Privacy Policy

1. Data controller

The Statyk service (projektavimas.lt) is provided by, and the controller of your personal data is, Business Hive Vilnius UAB, company code 125418510, VAT code LT100001247916, registered office Savanorių pr. 178F, LT-03154 Vilnius, Lietuva.

Data protection contact: info@projektavimas.lt, tel. +370 686 77781. No data protection officer is appointed (not required under GDPR Art. 37) — the controller answers all questions at these contacts.

2. Data we process

- Account data: first name and email address (required); last name, phone, city, customer type and company name (optional); preferred language.

- Project data: building parameters, the description text you enter, project versions, comments, share links, generated PDFs and visualisations.

- Technical data: IP address (abuse prevention and sign-in link protection), session and last sign-in time, the project change log (who changed what and when).

- Consent history: whether and when you gave or withdrew consent to news, and for which text version.

- Reminder about an unfinished project: if you created a project but did not generate a result or return within 3 days, we send one service email with a link to continue; you can opt out via the link in the email. This is not marketing – no newsletter consent is involved.

- Site feedback (the “Feedback” button): message, page path, language and browser type; your email address only if you entered it for a reply; when signed in, a link to your account (removed when the account is deleted). Kept until the feedback is handled and no longer than account data.

- The wizard description text and the recognition result (which object was recognised): email addresses and phone numbers in the text are masked before saving; kept up to 12 months to improve recognition (what people ask for, what the system does not understand).

- Traffic statistics: page path, language, referring website domain, campaign tags (utm) and the example parameter (preset) are summed per day on the server – without cookies, IP address or user identity, so no person can be identified from this data. Kept up to 13 months.

- If you create a specialist profile: display name, company name and code, fields, municipalities, description, certificate number and register, optional public phone, portfolio entries, daily count of page views (no visitor data).

- Orders to specialists: request message, statuses, notes, offers (price, due date) and offer templates, a logo for PDFs (if uploaded), reviews (rating, text, reply).

3. Purposes and legal bases

- Account, sign-in, project calculations, PDFs, visualisations and project notifications — performance of a contract (GDPR Art. 6(1)(b)).

- Service security: rate limiting, abuse prevention, change log for collaboration — legitimate interest (Art. 6(1)(f)).

- News and offers — only with your separate consent (Art. 6(1)(a)); you may withdraw it at any time without affecting the service.

- Legal obligations (e.g. requests from authorities) — Art. 6(1)(c).

- Specialist catalogue, requests, offers and reviews — performance of a contract (Art. 6(1)(b)). The administrator checks the certificate number manually in the public register. Publishing and moderating reviews — legitimate interest in giving other users reliable information (Art. 6(1)(f)).

4. Recipients

- The server infrastructure (hosting) provider, acting as a processor on our instructions only.

- Emails (sign-in links) are sent through our own mail server.

- The description text and any attached photo or sketch are processed on our server and not stored; no external AI service is used for them.

- AI visualisation is disabled — no images are sent to external providers.

- Anyone holding a share link you created can see the project results (without your budget and price changes) and leave a comment. You can revoke the link at any time.

- Project members you invite.

- Publicly (specialist catalogue): a published specialist profile without company code and email; phone — only if you entered it yourself; portfolio — only title, type, area and plan (a client project — only with the client consent); reviews — only with the client first name; a “Pro” badge — if you have the paid Pro plan. A client who sent a request and the specialist who received it see each other name and the order details.

- Public authorities — only where required by law.

We do not sell data or use it for advertising.

5. Retention

- Account and projects — while you use the account. If you do not sign in for 24 months, the account is deleted automatically.

- When an account is deleted (by you or automatically): projects are marked deleted, sessions and consents are erased, comments and the change log are anonymised (author removed).

- Sign-in links are valid for 15 minutes, stored only as a SHA-256 hash and deleted within a day after expiry.

- Sign-in session — 30 days or until sign-out.

- Rate-limit records (IP address or account ID) — short-term, cleaned automatically.

- Specialist profile, portfolio, orders, offers, reviews and view statistics — while you use the account; deleted with the account (you can hide your profile or delete your review at any time).

- Backups — 30 days, then overwritten.

6. Your rights

- Access your data and get a copy — "Download my data" in the project list (JSON file).

- Rectify inaccurate data.

- Erase data — "Delete account" in the project list.

- Restrict processing and object to processing based on legitimate interest.

- Data portability — the same JSON file.

- Withdraw consent to news at any time.

Send requests to info@projektavimas.lt; we reply within one month. You may lodge a complaint with the Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate, https://vdai.lrv.lt).

7. Is providing data required

Name and email are required to create an account and send sign-in links — without them we cannot provide the service. Other contact details are optional.

8. Automated decisions

The system automatically calculates building structures, materials and prices, but makes no decisions about you with legal or similarly significant effects (GDPR Art. 22 does not apply). We do not profile.

9. Children

The service is intended for adults and companies. We do not knowingly collect children’s data.

10. Security

Connections are encrypted (HTTPS/TLS). There are no passwords — sign-in uses one-time email links. The application uses a least-privilege database role and an append-only change log. Files (PDFs, visualisations) are not public and are served to project members only.

11. Cookies

We use only strictly necessary cookies and browser storage entries. See the Cookie Policy.

12. Changes

When processing changes, we update this policy and the date above; registered users are informed of significant changes by email.