Privacy Policy

1. Data Controller and Operator

MB "Lanksti reklama" operates AgroLITix. It acts as controller for its account administration, own communications and service security. When a farm processes employee or other people's data for its own purposes, the farm may act as controller and MB as processor following its instructions. The role depends on the processing operation.

Legal entity: MB "Lanksti reklama"
Company registration number: 307027540
Registered office: Giedraičių g. 39, R53, LT-09302 Vilnius, Republic of Lithuania
Legal form: small partnership (mažoji bendrija), registered in the Register of Legal Entities of the Republic of Lithuania on 14 November 2024
Representative: Deividas Jackis, Director
Email (privacy and general support): info@agrolitix.lt
Phone: +370 636 82177

Please direct data protection enquiries to the contacts above.

2. Data We Collect

2.1 Data you provide directly

• Registration: email address, first and last name.
• Google sign-in: email address, name, profile picture (only if you sign in via Google).
• Sign in with Apple: a stable Apple user identifier, email address and name. Apple supplies the name only on the very first sign-in. If you choose "Hide My Email", you get an Apple-generated relay address (domains privaterelay.appleid.com, icloud.com or the newer private.icloud.com) and we never see your real address. We also store an encrypted Apple session refresh token, without which we could not revoke the Apple sign-in when you delete your account.
• Farm data: farm name, field names, boundary coordinates (GPS), areas, yields, seasonal records.
• Activity log: planting, fertilising, spraying and other field activity entries.
• Documents: PDFs, photos, contracts and other farm-related files you upload.
• Employees and farm contacts: names, roles, contact details, notes and work assignments entered by you.
• Voice and image features: submitted audio, transcriptions, photos and system-generated context.
• Support and feedback: messages, submitted screenshots, account and organisation identifiers and technical data.
• AI assistant: conversation history with the AI, including your questions and system responses.

2.2 Automatically collected data

• Device type, operating system and version.
• App version.
• App installation identifier and push notification token when you enable push notifications.
• Crash logs for system stability.
• Usage journal: how many times you opened the app's screens and pressed a few marked buttons during a period, together with the platform and app version. Only screen names from a fixed allowlist are counted. The journal contains none of your typed text, field data, documents or conversations.
• Login timestamps and IP address (to prevent unauthorised access).

3. Purposes and Legal Bases

Direct marketing messages (e.g. newsletters) require your separate consent, which you may withdraw at any time.

4. Recipients and Data Transfers

We use the external providers listed below to deliver the service. Their roles depend on the particular service and processing purpose. Our self-hosted Supabase components run on Hostinger infrastructure; using the software does not itself mean that data is sent to Supabase Cloud.

Some providers use global infrastructure, so processing may take place outside the European Economic Area, including in the USA. The location of the main database and the processing locations of external services are separate matters.

Transfers outside the EEA are subject to GDPR Chapter V. Depending on the recipient and transfer chain, the basis may be an adequacy decision or appropriate safeguards such as Standard Contractual Clauses. You may request information about the safeguards applicable to a particular transfer and copies of them at info@agrolitix.lt.

5. Data Retention

• Account and farm data – retained until account deletion, then deleted within 30 days (backups purged within 90 days).
• AI assistant conversation history – subject to a 180-day retention period from the conversation, after which the data must be deleted.
• Crash logs (technical) – retained for 90 days.
• Security / login logs – retained for 90 days.
• Usage journal – kept for as long as you use the account and deleted together with it.
• Apple session refresh token – stored encrypted for as long as you use the account. On deletion we first use it to revoke the Sign in with Apple session, then delete it.

6. Your Rights

As an EU data subject, you have the following rights:

• Right of access (Art. 15) – obtain confirmation of whether your data is processed and receive a copy.
• Right to rectification (Art. 16) – request correction of inaccurate or incomplete data.
• Right to erasure (Art. 17) – request deletion of your data ("right to be forgotten") when no longer necessary for the original purpose.
• Right to restriction (Art. 18) – restrict processing in certain circumstances.
• Right to data portability (Art. 20) – where GDPR Article 20 applies, receive portable data in a structured, commonly used and machine-readable format.
• Right to object (Art. 21) – object to processing based on legitimate interest or for direct marketing.
• Right to withdraw consent – withdraw previously given consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, write to: info@agrolitix.lt. We respond without undue delay and within one month of receipt. Where necessary because of the complexity and number of requests, this may be extended by two further months. We inform you of the extension and its reasons within the first month. Where necessary, we request additional information to confirm your identity.

7. AI Features and Data Processing

AI features use OpenAI services. Depending on the feature, requests, conversation excerpts, system-generated farm context, document text or excerpts, images and audio may be transmitted. Context may include field, plan, work, inventory, employee and equipment records. Names, contact details or other personal data in that content may also be processed.

Document text may be sent for AI search indexing when it is uploaded, before you ask a question about the document. Remove personal data that is unnecessary for the feature before uploading.

Under OpenAI’s default API policy, customer content is not used for model training unless the customer opts in to sharing data for that purpose. Training and retention are separate: content may be retained for abuse monitoring or a particular feature. Rules depend on the endpoint and settings; see OpenAI data controls.

AI answers are supporting information and may be inaccurate. Check calculations, current product labels, use restrictions and actual field conditions before applying a recommendation. Agronomic advice is not, by itself, a decision about a person under GDPR Article 22.

8. Data Security

• The public website and API use HTTPS.
• Passwords use the bcrypt hashing function.
• The main infrastructure is hosted on Hostinger with self-hosted Supabase components.
• Periodic backups are made.

A personal data breach is reported to the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless it is unlikely to result in a risk to individuals’ rights and freedoms. Where a breach is likely to result in a high risk, affected people are informed without undue delay, subject to statutory exceptions. When acting as processor, MB informs the controller without undue delay.

9. Cookies

The mobile app does not use cookies or third-party behavioural analytics or advertising SDKs. The website agrolitix.lt uses necessary cookies for language and privacy preferences.

The Android app reads Google Play Install Referrer campaign tags (such as campaign and ad variant) once and links them to a newly created account. It does not collect advertising-view history or activity in other apps.

The app has two optional choices, both off at first: “App usage analytics (Google)” and “Advertising measurement (Meta)”. You can tick them in the sign-up form or change them at any time in the app settings. The app works the same if you leave them off.

With analytics on, Google Analytics for Firebase receives app usage events: screens opened, buttons pressed, the sign-up method and technical device data. The content of your fields, jobs, documents and chats is not sent. Until you allow it, analytics is switched off.

With advertising measurement on, Meta may receive the app install, verified registration and first created field events, a SHA-256 hash of the account email, a hash of the internal account identifier, the platform, app and operating system versions, device model, language, time zone, screen data, a random app installation identifier, the device advertising identifier (Android advertising ID or iPhone IDFA), the iPhone identifier for vendor, the Google Play install referrer and the IP address the choice was saved from. If the phone limits ad tracking, the advertising identifier is not sent. When you withdraw consent, the advertising identifiers and the IP address are deleted. This shows which advertisement brought the user. With it on, the app also switches on Meta's app SDK, which itself reports the install and app opens with the same device data. Without consent the SDK stays off and does not contact Meta.

On an iPhone, Apple itself asks about advertising measurement by showing its App Tracking Transparency prompt once. Data is sent to Meta only if you choose “Allow”. You can change the permission in iPhone Settings (Privacy > Tracking) or in the app settings.

When you switch a choice off, no new data is sent. Change the website choice through “Cookie settings” in the footer. The website and app choices are separate.

10. Children's Privacy

AgroLITix is intended for adults and is not intended for persons under 18 years of age. We do not knowingly collect data from minors. If you believe such an account exists, please contact info@agrolitix.lt immediately – we will delete it.

11. Supervisory Authority

If you believe your data is being processed in violation of GDPR, you may lodge a complaint with the supervisory authority:

State Data Protection Inspectorate (VDAI), Lithuania
L. Sapiegos g. 17, LT-10312 Vilnius
Tel.: +370 5 279 1445
Email: ada@ada.lt  |  vdai.lrv.lt/en

You may contact the supervisory authority directly; contacting us first is not required. You may also send your enquiry to us if you prefer.

12. Changes to This Policy

We will notify you of material changes by email and in-app notification at least 30 days before they take effect. Reading this policy or continuing to use the service is not itself consent to processing that requires separate consent. This update clarifies existing data flows and statutory requirements.

13. Contact

MB "Lanksti reklama", company registration number 307027540
Giedraičių g. 39, R53, LT-09302 Vilnius, Republic of Lithuania
Privacy enquiries: info@agrolitix.lt
General support: info@agrolitix.lt
Phone: +370 636 82177

Previous version: Privacy policy dated 2026-08-26.