Privacy policy

Version 1, published Oct 21, 2026

Draft. This document has not yet been reviewed by a lawyer. Details marked with square brackets [ ] will be filled in before the platform launches. The Lithuanian version is the binding one; this is a translation.

This policy explains what personal data we process when you use the OXTARIS platform (oxtaris.lt), why and for how long we keep it, who we share it with, and the rights you have under the General Data Protection Regulation (GDPR).

1. Controller

[Operator name], company code [code], registered address [address]. For data protection questions write to info@oxtaris.lt.

2. What we process

Farmers

a phone number, confirmed by an SMS code — you sign in with it;
optional: your name, farm name, a contact email address, a password (only its hash is stored);
listing details: the animals’ purpose, type, direction, breed and number, the district, the description, photos and the contact phone number;
answers to “Have you sold the animals?” and any feedback you give.

Managers (buyers)

name, email address and phone number, each confirmed by a code;
company name and code, company phone number, the districts you work in and what you buy;
purchase prices you submit, access periods and the contacts you open;
company subscription, order, invoice and payment details, and the billing email address;
if you sign in with Google — your Google account’s email address and identifier.

All visitors

Technical data: IP address and browser details. Our database does not store your IP address — only a one-way hash of it, computed with a secret key, which is used to count views, limit abuse and keep the security log. Our hosting providers’ logs may hold IP addresses for a short time.

Other people

If a farmer gives someone else’s phone number on a listing, we process that number too. The farmer must have that person’s permission.

3. Purposes and legal bases

Accounts, listings and number verification — performance of a contract (GDPR Article 6(1)(b)).
Passing a listing’s contact number to approved managers — the Platform’s core service; performance of a contract (b).
Showing a number publicly — only with your consent (a). You can withdraw it at any time.
Manager access, price submissions and company subscriptions — performance of a contract (b); keeping accounting records — a legal obligation (c).
Messages: verification codes, “Have you sold the animals?”, the district digest for managers, notices about your account — performance of a contract (b). You can switch the district digest off in your settings.
Security, abuse prevention and the event log: actions on the Platform, contact reveals, administrator decisions, rate limiting — our legitimate interest in protecting the Platform and its users and in keeping evidence for disputes (f).
Counting views and statistics — legitimate interest (f).

We send no marketing messages, and we do not sell personal data.

4. Who we share data with

Managers — a listing’s contact number, when an approved manager opens it. From then on the manager and their company are independent controllers of that number and may use it only to get in touch about the listing.
All visitors — listing details without the contact number; the number only with your consent.
OXTARIS administrators — as far as needed to run the Platform.
Service providers (processors): Supabase (database, sign-in, file storage), Vercel (website and server hosting), and the providers that send our SMS and email.
Google — if you sign in with Google; Google processes that data under its own privacy policy.
Public authorities — where the law requires it.

5. Where data is stored

The database, file storage and server functions run in the European Union, in Frankfurt, Germany. Supabase and Vercel are US companies, so their support staff and sub-processors may access data from outside the EU. Such transfers are covered by the safeguards in these providers’ data processing agreements — the EU–US Data Privacy Framework and/or the European Commission’s standard contractual clauses. The website is delivered to visitors through Vercel’s global network.

6. How long we keep data

verification codes are valid for 10 minutes;
unfinished registrations, and unfinished listings started without an account, are deleted within a day;
account data is kept while you have an account; you can ask for it to be deleted at any time;
listing details and photos are kept while needed for the listing, statistics and possible disputes — [no longer than … after the listing ends];
the event log and records of contact reveals — [no longer than …];
accounting records (orders, invoices, payments) — for the period the law requires, usually 10 years.

7. How we protect your number and photos

A listing’s contact number is never part of the website’s public data. Every reveal is logged, and a manager can open a limited number of contacts per day.
Metadata, GPS coordinates included, is removed from uploaded photos, and the listing’s reference number is stamped on each one.
Passwords, verification codes and access tokens are stored only as hashes.
Access to the database and file storage is restricted, and only administrators can use the administration tools.

8. Cookies and browser storage

We use only the cookies and browser storage the website needs to work. We use no analytics, advertising or third-party tracking tools, which is why we do not ask for cookie consent.

sign-in session cookies (sb-…) — to keep you signed in;
a language cookie (NEXT_LOCALE) — the language you chose;
local storage — a signed-in user’s role and a shortened name or masked number, so the site header shows correctly at once; cleared when you sign out;
session storage — a draft of an unfinished listing or manager registration; cleared when you close the browser tab.

9. Automated decisions

We make no decisions based solely on automated processing that have legal or similarly significant effects on you. An administrator approves a manager’s account; the system only applies the rules, for example whether access and payment are current.

10. Is giving data required?

A phone number is needed to publish a listing, and a manager’s details are needed for access. Other data, such as a farmer’s name or email, is optional. Without the required data we cannot provide the service in question.

11. Your rights

to access your data and receive a copy of it;
to have inaccurate data corrected;
to have data erased when it is no longer needed or there is no longer a basis for processing it;
to restrict processing;
to receive your data in a common machine-readable format and pass it to another controller;
to object to processing based on legitimate interest;
to withdraw consent to showing your number publicly at any time — this does not affect processing before the withdrawal.

Send requests to info@oxtaris.lt. Before acting on a request we may verify your identity, for example with an SMS code to your account’s phone number. We will reply within one month.

If you believe your data is processed unlawfully, you have the right to complain to the State Data Protection Inspectorate (vdai.lrv.lt, L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania).

12. Changes to this policy

When the way we process data changes, we will update this policy. The current version and the date it was published are always shown on this page.