Privacy

The controller is Justas Vaičekauskas, working under an individual-activity certificate. About anything on this page, write or call:

Email

info@sudievu.lt

Telephone

+370 656 94057

Individual activity certificate

1550560

The address is on every contract and every invoice.

When you write through any of this site's forms (on the home, websites or infrastructure pages), an email is sent to info@sudievu.lt. The message itself is not written to a database — it simply arrives in an inbox. So that we know how many enquiries we get, only the day it was sent and the form's language are recorded, with nothing that points to you.

Sent: your name, email address, telephone (optional), your message, which page you wrote from, and which language it was in.

The basis is GDPR Art. 6(1)(b): steps taken before a contract, at your own request. If you are writing about something else, the basis is the legitimate interest in answering somebody who wrote.

The message stays in the inbox as long as it takes to answer and, if we work together, for as long as that lasts. Enquiries that come to nothing are deleted within a year.

So that one script cannot bury the inbox, the form counts how many times an address writes in an hour. What is stored is not the IP address itself but a cryptographic hash of it, and only for an hour — after that it is deleted, the next time anybody writes through the form.

When you press "Check" on the pricing page, the domain name you typed (and nothing else) is sent from my server to the .lt registry, DOMREG, run by Kaunas University of Technology, which answers whether the name is free. My server does the asking, so the registry does not see your IP address. The answer is kept on the server for 5 minutes under a cryptographic hash of the name, so the same name is not asked again, and is then deleted.

So that the check cannot be used to flood the registry, one visitor may make 10 checks in 10 minutes and 30 in a day. For that, what is stored is not the IP address but a hash of it with a secret kept only on the server, and the times of the checks; after a day they are deleted, the next time anybody checks a name. The basis is GDPR Art. 6(1)(f): a legitimate interest in protecting this service and the registry from abuse.

So that I know which pages are read, my own server (count.sudievu.lt) counts visits.

It receives the address of the page you opened (without anything after a "?"), which site you came from (only its name), and whether you read the page for at least 8 seconds. If you came through one of my advertising links, also its three tags (utm_source, utm_medium and utm_campaign: where the link was published, through what kind of channel and for which campaign); nothing else after the "?". If your browser does not say which site you came from and the link's utm_source names a site (such as chatgpt.com), that site counts as the one you came from. From the tags, totals per campaign and day are made: how many visitors came, how many read on, and how many reached a goal, such as sending an enquiry. So that one person is not counted twice on the same day, a code is made from your IP address and your browser's name with a secret salt that changes every day. The salt itself is deleted the next day, so the code can never again be linked to you or to another day. Neither the IP address nor the browser's name is stored, and the counting uses no cookies.

Basis: Article 6(1)(f) GDPR, the legitimate interest in knowing which pages are read and which advertising works.

The records are kept for 35 days; after that only the daily totals remain (also per campaign).

Would you rather your visits were not counted? Open any page with ?notrack: your browser remembers it, and they are no longer counted (?track undoes it). The browser the owner signs in to the client area with is marked the same way automatically.

Clients I work with have a private area showing how their project is going. An account exists only because I made it — there is no registration anywhere.

Stored: email address, name, a cryptographic hash of the password (never the password), when the account was made, when it was last used, which projects you may see, the progress notes, and notes on the project (how to sign in to your site's admin, for instance).

The basis is GDPR Art. 6(1)(b): performance of a contract.

For as long as we work together and a year after. You can ask for it to go sooner — the account and its notes go with it.

Failed sign-ins — which IP address (for IPv6, only its network, the /56) and which email address they were made with, and when — are kept for an hour, so that a password cannot be guessed at indefinitely. Signing in gives the browser a random token; its hash is kept with the email address for 180 days, so that a stranger's attempts cannot lock you out of your account.

Hosting clients have a control panel at panel.sudievu.lt. An account there is made by me, or by you when you sign up. You sign in with a link sent by email; there is no password.

Stored: email address, name, language, when the account was made and when it was last used, and, if you turned on two-step sign-in, its app's secret key. When you sign up: email address, name and, if you give one, a company; if the link sent to you (good for 15 minutes) is not followed, these are deleted after a day, the next time somebody signs up. Sign-in links are kept only as a cryptographic hash and are deleted a day after they expire.

When you order a plan: the plan, the site's address, whether you order as a consumer or for a business, the company's name and code, when you accepted which edition of the terms, and whether you asked for the service to start within the 14 days. If you withdraw from the contract as a consumer: when and by whom, your name, the bank account (IBAN) for the refund and the email address for the acknowledgement. If you end the contract in the panel: when and by whom, the last day of service and, when money is returned, the bank account (IBAN) for it. Also what you write under Questions, with the files you attach (pictures or PDFs), and your sites' settings: domains, mailbox addresses, the storage plan.

The basis is GDPR Art. 6(1)(b): making and performing the contract; the consumer's withdrawal record (c): consumer protection law requires it; protecting sign-in (f). An email address is required: it is how you sign in, so there is no account without one.

The account is deleted with its client, and I delete the client once we stop working together and no invoice is left unpaid. Questions and their files are kept while we work together and no longer than a year after. The order and any withdrawal record are kept for 10 years after the contract ends, as the signed contract is, and the buyer's details on invoices for 10 years (see Invoices and payments).

So that sign-in links and codes cannot be sent or guessed at indefinitely, attempts from one address are counted: not the IP address itself but a hash of it with a secret kept only on the server, and the times of the attempts; they are deleted after a day. The admin's sign-ins and failed two-step codes (with the account's number) go into the events log without an IP address and are kept for 90 days. When an invoice is still unpaid 14 days after it was due, the panel's extra functions (the file manager, restores, the staging copy) pause automatically until it is paid (clause 5.11 of the contract).

The panel also shows me the numbers of sudievu.lt's social accounts, the 10 newest replies and mentions of its X account, and the 10 newest comments by others on its Facebook, Instagram and YouTube accounts: the author's name there, the text, its day and its link. The networks give them when the panel asks (X twice a day, the others every 30 minutes), and each time a list is replaced whole: a post leaves it once 10 newer ones arrive, and leaves the backups within 6 months. Meta may also send new Facebook and Instagram comments the moment they are written; those are kept in the panel's database for at most 7 days and shown only until the next time the panel asks. No history of these lists is built up, nothing is passed on, and only I see them. For my own accounts the panel keeps only their numbers day by day for 90 days (followers, and each post's views, likes and comment count), with no one's name or words. The basis is GDPR Art. 6(1)(f): the legitimate interest of seeing and answering people who address me on these networks.

The panel's cookies: __Host-panel (signed in, up to 30 days), __Host-panel-trust (only if you tick "Remember this computer for 30 days"; the server keeps only a hash of it), __Host-panel-oauth-next and __Host-panel-sso-next (where to return after signing in, 15 minutes) and panel_lang (language, a year). Kept in the browser: panel-lang, panel-theme, panel-role, panel-fm-wrap, panel-i18n:*, panel-h:*, panel-groups:*, panel-band2:* (language, look, the sizes of the page's parts, copies of the words and the background). Gone when the tab closes: panel-c:*, panel-who, panel-redir, panel-restore-last, panel-sites-sort, panel-db-jobs, panel-i18n-at:*, panel-diag, panel-diag-log, connect-reload (the panel's last answers, so pages open at once, and where you were). Every one is needed for the panel to work, so no consent is asked.

The content of your sites, and the data of their visitors and guests that you see in the panel, I process on your behalf as a processor, under annex B of the service contract; for that data the privacy notice to your visitors is yours.

I call rural-tourism homesteads and guest houses to offer a website or a booking system. Who to call comes from a list I build myself from public sources: Google Maps place data, the lists of rural-tourism providers, the atostogoskaime.lt and prieezero.lt directories, the homesteads' own websites and the Register of Legal Entities.

For each homestead: its name, the phone numbers and email it publishes, its address and map location, its website and what I found about it (whether it works, how fast it opens on a phone, whether it is on Booking.com), its Google rating, its number of places and its prices where published. After a call: when we spoke and for how long, what we agreed, when to call back, and my notes. Phone numbers from Google are refreshed or deleted within 30 days, as Google requires. After 30 days the change history keeps only a number's last three digits. The list is ranked automatically by how useful my offer could be to the homestead. It only decides the order of my calls and makes no decision about you.

The call is recorded, and you are told so at the start. The recording is turned into text on my own computer. Once I have checked that the text is right, Anthropic's AI (Anthropic Ireland, Limited; the text is processed in the USA) reviews it: a summary and what to say better next time. Anthropic receives the text only, never the audio, and does not use it to train its models; the transfer to the USA rests on the standard contractual clauses. A call-back we agree on goes into my Google Calendar (Google Ireland Limited). The phone reminder of the day's call-backs is sent empty: no homestead's name passes through Google or Apple.

Basis: GDPR Art. 6(1)(f), my legitimate interest in offering my services to businesses (direct marketing, GDPR Recital 47). The recording and its text rest on the same basis: so I know what we agreed and can learn to call better.

The recording is kept 90 days, the call's text and its review one year. A homestead I have neither spoken with nor called for two years is deleted entirely. If you become a client, the sections on contracts and invoices apply from then on. Deleted data leaves the backups within 6 months.

Rather not be called? Say so during the call or write to info@sudievu.lt. I then delete everything about you, with every other entry holding the same number, email or place, and do not call again. So that a later update of the list cannot add you back by mistake, only a cryptographic fingerprint of the number and address stays: it cannot be turned back into them, only recognise them if they appear again.

I write to restaurants, cafés and takeaways to offer ordering on their own website instead of Wolt or Bolt Food. Who to write to comes from a list I build myself from public sources: Google Maps place data and reviews, Wolt's public list of restaurants and the restaurants' own websites. I write only to the address a restaurant publishes on its own website, a general one (such as info@) first.

For each restaurant: its name, town, address and map location, its website and what I found on it (whether you can order online, whether it links to Wolt or Bolt Food), whether it is on Wolt, its Google rating and number of reviews, the email address from its website, and my letter. From Google reviews only the text is taken, never the author's name. The data is kept on my own computer and my own server.

A draft of the letter is written from these facts and the reviews' text by Anthropic's AI (Anthropic Ireland, Limited; the text is processed in the USA). Anthropic receives neither the email address nor any reviewer's name, does not use the data to train its models, and the transfer to the USA rests on the standard contractual clauses. I read and approve every letter myself; none is sent without that. Letters go from info@sudievu.lt through Telia's mail, a few each working day.

If we agree on a 15-minute demonstration, it happens on Google Meet (Google Ireland Limited) or in person. I record a Meet call only with your consent: I ask at the start, and if you say no, I do not record. The recording is turned into text on my own computer and stays there; it goes to nobody, Anthropic included. Basis: your consent (GDPR Art. 6(1)(a)), so that I know what we agreed. The recording and the text are deleted after 90 days; if you change your mind, write to info@sudievu.lt and I will delete them at once.

Basis: GDPR Art. 6(1)(f), my legitimate interest in offering my services to businesses (direct marketing, GDPR Recital 47).

Google's data is kept at most 30 days, as Google requires. A restaurant I have not written to by then is deleted entirely. One I have written to keeps only its name, town, website and what I found on it; the reviews' text, the rating and their summary beside the letter are deleted. Letters sent are kept as the record of whom I wrote to and what I said. Deleted data leaves the backups within 6 months.

Rather not get letters? Every letter ends with a link that stops them in one click, or reply to it or write to info@sudievu.lt and I will do the same for you. Nothing more then goes to that address, that domain or that place, and any unsent letter is deleted. So that a later update of the list cannot write to you again by mistake, only a cryptographic fingerprint of the address, domain and place stays: it cannot be turned back into them, only recognise them if they appear again.

I issue invoices to clients in the client area or the control panel. An invoice carries the buyer's details — a name or company name, a code and an address — and what is being paid for, and how much.

The basis is GDPR Art. 6(1)(c): the accounting and tax laws require it.

Invoices are kept for 10 years, counted from 1 January of the year after they were issued, as accounting documents must be, and cannot be deleted on request in that time.

If you pay with the Pay button, the payment is handled by Paysera LT, UAB — a licensed electronic money institution and a controller in its own right. Card or bank sign-in details are entered on Paysera's page and never reach me. Paysera sends me a notice: which invoice, how much, when and how it was paid, sometimes with the payer's name and email address. I keep it with the invoice.

A client can sign the services contract in the client area. Signing sends a six-digit one-time code to their email address.

Stored: the contract version, the Order, your declaration (business or personal purposes), whether you asked for work to start early, the name you typed, the account, the time of signing, the IP address, the browser's name (user agent), when the code was confirmed, and the whole signed document with its checksum. If you withdraw from the contract, the withdrawal statement, its time, IP address and browser are stored too. The code itself is never stored: only a cryptographic hash of it, deleted within a day.

The agreement on electronic signatures keeps its own record: when and to which address it was sent to you, which version of it (with its checksum) you confirmed and how — with a qualified electronic signature, a hand-signed copy, or a reply saying "Patvirtinu" (I confirm) from your own email address — and the proof I record: the reply's date, sender and message id, or where the signed original is kept. If the agreement is ended, when it ended, which party ended it and the proof are recorded too.

The basis is GDPR Art. 6(1)(b): concluding and performing the contract; for the IP address and browser, Art. 6(1)(f): a legitimate interest in proving who signed or withdrew, and when. The record of the agreement on signatures rests on the same Art. 6(1)(b).

A signed contract and its record are kept for 10 years after the contract ends (the general limitation period) and cannot be deleted in that time. The record of the agreement on signatures is kept for as long as any document signed under it is kept. The signed document is emailed to you and to me.

There is not one tracking cookie, which is why there is no consent banner: consent is needed for what is not necessary, and here everything is.

Only the first group are cookies, and only they go to a server. Everything else is an entry in your own browser that nothing sends anywhere (apart from the owner’s proofreading notes, marked above). The demonstration’s rows are cleared by its own “Start again” button. The site itself, the Bible reader and the demonstration also keep a copy of their own files in the browser’s cache, so that pages open at once and work offline: the site’s files, not data about you.

The demonstration counts its own pageviews — that is what its analytics page is for, and it is part of what is being shown. The count goes nowhere: it stays in the same browser storage as everything else you change in it.

The site and the control panel run on my own server in Lithuania, so no hosting company handles the data. The site is reached through the network of Cloudflare, Inc.: every request, including what you type into a form, passes through its servers on the way to mine. Cloudflare is a processor and may handle the data outside the European Economic Area, in the US for instance, so the basis for the transfer is the standard contractual clauses and the EU-US Data Privacy Framework. A standby copy of the site and its data is kept on a virtual server I rent from UAB Interneto vizija in Vilnius. Like every server, mine writes ordinary access logs (IP address, time, the address opened, the browser's name): they are kept for up to 9 weeks, and the security filter's (WAF) log for 28 days. Addresses that try to break in are blocked for a while. Mail from the form, the client area and the control panel (contracts, codes, sign-in links, invoices) goes out through Telia Lietuva, AB, which also holds the mailbox it arrives in.

One thing does reach outside: the demonstration's map — and it fetches nothing until you ask. In its place there is a line and a button; press it and the tiles come from OpenStreetMap, and their server sees your IP address. Leave it and not one request is made. The permission lasts for that visit only.

Every night the whole server is backed up. The backup is encrypted on the server and kept in three places. On the server, for up to 9 days. In Backblaze B2 storage (Backblaze, Inc., EU region, Amsterdam), for 30 days during which nobody can delete it, and then deleted within a couple of days. On my computer, one copy a day is kept for 14 days, one a week for 8 weeks and one a month for 6 months. Backblaze cannot read what is in it, but it is a US company, so the transfer rests on the EU-U.S. Data Privacy Framework and the standard contractual clauses. Deleted data leaves the backups within 6 months.

Nobody else, apart from Paysera when you pay an invoice, the .lt registry DOMREG when you check a domain name (it gets the name only), Backblaze (encrypted backups only), Anthropic (call transcripts and drafts of letters to restaurants), Telia (sending those letters), Google (call-back reminders in a calendar and demonstration calls on Meet), and public authorities where the law requires it (the tax inspectorate, for instance). The data is not sold, not handed to advertising, and, apart from what the sections on calls and on letters to restaurants describe and what passes through Cloudflare, is kept in the European Economic Area.

Write by email about any of them — I answer, and I do it within a month.

• Find out what data of yours I hold, and get a copy.
• Have anything wrong corrected.
• Ask for it to be deleted, apart from invoices and contracts the law requires me to keep.
• Restrict how it is used, or object to it.
• Get your data in an ordinary format and take it with you.

If the answer does not satisfy you, you can go to the State Data Protection Inspectorate: L. Sapiegos g. 17, 10312 Vilnius, ada@ada.lt, +370 5 271 2804, vdai.lrv.lt.

• Anybody else's analytics: not Google's, not anybody's. Only my own server counts, as described above.
• Ad networks and tracking pixels.
• Fonts or scripts from somebody else's server: everything is served from here.
• Profiling and automated decisions about you. The one automatic step is the panel's tools pausing when a payment is late, described above. The order of my call list, described above, makes no decision about you.
• Selling data. Ever.

If what is written here changes, this page changes, and the date at the top says when. Clients are told about anything substantial by email.