Privacy Policy

1. Introduction

UAB Saakuru Technologijos ("we," "us," or "our") operates the Form Builder Application (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your privacy and ensuring the security of your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Information We Collect

2.1 Information You Provide

• Form responses: Any data you submit through forms, which varies depending on the form's questions
• Email address: Required for verification of form submissions
• File uploads: Any files you choose to upload as part of form submissions
• Lesson answers: Answers, completion state, and AI feedback generated when you complete an interactive lesson

2.2 Information Collected Automatically

• IP address: Used for security and fraud prevention
• Browser type (user agent): Used for security and debugging purposes
• Submission timestamp: When you submitted the form

3. How We Use Your Information

• Process and store your form submissions
• Send verification emails to confirm your submissions
• Ensure security and prevent fraud or abuse
• Provide your submissions to form owners (the organizations that created the forms)
• Improve our Service and fix technical issues
• Provide optional AI feedback on a lesson answer when you explicitly request it

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: You provide explicit consent when submitting forms by agreeing to this Privacy Policy
• Legitimate Interest: For security measures, fraud prevention, and Service improvement
• Contract: To fulfill our obligations to form owners who use our Service

5. Data Sharing

We may share your information with:

• Form owners: The organizations that created the forms receive your submissions
• Service providers: Companies that help us operate the Service:
  • Supabase (data hosting)
  • Resend (email delivery)
  • Vercel (application hosting)
  • Vercel AI Gateway and the selected AI model provider (lesson generation and optional answer feedback)
  • Google Gemini API (lesson illustration generation and validation)
  • Stripe (billing, checkout, tax, and customer portal)

When a learner requests AI feedback, we send only the relevant answer, lesson question, saved rubric, and saved reference material. We do not include the learner's email address or unrelated form responses in that model request. The feedback is advisory and does not produce legal or similarly significant effects by itself.

We do NOT sell your personal data to third parties.

6. Data Retention

• Form submissions: Retained as determined by the form owner and any configured retention settings
• Unverified submissions: Verification links expire after 24 hours
• Audit logs: Retained for security and compliance purposes
• File uploads: Follow the same configured retention cleanup as their related submissions
• Generated lesson illustrations: Follow the deletion lifecycle of their owning lesson

7. Your Rights

Under the GDPR, you have the following rights:

• Right of access: Request a copy of your personal data
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing: Request limitation of how we use your data
• Right to data portability: Receive your data in a machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to lodge a complaint: File a complaint with a supervisory authority

8. How to Exercise Your Rights

To exercise any of your rights, please contact us at: privacy@silotech.xyz

We will respond to your request within 30 days. We may need to verify your identity before processing your request.

9. International Data Transfers

Your data may be processed in the European Union/European Economic Area (EU/EEA) or the United States, depending on the service provider's infrastructure. When data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses.

10. Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for stored data
• Access controls and Row Level Security (RLS) policies
• Audit logging of data access
• Regular security assessments

11. Cookies

We use only strictly necessary cookies for the functioning of the Service:

• Session cookies: Required for form access control and authentication. Admin sessions store strictly necessary access, refresh, expiry, user ID, and email values.

We do not use marketing, analytics, or tracking cookies.

12. Children's Privacy

Our Service is not intended for children under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at privacy@silotech.xyz.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the "Last Updated" date at the top of this policy. We encourage you to review this policy periodically.

14. Contact Us

15. Supervisory Authority

If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the supervisory authority in Lithuania: