privacy@[yourdomain.com]