Privacy Policy

This privacy policy complies with the EU General Data Protection Regulation (GDPR) 2016/679 and applicable Lithuanian data protection law.

1. Data Controller

The controller of your personal data is the developer and operator of the AgroLITix app:

Legal entity: MB "Lanksti reklama"
Company registration number: 307027540
Registered office: Giedraičių g. 39, R53, LT-09302 Vilnius, Republic of Lithuania
Legal form: small partnership (mažoji bendrija), registered in the Register of Legal Entities of the Republic of Lithuania on 14 November 2024
Representative: Deividas Jackis, Director
Email (privacy and general support): info@agrolitix.lt
Phone: +370 636 82177

We do not appoint a dedicated Data Protection Officer (DPO), as we are a small-scale controller not subject to the mandatory appointment obligation under GDPR Article 37. All data protection questions can be directed to the contacts above.

2. Data We Collect

2.1 Data you provide directly

Registration: email address, first and last name.
Google sign-in: email address, name, profile picture (only if you sign in via Google).
Sign in with Apple: a stable Apple user identifier, email address and name. Apple supplies the name only on the very first sign-in. If you choose "Hide My Email", you get an Apple-generated relay address (domains privaterelay.appleid.com, icloud.com or the newer private.icloud.com) and we never see your real address. We also store an encrypted Apple session refresh token, without which we could not revoke the Apple sign-in when you delete your account.
Farm data: farm name, field names, boundary coordinates (GPS), areas, yields, seasonal records.
Activity log: planting, fertilising, spraying and other field activity entries.
Documents: PDFs, photos, contracts and other farm-related files you upload.
AI assistant: conversation history with the AI, including your questions and system responses.

2.2 Automatically collected data

Device type, operating system and version.
App version.
App installation identifier and push notification token when you enable push notifications.
Crash logs for system stability.
Usage journal: how many times you opened the app's screens and pressed a few marked buttons during a period, together with the platform and app version. Only screen names from a fixed allowlist are counted. The journal contains none of your typed text, field data, documents or conversations.
Login timestamps and IP address (to prevent unauthorised access).

3. Purposes and Legal Bases

Purpose	Legal basis
Account creation and management	Performance of contract (GDPR Art. 6(1)(b))
Providing app features (maps, plans, documents)	Performance of contract
AI assistant operation (processing conversations and generating responses)	Performance of contract; legitimate interest – service improvement
Technical error diagnostics	Legitimate interest – service stability
App usage statistics: which screens are used most	Legitimate interest – understanding which features are worth improving (GDPR Art. 6(1)(f))
Security: fraud prevention and unauthorised access detection	Legitimate interest – protecting the system and users
Website audience analytics and advertising campaign measurement	Your consent (GDPR Art. 6(1)(a))
Measuring the app installation source and initial product outcomes using Google Play Install Referrer campaign tags	Legitimate interest – evaluating our own campaign effectiveness and improving onboarding (GDPR Art. 6(1)(f))
Attributing a verified registration and the first created field to a Meta advertising campaign through the server-side Conversions API	Your marketing consent (GDPR Art. 6(1)(a))

Direct marketing messages (e.g. newsletters) require your separate consent, which you may withdraw at any time.

4. Data Sharing and Processors

Your data is not sold. It is shared only with the following processors, to the minimum extent necessary:

Provider	Purpose	Data location
Supabase, Inc.	Database, authentication, file storage	EU (Frankfurt, DE)
OpenAI, Inc.	AI assistant conversation processing	USA (SCCs in place)
Google LLC	Google account sign-in (OAuth), Firebase Cloud Messaging delivery, Google Play Install Referrer installation-source tags and, only with your consent, website analytics through Google Analytics 4	USA / EU (SCCs in place)
Apple Inc.	iOS app only: Sign in with Apple identity verification, the private email relay (if you chose to hide your address) and APNs push delivery. Farm data, documents and AI conversations are never shared with Apple.	EU / USA (under SCCs)
Meta Platforms Ireland Limited	Only with your consent – advertising attribution through Meta Pixel and the server-side Conversions API. For registration and first-field events, the email address is sent only as a SHA-256 hash; passwords, farm data and field content are not sent.	EU / USA (applicable transfer safeguards)

All processors have signed Data Processing Agreements (DPAs), comply with GDPR and are contractually required to provide protection of your data no lower than the level stated in this policy. Transfers to the USA are made under the European Commission's Standard Contractual Clauses (SCCs) pursuant to GDPR Article 46(2)(c).

5. Data Retention

Account and farm data – retained until account deletion, then deleted within 30 days (backups purged within 90 days).
AI assistant conversation history – automatically deleted after 180 days from each conversation.
Crash logs (technical) – retained for 90 days.
Security / login logs – retained for 90 days.
Usage journal – kept for as long as you use the account and deleted together with it.
Apple session refresh token – stored encrypted for as long as you use the account. On deletion we first use it to revoke the Sign in with Apple session, then delete it.

6. Your Rights

As an EU data subject, you have the following rights:

Right of access (Art. 15) – obtain confirmation of whether your data is processed and receive a copy.
Right to rectification (Art. 16) – request correction of inaccurate or incomplete data.
Right to erasure (Art. 17) – request deletion of your data ("right to be forgotten") when no longer necessary for the original purpose.
Right to restriction (Art. 18) – restrict processing in certain circumstances.
Right to data portability (Art. 20) – receive your data in a structured, machine-readable format (JSON).
Right to object (Art. 21) – object to processing based on legitimate interest or for direct marketing.
Right to withdraw consent – withdraw previously given consent at any time without affecting the lawfulness of prior processing.

To exercise these rights, write to: info@agrolitix.lt. We will respond within 30 days (extendable to 90 days for complex requests, with notification).

7. AI Assistant and Automated Processing

The AgroLITix AI assistant uses OpenAI large language models (GPT series) to generate agronomic recommendations. Important disclosures:

AI recommendations are informational only and do not replace professional agronomic advice.
When conversation content is sent to OpenAI, only the conversation text and your selected field data (area, crops, notes) are transmitted. No personally identifying information (email, name) is included in API requests.
Your data is not used to train OpenAI models – this is guaranteed under our OpenAI Data Processing Agreement (DPA).
We do not use automated decision-making that produces legal or similarly significant effects (GDPR Art. 22).

8. Data Security

All data is transmitted over encrypted connections (HTTPS / TLS 1.3).
Passwords are stored using strong one-way hashing (bcrypt).
The database is hosted on Supabase in the EU (Frankfurt) with encryption at rest (AES-256).
Access to production data is restricted on a least-privilege basis.
Regular backups are performed.

In the event of a data breach posing a high risk to your rights and freedoms, we will notify you and the supervisory authority within 72 hours (GDPR Art. 33–34).

9. Cookies

The mobile app does not use cookies or third-party behavioural analytics or advertising SDKs. The website agrolitix.lt uses necessary cookies for language and privacy preferences.

The Android app reads Google Play Install Referrer campaign tags (such as campaign and ad variant) once and links them to a newly created account. It does not collect advertising-view history or activity in other apps.

The iOS app does not use the advertising identifier (IDFA), never shows an App Tracking Transparency prompt and collects no campaign tags: we do not track you across apps or websites.

Google Analytics 4 analytics and Meta marketing measurement (Meta Pixel and Conversions API) are enabled only when you select the corresponding analytics or marketing consent. If you install the app from Google Play after giving marketing consent, two completed outcomes may be linked to the campaign: a verified registration and the first created field. You may change your choice at any time through “Cookie settings” in the website footer. After consent is withdrawn, new non-essential measurement data is no longer collected.

10. Children's Privacy

AgroLITix is intended for adults and is not intended for persons under 18 years of age. We do not knowingly collect data from minors. If you believe such an account exists, please contact info@agrolitix.lt immediately – we will delete it.

11. Supervisory Authority

If you believe your data is being processed in violation of GDPR, you may lodge a complaint with the supervisory authority:

State Data Protection Inspectorate (VDAI), Lithuania
A. Juozapavičiaus g. 6, LT-09310 Vilnius
Tel.: +370 5 279 1445
Email: ada@ada.lt | vdai.lrv.lt/en

We encourage you to contact us first – we resolve most issues promptly and directly.

12. Changes to This Policy

We will notify you of material changes by email and in-app notification at least 30 days before they take effect. Continued use after the effective date constitutes acceptance of the updated policy.

13. Contact

MB "Lanksti reklama", company registration number 307027540
Giedraičių g. 39, R53, LT-09302 Vilnius, Republic of Lithuania
Privacy enquiries: info@agrolitix.lt
General support: info@agrolitix.lt
Phone: +370 636 82177