Privacy Policy
Version 1.0, last updated 2026-09-27. The Lithuanian version prevails in case of discrepancy.
This privacy policy explains how PirkPigiau (“we”, “PirkPigiau”) processes your personal data when you use https://pirkpigiau.site. We process data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Lithuanian Law on Legal Protection of Personal Data and the Lithuanian Law on Electronic Communications.
1. Controller and contact
- Controller: Faustas Šedauskas, individual activity (Lithuania).
- Privacy enquiries: pirkpigiau4@gmail.com.
2. What we process, why and on what legal basis
| Data | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| Search queries, chosen radius and sort | Showing price comparisons | Performance of contract (6(1)(b)) | Not stored against your identity; technical logs up to 30 days |
| Location: GPS coordinates (rounded to ~100 m) or a chosen city | Showing nearby stores and distances | Consent (6(1)(a)) via the browser permission; you may choose a city instead | Precise location is not stored on our servers. It is used only to answer the request. A chosen city (never GPS) may be remembered in your browser if you consent to preference cookies. |
| Account data from Google: name, email, profile picture URL, Google account ID | Creating and managing your account, sign-in | Performance of contract (6(1)(b)) | While your account exists; deleted within 30 days of account deletion |
| Sessions: session token, IP address, user agent | Keeping you signed in, security, abuse detection | Contract and legitimate interest (6(1)(b) and (f)) | Up to 30 days after last use |
| Favourite products | Saving your list and alerting you to discounts | Performance of contract (6(1)(b)) | Until you remove them or delete your account |
| Notification settings and notifications (on-site, email, browser) | Alerting you to discounts on favourites | Contract; for browser notifications, consent (browser permission) | Notifications up to 12 months; settings while your account exists |
| Premium status (plan, period; payment provider reference once payments launch) | Providing Premium features, accounting | Contract; legal obligation (6(1)(c)) for accounting records | While your account exists; accounting records 10 years as required by Lithuanian law |
| Technical logs: IP address, time, request path, errors, rate-limit counters | Security, rate limiting, bot protection, debugging | Legitimate interest (6(1)(f)) in protecting the service and users | Up to 30 days |
| Cookie choice | Recording and honouring your choice | Legal obligation (6(1)(c)) | 12 months |
We never receive or store your Google password. We request only basic profile scopes (openid, email, profile). OAuth tokens, where stored, are encrypted (AES-256-GCM) and not used for any other purpose.
We do not sell your personal data and do not use it for profiling with legal or similarly significant effects.
3. Location data
- Your browser asks for location permission only when you press “Use my location”.
- Coordinates are rounded to about 100 m before they are sent to our server.
- We do not store your precise location in our database or link it to your account.
- If you prefer not to share your location, choose a city manually or search without a location.
- You can revoke the permission at any time in your browser settings.
4. Recipients and processors
- Cloudflare, Inc. – hosting, database, security (WAF, Turnstile, rate limiting). Processor.
- Google Ireland Ltd. / Google LLC – Sign in with Google (OAuth) and the Google Maps map. When the map is shown, your browser connects directly to Google, which receives your IP address. Use of the map is subject to the Google Maps Additional Terms of Service and the Google Privacy Policy.
- Resend (Plus Five Five, Inc.) – sending discount emails (receives your email address and the message). Processor.
- OpenStreetMap / Overpass API and Open Food Facts – sources of store locations and product information. Our server sends the requests, so none of your personal data is passed to them.
- Public authorities – only where required by law.
Retailers (Maxima, IKI, Rimi, Lidl, Norfa, Barbora, Senukai, Ermitažas) do not receive your personal data from us. “Navigate” opens Google Maps with only the store’s coordinates.
5. Transfers outside the EEA
Some providers (Cloudflare, Google, Resend) may process data in the United States. In that case the transfer relies on the EU-U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses with supplementary measures.
6. Cookies and similar technologies
Only strictly necessary cookies are used before you make a choice. Non-essential cookies and storage are used only with your consent. You can change your choice at any time via “Cookie settings” at the bottom of every page.
| Name | Category | Purpose | Duration |
|---|---|---|---|
| __Secure-pp.session_token, __Secure-pp.session_data | Necessary | Sign-in session (httpOnly, Secure, SameSite=Lax) | Up to 30 days |
| __Secure-pp.state and other short-lived OAuth cookies | Necessary | CSRF protection during Google sign-in | Up to 10 min |
| pp_consent | Necessary | Remembers your cookie choice | 12 months |
| __cf_bm, cf_clearance (Cloudflare) | Necessary | Bot and abuse protection, Turnstile check | 30 min – 1 year |
| pp_seen_notifications (localStorage) | Necessary | Prevents showing the same browser notification twice | Until you clear browser data |
| pp_pref_* (localStorage) | Preferences | Remembers your chosen city and radius (not GPS location) | Until you withdraw consent or clear data |
| — | Analytics | No analytics tools are currently used. If we add any, we will update this table and ask for consent first. | — |
7. Notifications
- Discount emails are sent only to signed-in users with favourites. Every email has a one-click unsubscribe link, and you can also turn them off in your account settings.
- Email frequency is capped at your chosen setting: at most hourly, daily or weekly.
- Browser notifications appear only after you grant permission in your browser. You can revoke it at any time.
- We do not send marketing or advertising emails.
8. Price and product information
Store locations come from OpenStreetMap (© OpenStreetMap contributors, ODbL). Product descriptions and quality indicators come from Open Food Facts (ODbL). Prices and offers come from sources provided or published by retailers. Until real sources are connected, clearly labelled demo data is shown. This information is not personal data.
9. Your rights
Under the GDPR you have the right to:
- access your data and get a copy. You can download it from your account (“Download my data”);
- have inaccurate data corrected;
- have your data erased. You can delete your account yourself in the account settings;
- restrict processing;
- data portability (the export is in JSON format);
- object to processing based on legitimate interest;
- withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it;
- lodge a complaint with the State Data Protection Inspectorate of Lithuania (L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt).
Send requests to pirkpigiau4@gmail.com. We respond within one month and may ask you to verify your identity.
10. Security
We apply appropriate technical and organisational measures: HTTPS only (HSTS), secure session cookies, a Content Security Policy, rate limiting, access control, encrypted OAuth tokens and data minimisation. Secret keys are kept only in the server environment.
11. Children
Accounts are available only from age 14. This is the age at which a child in Lithuania can consent to information society services themselves. Younger users can search without an account.
12. Changes
We will announce material changes on the site and, if you have an account, by email. Previous versions are available on request.