Privacy & Cookie Policy

Last updated: 2026-09-27

1. Data controller

The controller of personal data processed through this website is Darius, operating as an individual (not a registered company), the creator of KodoAsas (kodasas.lt). You can reach the controller via the contact form on this website.

2. What data we collect and why

• Contact/order form — name, email address, selected service, and your message. Used solely to respond to your inquiry. Legal basis: steps taken at your request prior to entering into a contract (GDPR Art. 6(1)(b)), and our legitimate interest in responding to inquiries (Art. 6(1)(f)) where no contract follows.
• Language preference — a cookie remembering whether you browse in Lithuanian or English. Strictly necessary for the site to function as you requested.
• Analytics — only if you consent via the cookie banner, anonymous usage statistics (pages visited, approximate traffic) are collected via Umami. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.
• Email subscription — if you sign up to receive notifications about new stories, we store your email address, your language preference, and the date you confirmed. Subscription uses double opt-in: no update email is ever sent until you click the confirmation link in the first email. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time via the unsubscribe link included in every email you receive.
• Registered visitor login (Google) — if you sign in with Google to use the AI image tool or the SEO/AI readiness check, we store your Google account ID, email address, name, and profile picture URL, so we can recognize you on your next visit and apply your usage limits correctly. Legal basis: necessary to provide the feature you requested (Art. 6(1)(b)).
• SEO/AI readiness check — if you use the SEO check tool, we store the website URL you submitted and the analysis results, so you can view them and optionally email them to yourself. We also store a keyed hash of your IP address (HMAC-SHA256 with a secret key — without the key it cannot be traced back to your IP; the IP itself is never stored) to enforce a fair daily usage limit and prevent abuse. Legal basis: your request to run the check (Art. 6(1)(b)) and our legitimate interest in preventing abuse of a free tool (Art. 6(1)(f)). If you also tick the separate "I'd like to receive offers about website development" checkbox — unchecked by default, and entirely optional — we additionally record the date of that consent. Legal basis: your consent (Art. 6(1)(a)), withdrawable at any time via the contact form. On the results page, the “Fix these things” link opens the order form on the home page with the checked URL pre-filled in the visible message field; you can edit or delete it, and nothing is sent until you press send.
• AI image tool — if you use the image tool, the description you type is sent to an image-generation service (see section 4) and, if you use the description-improvement feature, also to an AI language model; we do not store the description text itself. The generated image is saved in our image storage (Cloudflare R2) for 30 days and can be reached only via its random link; it is not linked to you or your account, and the page reminds you to download it. To enforce a fair daily limit we store a keyed hash of your IP address (HMAC-SHA256 with a secret key; the IP itself is never stored) and, for signed-in visitors, the account ID. The tool's event log records only a partially masked IP address (last part hidden) and the length of the description, not its text. Legal basis: your request to generate an image (Art. 6(1)(b)) and our legitimate interest in preventing abuse of a free tool (Art. 6(1)(f)).
• Chat widget — if you write to the chat assistant on this site, your message and the last few exchanges of the conversation are sent to an AI language model (Google Gemini; if unavailable — a DeepSeek model via OpenRouter, only to providers that do not collect or retain requests) to generate a reply. To keep the context, the last 3 exchanges are held only in the server's memory, linked to a random chat ID stored in your browser (chatSessionId); they are not written to the database, and logs record only the message length. Legal basis: our legitimate interest in answering visitors' questions (Art. 6(1)(f)).

3. Cookies used on this site

4. Who else receives your data (recipients)

• Render — hosts the website (application server).
• Neon — hosts the website's database (EU, Frankfurt), where the data described on this page is stored.
• Umami Cloud — processes anonymous analytics data, only if you consent to analytics cookies.
• Yahoo Mail (SMTP) — used to forward contact-form submissions to the controller's inbox.
• Resend — sends subscription confirmation and new-story update emails, and SEO check results if you ask to receive them by email.
• Google — sign-in with Google (OAuth) for registered visitors using /public-image or /seo-analize; Google Gemini AI models are also used as described below.
• AI language models — Google (Gemini), Groq, OpenRouter (DeepSeek models; OpenRouter requests are sent only to providers that do not retain or collect them) — process chat widget messages, the information extracted from the page you submit for the SEO check (title, description, headings, a short content excerpt) and, if you use the description-improvement feature of the image tool, your image description.
• Image generation and storage — Cloudflare (Workers AI; R2 storage), Replicate, Google (Gemini) — receive the image description you type in order to generate the image; generated images are stored in Cloudflare R2 for 30 days.
• Public CDNs — cdnjs (Cloudflare), jsDelivr — two pages load a code library directly from them (the statistics page — Chart.js; the 3D sphere — three.js); your browser connects to them, so they see your IP address.

Some of these recipients may operate infrastructure outside the EU/EEA. Not all of them are contractual processors (for example, the public CDNs); we list them so you know who receives data during your visit. We rely on each processor's own compliance mechanisms (such as standard contractual clauses) for any such transfers; we do not independently verify this beyond what each processor publicly states.

5. How long we keep your data

Contact/order form submissions (name, email, message) are kept for 12 months from submission, after which they are automatically deleted. If you'd like your data removed sooner, contact us via the form and we will delete it manually.

Email subscription data (email address, language preference, confirmation date) is kept until you unsubscribe (via the link included in every email) or request removal via the contact form.

Registered visitor account data (Google account ID, email, name, profile picture) is kept for as long as you continue to use /public-image or /seo-analize; contact us via the form if you'd like your account and its data deleted.

SEO/AI readiness check results (submitted URL, analysis) are kept for 12 months from the check, then automatically deleted. Daily usage-limit counters (including the IP address hash) are kept for no more than 7 days.

Daily-limit counters of the image tool (the IP address hash and, for signed-in visitors, the account ID) are deleted nightly, so they are kept for no more than 7 days. Generated images are kept for 30 days and then deleted automatically; if you'd like one removed sooner, contact us via the form and include its link.

Chat widget messages are not stored in the database: the last exchanges are kept only in server memory and are no longer used after 30 minutes of inactivity; they are deleted when the server next receives a chat message or restarts.

6. Your rights

Under the GDPR, you have the right to: access your data, request correction, request erasure, restrict or object to processing, request data portability, and withdraw consent at any time (use the cookie settings button, or the 🍪 icon in the corner of any page). You also have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI) — ada.lt, email ada@ada.lt.

7. Changes to this policy

We may update this policy as the website evolves. Material changes affecting cookie consent will prompt the cookie banner to appear again.

This page is provided in good faith based on general EU/Lithuanian data protection practice and is not a substitute for professional legal advice.