Privacy policy
Last updated 4 October 2026
In short
- We collect only what you send us, plus the technical minimum to run the site.
- No cookies, no advertising trackers and no profiles. We never sell your personal data or share it for marketing.
- We never use your data to train AI models.
- Briefs from people we don’t end up working with are deleted within 12 months.
1. Who is responsible
The controller of your personal data is Arkira Ventures, MB (a small partnership, mažoji bendrija), company code 306351429, VAT code LT100019659116, registered at Smiltelės g. 53-11, LT-94262 Klaipėda, Lithuania. For anything about your data, write to hello@arkira.ventures.
This policy covers this website, project briefs, emails and the personal data of people we work with on client projects.
2. What we collect, why, and for how long
When you send a project brief
- Data
- Name, work email, company, what you need and your message; optionally a budget range and timeline.
- Why
- To reply, ask follow-up questions and, if you want to go ahead, prepare a proposal.
- Legal basis
- Steps taken at your request before a possible contract (GDPR Article 6(1)(b)).
- Kept
- Deleted within 12 months of our last contact if we don’t start working together.
When you email us
- Data
- Your email address, name and whatever you choose to write or attach.
- Why
- To answer you and keep a record of the conversation.
- Legal basis
- Steps at your request (Article 6(1)(b)), or our legitimate interest in replying to messages (Article 6(1)(f)).
- Kept
- As for briefs: 12 months after our last contact, unless it becomes project correspondence.
When we work together
- Data
- Contact details of the people we work with, the agreement, project correspondence, invoices and payment records.
- Why
- To deliver the work, invoice it and meet our accounting and tax duties.
- Legal basis
- Performing our contract (Article 6(1)(b)) and legal obligations (Article 6(1)(c)).
- Kept
- For the agreement’s term and then as long as Lithuanian accounting and tax law requires for business records, generally 10 years.
Keeping the form free of spam
- Data
- Signals from your browser, read by Cloudflare Turnstile when you submit the form, and the form fields themselves.
- Why
- To stop bots and link spam before anything is stored.
- Legal basis
- Our legitimate interest in a secure, working form (Article 6(1)(f)).
- Kept
- Spam is discarded straight away; we don’t keep the browser signals.
Running the website
- Data
- Technical request details recorded by our host: IP address, browser, the page requested and the time.
- Why
- To deliver pages, keep the site secure and investigate faults or attacks.
- Legal basis
- Our legitimate interest in a secure, working website (Article 6(1)(f)).
- Kept
- Kept by our hosting provider for a limited period under its own retention rules.
Counting visits
- Data
- Which pages are viewed, the site you came from, and your browser, device type and country, counted in aggregate by Cloudflare Web Analytics.
- Why
- To see whether the site is useful and which pages work.
- Legal basis
- Our legitimate interest in understanding how the site is used (Article 6(1)(f)).
- Kept
- Only aggregate counts are kept. No cookies, no profile, nothing that identifies you.
3. What we don’t do
- We don’t sell, rent or trade personal data, and we don’t add you to mailing lists.
- We don’t use your data, briefs or project material to train AI models.
- We don’t make decisions about you by automated means alone, and we don’t profile visitors.
- We don’t ask for special categories of data, such as health data. Please don’t include them in a brief.
4. Cookies and tracking
This website sets no cookies and stores nothing in your browser. It runs no advertising or social media scripts. Visits are counted with Cloudflare Web Analytics, which works without cookies, doesn’t build a profile of you and doesn’t follow you to other sites. That is why there is no cookie banner.
5. Who processes data for us
We use a small number of service providers, each bound by a data processing agreement and allowed to use the data only on our instructions:
- Netlify, Inc. (United States): Hosts the website, stores brief submissions and keeps technical logs.
- Cloudflare, Inc. (United States): Visit statistics and the form’s spam check.
- Proton AG (Switzerland): Our email, including the notifications sent when a brief arrives.
We may also share data with our accountant or legal advisers when needed, and with authorities where the law requires it. Client project data is handled under the terms agreed with each client.
6. Transfers outside the EEA
Netlify and Cloudflare are based in the United States. Transfers to them are protected by the safeguards the GDPR requires, such as the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. Proton is based in Switzerland, which the European Commission recognises as providing adequate protection. You can ask us for a copy of the relevant safeguards.
7. How we protect it
The site is served only over HTTPS with strict security headers. The form is checked for spam before anything is stored, and access to submissions and email is limited to the people who need it. We keep as little as we can, for as short a time as we can.
8. Your rights
Under the GDPR you have the right to:
- Access. Ask what data we hold about you and get a copy.
- Correction. Have inaccurate or incomplete data put right.
- Erasure. Have your data deleted when we no longer need it or have no lawful basis to keep it.
- Restriction. Ask us to pause using your data while a question about it is settled.
- Objection. Object to processing based on our legitimate interests; we then stop unless we have compelling grounds.
- Portability. Receive data you gave us in a common, machine-readable format, or have it sent to someone else.
Where we rely on your consent, you can withdraw it at any time. To use any of these rights, write to hello@arkira.ventures. It’s free, we reply within one month, and we may ask you to confirm your identity first.
If you think we’ve handled your data wrongly, please tell us first so we can put it right. You can also complain to the State Data Protection Inspectorate of Lithuania (vdai.lrv.lt) or the data protection authority where you live or work.
9. Children
This website is for businesses. It isn’t aimed at children, and we don’t knowingly collect data from anyone under 16.
10. Changes to this policy
If we change how we handle personal data, we update this page and the date at the top. Significant changes that affect people we already work with are also sent to them directly.