Privacy Policy

Version 1.0 — in force from 17 September 2026

1. Who is responsible for your data

The controller of your personal data is Ianina Kuodis, individual activity certificate Nr. 1331440, email labas@savoapp.lt, operating the website savoapp.lt under the name SAVO.

We have not appointed a Data Protection Officer — we are not required to. Write to labas@savoapp.lt with any data protection question.

2. What we process, why, and on what legal basis

What	Why	Legal basis	How long
Email address, name, password hash, chosen interface language; profile picture and name if you sign in with Google	Creating and running your account; signing you in; sending service emails	Performance of a contract — GDPR art. 6(1)(b)	While your account exists, then deleted within 30 days of closure
Provider profile: business name, service title, description, city, address, languages, categories, price list, photos, contact methods, any SAVO perk	Publishing your listing — this is the service you asked for	Performance of a contract — art. 6(1)(b)	While the profile exists, then deleted within 30 days of closure. Search-engine caches may persist longer and are outside our control
Reviews you write, and favourites you save	Publishing reviews; showing you your saved providers	Performance of a contract — art. 6(1)(b)	Reviews: while the provider profile exists, or until you delete the review. Favourites: while your account exists
News posts published by Providers	Publishing the post	Performance of a contract — art. 6(1)(b)	Until deleted by the Provider or the profile is closed
Subscription plan, status, period end, Stripe customer and subscription identifiers, promo code used	Managing your subscription and billing	Performance of a contract — art. 6(1)(b); and a legal obligation for accounting records — art. 6(1)(c)	10 years from the end of the financial year, as required by Lithuanian accounting and tax law
Provider statistics: for each profile view or contact-button click we store the provider, the event type, the time, and a one-way SHA-256 hash of the visitor's IP address, browser user-agent and the calendar date. We never store the IP address or the user-agent themselves, and nothing is stored in or read from your browser for this purpose. The hash changes every day and exists only to avoid counting the same visitor twice on the same day	Showing Providers how many people viewed their profile and clicked to contact them	Legitimate interests — art. 6(1)(f). Our interest is giving Providers honest evidence that their listing works; the data is pseudonymised at the point of collection and is never used to identify or profile a visitor. You may object at any time under §5	24 months, then deleted
Website analytics — Google Analytics 4. Cookies _ga and _ga_7MN8QK31H6, and the pseudonymous identifiers they carry	Understanding how many people use the site and which pages they reach	Consent — art. 6(1)(a), given through the cookie banner, and Elektroninių ryšių įstatymas art. 73(4). No analytics runs before you consent, and you may withdraw at any time	Cookies: up to 24 months. Analytics data retention in Google Analytics: 14 months
Emails we send you and delivery status	Confirming your account, resetting your password, telling you about your trial or subscription	Performance of a contract — art. 6(1)(b)	12 months
Reports of illegal content, and our decisions on them	Complying with the Digital Services Act	Legal obligation — art. 6(1)(c)	3 years

We do not make any automated decision that produces legal effects or similarly significantly affects you, and we do not profile you.

We do not process special categories of data (health, beliefs, and so on). Please do not put such information into a profile, a review or a message.

3. What is published to the world

If you create a provider profile, the following becomes publicly visible to anyone on the internet, and can be indexed by search engines and read by AI systems: your business name, service title, description and its translations, city and address, languages, categories, price list, photos, published news posts, approved reviews about you, and the contact methods you chose to add.

You decide what goes there. Do not publish a home address or a personal phone number unless you are willing for them to be public.

Reviews are published with the reviewer's display name. Your account email address is never published.

4. Who else receives your data

Recipient	Role	Where
Lovable Labs Incorporated / Lovable Cloud and Supabase — hosting, database, file storage	Processor (and its sub-processors)	EU region, with transfers to the United States governed by Standard Contractual Clauses
Stripe Payments Europe, Ltd. and Stripe, Inc. — payment processing	Processor for the data we send, and an independent controller for its own fraud prevention, anti-money-laundering and regulatory obligations. Its own privacy policy applies to that part	Ireland and the United States
Google Ireland Ltd / Google LLC — Google sign-in, and Google Analytics 4	Independent controller for your Google Account; processor for Analytics under the Google Ads Data Processing Terms	EU and the United States
Resend — sending transactional email	Processor	Sending from the EU; stored data is held in the United States
The general public — for the parts of a provider profile listed in §3	—	Worldwide
Public authorities, where we are legally required to disclose	—	Lithuania / EU

We do not sell your data and we do not share it for anyone else's advertising.

5. Transfers outside the EU

Some of the recipients above process data in the United States. Those transfers rely on:

• the EU–US Data Privacy Framework adequacy decision (Commission Implementing Decision (EU) 2023/1795) where the recipient is certified — Google LLC, Stripe, Inc. and Resend are on the list at dataprivacyframework.gov/list; and
• Standard Contractual Clauses approved by the European Commission where the Framework does not apply.

You can ask us for a copy of the safeguards by writing to labas@savoapp.lt.

6. Your rights

You have the right to: access your data; have it corrected; have it erased; restrict how we use it; object to processing based on our legitimate interests (which covers provider statistics); receive your data in a portable format; and, where we rely on consent, withdraw that consent at any time — withdrawal does not affect what was lawful before it.

Most of this you can do yourself from your dashboard. Otherwise write to labas@savoapp.lt — we answer within one month.

Providing your email address and password is necessary to create an account; without them we cannot give you one. Everything you put in a provider profile is voluntary, but a profile with too little information cannot be published.

If you are unhappy with how we handle your data, you can complain to the Lithuanian supervisory authority:

Valstybinė duomenų apsaugos inspekcija (VDAI) L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania Tel. +370 5 271 2804 · ada@ada.lt · vdai.lrv.lt

7. Security

Data is stored on managed infrastructure with access controls, encryption in transit, and row-level access rules so that Providers can read only their own data. Access to production data is limited to the operator of SAVO. Passwords are stored hashed and are never visible to us.

If a personal data breach occurs that is likely to result in a risk to you, we notify VDAI within 72 hours of becoming aware of it, and we tell you directly where the risk to you is high.

8. Children

SAVO is not intended for people under 16. We do not knowingly collect their data. If you believe a child has an account, write to labas@savoapp.lt and we will remove it.

9. Changes

We will publish any change here with a new version number and date. Where a change materially affects you, we will also tell you by email.