Privacy policy

Customer Bits is operated as individual activity (individuali veikla) registered in the Republic of Lithuania under certificate no. 913953. The holder of that certificate is the data controller for the account data described below.

For anything in this policy, write to [email protected].

Customer Bits does two separable things, and the law treats them differently. Being clear about which is which is the whole of this policy.

Your console account is ours to answer for. When you register, we decide what to collect and why, so we are the controller and the rest of this page applies to you directly.

The data your product sends us is yours. Feedback and quiz responses arrive from a customer’s own backend, and we store and return them on that customer’s instructions. For that data the customer is the controller and Customer Bits is a processor. If you are an end user of a product built on Customer Bits, your rights run against that product, not against us, and its privacy policy is the one that governs you.

If you create a console account, we store:

• Your name, email address and company name, because you typed them into the registration form.
• Your password, hashed with argon2id. It is never stored or logged in readable form and cannot be recovered, only replaced.
• When you registered, when your email was verified and when you last signed in.
• An audit trail of changes made through the console: which record, the fields before and after, and which project made the change.
• IP addresses, briefly, to apply rate limits and to record who made a change.

When you choose a password we check whether it appears in known breach corpora using the Have I Been Pwned range API, which works by k-anonymity: the first five characters of a hash of the password are sent, never the password and never the full hash.

No payment card details, because the service takes no payments here. No identity documents. No location beyond what an IP address implies. No advertising or cross-site tracking profiles, and no third-party advertising pixels, session recorders or chat widgets anywhere on this site.

The service has no users table for your customers’ end users. A product integrating with Customer Bits sends an opaque identifier of its own choosing, and we never receive the account behind it.

• To provide the service you asked for (Art 6(1)(b)): your account, signing you in, and the emails that verify your address or reset your password.
• Our legitimate interest in a service that is not abused (Art 6(1)(f)): rate limits, the audit trail, and the breached-password check. Keeping a record of who changed what is what makes a mistake or a compromise traceable.
• Your consent (Art 6(1)(a)): analytics, and nothing else. It is asked for plainly, refusing is as easy as accepting, and you can change your mind at any time from the footer of any page.

• Account data: while the account exists, and deleted when it is closed.
• Sign-in sessions: twelve hours, or until you sign out.
• Audit rows: one year, then deleted automatically by a job that runs every day.
• Your cookie choice: twelve months, after which you are asked again.

Only the companies needed to run the service, each under a contract that limits them to our instructions. No one is sold anything, and no personal data is transferred to a third party for its own purposes.

• Our hosting provider, which runs the servers and the database, inside the European Union.
• Brevo, which delivers the verification and password reset emails, and therefore sees your email address. Brevo is established in France.
• Cloudflare, which serves the site and filters abusive traffic, and therefore sees the IP addresses of requests.

Some of these companies are established outside the European Economic Area. Where that means personal data leaves the EEA, it is covered by the European Commission’s standard contractual clauses or an adequacy decision.

Write to [email protected] and you can ask us to give you a copy of what we hold about you, correct it, delete it, restrict what we do with it, hand it to you in a portable form, or stop relying on legitimate interest where you object. We answer within one month.

Withdrawing consent to analytics never costs you anything: the site works the same either way.

If you are not satisfied with how we handle it, you can complain to the Lithuanian State Data Protection Inspectorate, Valstybinė duomenų apsaugos inspekcija, or to the supervisory authority where you live.

When this policy changes, the date at the top changes with it. If a change affects what we collect or why, we tell account holders by email rather than relying on you to re-read the page. Changing the purposes analytics consent was given for resets that consent, and you are asked again.