Who handles your data
The data controller is MB „Oxtren Labs“, company code 306197625, Šarkuvos g. 31-31, Kaunas, Lithuania, tel. +370 679 91246.
Send questions about your data to [email protected].
What this policy covers
This policy covers oxtren.com and oxtren.lt: the project enquiry form, emails you send us and the technical data created when you visit the site.
Oxtren Cloud (cloud.oxtren.com) is a separate system with its own rules.
What data we receive and why
Project enquiry. When you send the enquiry form, we receive:
| Data | Required | What we use it for |
|---|---|---|
| Name, email | yes | to reply to you |
| Company or project name, phone | no | to understand the context and reply in a convenient way |
| Project type, stage, description, current website address, budget range, timeline | type, stage and description – yes | to assess the enquiry |
| Attached files (up to 6, 20 MB in total) and their names | no | to assess the enquiry |
| Form language, the page you sent it from, the previous page address, campaign tags (utm_source, utm_medium, utm_campaign) if they were in the link | automatically | to reply in your language and know where enquiries come from |
| A keyed hash of your IP address (not the IP itself) | automatically | abuse protection |
| Enquiry number (OX-…) and time received | automatically | so we can find the enquiry |
Campaign tags and the previous page address are sent with the enquiry regardless of your cookie choice – they are form data, not cookies.
We store the enquiry in our database and forward it to the team by email, including your contact details, the enquiry and attached files. We may move the enquiry into our own customer management system to handle further communication. The email address in the enquiry is used only to reply and, if we agree, to prepare a proposal.
Nothing is sent until you press “Send the brief”, and we do not keep a draft of the form in your browser. If the form cannot reach the server and you choose “Send by email”, the message goes through your email provider to [email protected].
Emails and calls. If you write or call us directly, we receive what you give us: your name, contact details and the content of the message or call. We use it to reply.
Technical data. Like any web server, ours logs every request: IP address, time, the address opened (including tags such as utm_…), response status, the previous page address and the browser description. The API server (api.oxtren.com) logs the same when you send the form. We use this data to keep the site working and secure. Site traffic goes through Cloudflare (a content delivery and protection network), so Cloudflare sees your IP address and request data.
Abuse protection. To keep the form free of spam we limit the number of attempts, using an IP-based key kept briefly – from 1 minute to 24 hours. In the database we store a keyed hash of your IP address (HMAC-SHA256), not the address itself. The form also has a hidden field only bots fill in – such requests are rejected.
Analytics (only with your consent). If you turn on “Analytics” in the cookie settings, we use Google Analytics 4. Until you choose, the Google tag is not even loaded, so Google receives nothing; if you choose “Reject”, it is never loaded. Google Analytics shows which pages are visited and where visitors come from. Event data is kept for 14 months, and advertising signals (ad_storage, ad_user_data, ad_personalization) are always off. You can withdraw consent at any time under “Cookie settings” at the bottom of the page.
Legal basis
- The enquiry and our reply – steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)).
- Technical logs and abuse protection – our legitimate interest in keeping the site working and secure (GDPR Art. 6(1)(f)).
- Analytics – your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time.
Who else receives data
Data is received only by the service providers the site cannot work without. We do not sell data.
| Recipient | What it receives |
|---|---|
| Hetzner (servers) | database records, files and logs – the site and API run here |
| Cloudflare (network and protection) | site traffic: IP address and request data |
| Resend (email delivery) | the enquiry email with contact details, content and files |
| Our mailbox provider | emails sent to our addresses |
| Backup storage | copies of the database and files |
| Google (Google Analytics 4) | analytics data – only with your consent |
The site has no advertising pixels, social media plugins, embedded videos from other sites or maps. Fonts and videos are served from our own server.
We may disclose data to public authorities where the law requires it.
How long we keep data
We keep data only as long as needed for the purpose it was received for, or as long as the law requires. Some periods:
- Google Analytics event data – 14 months.
- Rate-limiting keys – from 1 minute to 24 hours.
- Your cookie choice in your browser – 12 months.
How we protect data
- We do not store IP addresses in the database – only their keyed hash.
- Attached files are kept on a private server disk, not in a public folder, and renamed with random names.
- The site uses no login cookies.
- Report security issues to [email protected].
Your rights
You have the right to:
- know what data of yours we process and get a copy of it;
- ask us to correct inaccurate data;
- ask us to erase data;
- ask us to restrict processing;
- object to processing based on legitimate interest;
- receive the data you provided in a common machine-readable format;
- withdraw consent at any time where processing is based on it (this does not affect what was done before).
To use these rights, write to [email protected]. We will reply within one month.
If you believe we process data unlawfully, you can complain to the State Data Protection Inspectorate of Lithuania: https://vdai.lrv.lt
What not to send
In the project description and attached files, include only what is needed to assess the project. Do not send health data, personal identification numbers, passwords or other sensitive data.
Contact
MB „Oxtren Labs“ · company code 306197625 · Šarkuvos g. 31-31, Kaunas, Lithuania · +370 679 91246 · [email protected] · security – [email protected]
Changes
When the way we handle data changes (for example, a new provider), we update this policy, its version and the date at the top of the page.