Privacy
Privacy policy
How Skenuok.com handles your data: contacts, accounts, payments, AI tools, cookies, GDPR rights and security.
Last updated: 2 July 2026
This policy explains how Skenuok.com collects, uses, and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and the laws of the Republic of Lithuania.
2. Data we collect
We collect only the data necessary to provide our services, maintain security, and communicate with you:
- Contact form: name, email address, company (optional), selected service, message content, technical timestamp.
- Account (sign-in): email address, name, profile photo (if you use Google OAuth), session identifiers.
- Payments: payment data is processed by Stripe; we store order ID, amount, credit balance, and transaction logs.
- Tools: public URLs for scanning, topics entered into the content generator, conversation history in the SEO agent (for signed-in users).
- Technical data: IP address (for security and rate limiting), browser type, operating system, time zone, cookie consent record.
3. Purposes and legal basis
We process personal data for the following purposes:
- Providing services — performance of a contract (GDPR Art. 6(1)(b)).
- Responding to enquiries and support — legitimate interest (GDPR Art. 6(1)(f)).
- Security and abuse prevention — legitimate interest.
- Analytics — consent (GDPR Art. 6(1)(a)), only if you accept analytics cookies.
- Legal obligations — accounting, tax, and dispute resolution (GDPR Art. 6(1)(c)).
4. Cookies and similar technologies
Cookies are small text files stored on your device. We use essential cookies for the website to function; analytics cookies are used only after you give consent via the cookie banner at the bottom of the page.
| Pavadinimas | Paskirtis | Trukmė | Tipas |
|---|---|---|---|
| authjs.session-token / __Secure-authjs.session-token | Prisijungimo sesija (NextAuth) — būtina paskyros funkcijoms. | Sesija / iki 30 d. | Būtinas |
| gen_session | Anoniminė SEO generatoriaus sesija ir kreditų sekimas be paskyros. | Iki 30 d. | Funkcinis |
| _ga, _ga_* | Google Analytics 4 — anoniminė lankytojų statistika (tik su sutikimu). | Iki 2 m. | Analitika |
| skenuok_cookie_consent | Jūsų slapukų pasirinkimo įrašymas (localStorage). | Iki 12 mėn. | Būtinas |
You may withdraw consent at any time by clearing browser cookies and the localStorage record, or by changing your browser settings. Essential cookies are required for sign-in and core functionality.
5. Third parties and data transfers
Data may be transferred to the following trusted processors:
- Stripe — payment processing (US / EU, SCC or adequacy decision).
- Google — OAuth sign-in, PageSpeed Insights API, Analytics (with consent).
- OpenAI — AI features (content generation, recommendations).
- Resend / SMTP — email notifications.
- Railway — hosting and database (PostgreSQL).
Transfers of data outside the European Economic Area (EEA) are carried out only with appropriate safeguards (standard contractual clauses, adequacy decisions, or vendor certifications). We enter into data processing agreements with each processor where applicable.
6. Retention periods
- Contact enquiries — up to 24 months after the last contact, or while a legitimate interest remains.
- Account data — while the account is active; deleted within 30 days of an account deletion request.
- Payment and credit logs — as required by accounting and tax law (typically up to 10 years).
- Server logs — up to 90 days, unless needed for a security investigation.
7. Your rights under the GDPR
You have the following rights:
- to know whether we process your data and to obtain a copy;
- to request correction of inaccurate data;
- to request erasure of data (“right to be forgotten”);
- to restrict processing or object to processing;
- to receive data in a structured format (data portability);
- to withdraw consent for analytics at any time (without affecting prior processing);
- to lodge a complaint with the State Data Protection Inspectorate of Lithuania (VDAI): vdai.lrv.lt.
For requests, email JustasMc91@gmail.com. We will verify your identity by reasonable means before disclosing data.
8. Data security
We apply technical and organisational measures including HTTPS encryption, storage of passwords and API keys in environment variables, rate limiting, access controls for administrative functions, and regular software updates. While we strive for a high level of security, no online system can guarantee absolute security.
9. Children's privacy
Our services are not intended for persons under 16 years of age. We do not knowingly collect data from children. If we learn that we have collected a minor's data without parental consent, we will delete it promptly.
10. Policy changes
We may update this policy due to changes in law, services, or technology. Material changes will be published on this page with a new date. We recommend reviewing this document periodically.