Privacy Policy

1. Data Controller

The controller of your personal data is the developer and operator of the AgroLITix app:

Name: Deividas Jackis
Privacy email: privacy@agrolitix.lt
General support: pagalba@agrolitix.lt

We do not appoint a dedicated Data Protection Officer (DPO), as we are a small-scale processor not subject to the mandatory appointment obligation under GDPR Article 37. All data protection questions can be directed to the email above.

2. Data We Collect

2.1 Data you provide directly

• Registration: email address, first and last name.
• Google sign-in: email address, name, profile picture (only if you sign in via Google).
• Farm data: farm name, field names, boundary coordinates (GPS), areas, yields, seasonal records.
• Activity log: planting, fertilising, spraying and other field activity entries.
• Documents: PDFs, photos, contracts and other farm-related files you upload.
• AI assistant: conversation history with the AI, including your questions and system responses.

2.2 Automatically collected data

• Device type, operating system and version.
• App version.
• App installation identifier and push notification token when you enable push notifications.
• Crash logs for system stability.
• Login timestamps and IP address (to prevent unauthorised access).

3. Purposes and Legal Bases

Direct marketing messages (e.g. newsletters) require your separate consent, which you may withdraw at any time.

4. Data Sharing and Processors

Your data is not sold. It is shared only with the following processors, to the minimum extent necessary:

All processors have signed Data Processing Agreements (DPAs) and comply with GDPR. Transfers to the USA are made under the European Commission's Standard Contractual Clauses (SCCs) pursuant to GDPR Article 46(2)(c).

5. Data Retention

• Account and farm data — retained until account deletion, then deleted within 30 days (backups purged within 90 days).
• AI assistant conversation history — automatically deleted after 180 days from each conversation.
• Crash logs (technical) — retained for 90 days.
• Security / login logs — retained for 90 days.

6. Your Rights

As an EU data subject, you have the following rights:

• Right of access (Art. 15) — obtain confirmation of whether your data is processed and receive a copy.
• Right to rectification (Art. 16) — request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) — request deletion of your data ("right to be forgotten") when no longer necessary for the original purpose.
• Right to restriction (Art. 18) — restrict processing in certain circumstances.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format (JSON).
• Right to object (Art. 21) — object to processing based on legitimate interest or for direct marketing.
• Right to withdraw consent — withdraw previously given consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, write to: privacy@agrolitix.lt. We will respond within 30 days (extendable to 90 days for complex requests, with notification).

7. AI Assistant and Automated Processing

The AgroLITix AI assistant uses OpenAI large language models (GPT series) to generate agronomic recommendations. Important disclosures:

• AI recommendations are informational only and do not replace professional agronomic advice.
• When conversation content is sent to OpenAI, only the conversation text and your selected field data (area, crops, notes) are transmitted. No personally identifying information (email, name) is included in API requests.
• Your data is not used to train OpenAI models — this is guaranteed under our OpenAI Data Processing Agreement (DPA).
• We do not use automated decision-making that produces legal or similarly significant effects (GDPR Art. 22).

8. Data Security

• All data is transmitted over encrypted connections (HTTPS / TLS 1.3).
• Passwords are stored using strong one-way hashing (bcrypt).
• The database is hosted on Supabase in the EU (Frankfurt) with encryption at rest (AES-256).
• Access to production data is restricted on a least-privilege basis.
• Regular backups are performed.

In the event of a data breach posing a high risk to your rights and freedoms, we will notify you and the supervisory authority within 72 hours (GDPR Art. 33–34).

9. Cookies

The mobile app does not use cookies or third-party behavioural analytics or advertising SDKs. The website agrolitix.lt uses necessary cookies for language and privacy preferences. Analytics cookies are enabled only after your explicit consent in the cookie banner; no advertising cookies are used.

10. Children's Privacy

AgroLITix is intended for adults and is not intended for persons under 18 years of age. We do not knowingly collect data from minors. If you believe such an account exists, please contact privacy@agrolitix.lt immediately — we will delete it.

11. Supervisory Authority

If you believe your data is being processed in violation of GDPR, you may lodge a complaint with the supervisory authority:

State Data Protection Inspectorate (VDAI), Lithuania
A. Juozapavičiaus g. 6, LT-09310 Vilnius
Tel.: +370 5 279 1445
Email: ada@ada.lt  |  vdai.lrv.lt/en

We encourage you to contact us first — we resolve most issues promptly and directly.

12. Changes to This Policy

We will notify you of material changes by email and in-app notification at least 30 days before they take effect. Continued use after the effective date constitutes acceptance of the updated policy.

13. Contact

Privacy enquiries: privacy@agrolitix.lt
General support: pagalba@agrolitix.lt