Birža

Birža Privacy Policy

Version: 14 October 2026. Effective date: 14 October 2026.

Who is responsible

Birža is operated by Lukas Plachtinas, an individual in Lithuania, who is the controller of the personal data described here. Contact: info@birza.app. Correspondence address: B. K. Balučio g. 21B, LT-11305 Vilnius, Lithuania.

This policy covers the Birža mobile app and its supporting account, listings, moderation, notification and support services. It does not describe unrelated third-party websites you choose to visit from listings.

Information we handle

chosen public name, account type and optional phone/contact defaults.

seller identity, selected location or property map coordinates and contact details you choose to attach to a listing.

website, contact details, memberships and approval/verification information.

notification preferences and optional saved-search email subscriptions.

messages, replies and screenshots you attach.

Signed-in activity uses an account-associated hash; guest activity uses a temporary session identifier. Hashing does not make account-linked data anonymous. Sellers receive aggregate statistics, not visitor identifiers.

authentication, email and map providers. These can include IP addresses, request timestamps, device/app/SDK identifiers, request paths and error/security records. The provider and retention details below explain their handling.

Some recent searches, drafts/photos and preferences are stored on your device. Photos and draft content may also be uploaded as part of preparing a listing. Removing the app does not delete your server account or uploaded content.

You can browse available listings without an account. Signing in is needed for account features, publishing and access to seller contact details. Providing information needed for a feature is necessary to use that feature; optional fields and email subscriptions can be left unused.

Why we use it

We use account and listing data to provide the service you request, including authentication, publishing, saved searches, notifications and support (performance of our agreement with you). We process reports, moderation records and limited listing activity to protect users, prevent abuse and provide useful seller statistics (legitimate interests). Optional search email subscriptions use your choice to subscribe; you can unsubscribe. We may process information when a specific legal obligation requires it. Optional saved-search emails are based on your consent. You can withdraw it at any time. Security and moderation serve the interests of protecting users and operating a trustworthy marketplace; statistics provide sellers with limited aggregate information. We consider users’ rights, including those of minors, when relying on these interests.

We do not treat acceptance of the terms as consent to every use of personal data.

What other users can see

Published listings expose the selected name, description, photos, listing details and location. Phone numbers and contact emails are shown to signed-in users under the app's contact controls. Approved business pages show business information and inventory; their contact details are also sign-in gated. Your authentication email is not automatically used as a public business email.

Listing contacts are snapshots: editing your profile does not automatically update existing listings. Edit the listing too if its contacts need changing. Avoid uploading identity documents, private correspondence, photos of people without permission or personal data unrelated to your listing. Other users can copy information they see; removing it from Birža cannot recall their copies.

Support conversations and attachments are accessible to you and authorised administrators. Reports and moderation records have restricted staff access.

Service providers and moderation

We use Supabase for account authentication, database and file storage. Email services deliver authentication codes and, when enabled, saved-search digests. The digest implementation uses Resend. Google Maps and related map/place services support map features and process requests through their services/SDKs.

Automated moderation sends submitted listing titles, descriptions and photos to OpenAI to check for prohibited content. Structured phone, seller-name and address fields are excluded from that request; personal information embedded in your text or photos can still be included. Results assist publication and human review. A clear automated result may publish a listing; flagged or failed checks are held for review. You may challenge a moderation decision through support or info@birza.app.

Resend delivers both authentication emails and enabled search digests. Supabase stores and processes our account/database/file data; OpenAI processes submitted content for moderation; Google supplies map features. Our static legal/help site is hosted on Cloudflare Pages when published. It has no advertising, analytics scripts or account sign-in, but Cloudflare processes technical request/security data to deliver and protect the site. We may disclose information when required by law or necessary to address a lawful claim, limiting disclosure to what is needed.

International processing

Some providers or their subprocessors may process information outside the European Economic Area. Our Supabase project is hosted in London, United Kingdom (eu-west-2). Providers may also process data in the United States and other countries where their subprocessors operate. Transfers are subject to the applicable provider agreements and safeguards, including adequacy decisions where applicable and Standard Contractual Clauses for other transfers. You may request information about those safeguards at info@birza.app. See the provider links below for their processing locations and contractual protections. We do not promise that all data stays in Lithuania or the EU.

Retention and deletion

Active account and listing information is kept while needed to provide the associated features. You can remove saved searches, edit/remove listings and request account deletion. Hiding or expiring a listing is not necessarily its permanent deletion from storage or moderation records.

Account-linked profiles, support conversations, saved searches, notification/delivery records and visitor records are kept while the account exists or until an applicable deletion request is fulfilled. Removed or expired listings, their photos and moderation history can remain privately stored for listing administration while the account exists; they are removed with account deletion. We do not currently operate automatic time-based purging of those records. You can request earlier erasure, subject to applicable rights and any specific legal obligation. We do not keep manual/off-site database backups. The current Supabase Free plan provides no scheduled database backups or point-in-time recovery; API/database operational logs have a published one-day retention period and no log drains are configured. Separate authentication audit records and provider-internal records are not covered by that one-day log-viewing period.

Account deletion is available in the app's profile settings. You may also email info@birza.app from your account email with the subject “Birža account deletion”. We may ask for proportionate proof of ownership; never send a login code or password. We handle requests at this address and normally complete verified requests within one month. If a legally permitted extension or exception applies, we explain it and the reasons.

The deletion flow removes your account, owned listings, uploaded photos and support attachments/conversations. A business shared with other members can remain; contact us if it contains your personal information. Aggregate listing totals may remain after account-linked activity is removed. The app removes uploaded listing/support files before deleting the authentication account; related account records cascade. Deletion can require retrying after a failure. Removing an account does not automatically erase provider delivery logs, independent audit records or someone else’s copies. If specific data must be kept for a legal obligation or claim, we restrict its use, identify the reason and applicable duration, and erase it when that reason ends. We do not apply a general additional retention period to a deleted Birža account.

Your choices and rights

You may request access, correction, erasure, restriction or portability of your personal data, and object to processing based on legitimate interests. Where processing uses consent, you can withdraw it without affecting earlier lawful processing. These rights depend on the applicable conditions. Contact info@birza.app; we respond within the applicable legal timeframe, normally one month, and explain any permitted extension.

Use email unsubscribe controls or the saved-search settings to stop optional digests. Device permission settings control photo access. You can complain to Lithuania's State Data Protection Inspectorate or the competent authority where you live or work.

Security, age and changes

We use access controls and secure connections to protect information. No system can guarantee absolute security. Keep authentication codes private and report suspected misuse to info@birza.app.

Accounts are for users aged 14 or older. Users aged 14–17 without full legal capacity need parent or legal-guardian consent and supervision. The service is not intended for children under 14. Contact us if you believe an ineligible child has created an account so we can investigate and arrange appropriate deletion. If this policy changes, we update its date and notify users of material changes as appropriate. New processing that requires consent will have a separate choice.

Provider retention and information

Resend publishes 30-day email and log retention on standard Free/Pro/Scale plans; this applies to authentication and digest delivery records and is separate from deletion of our database records. OpenAI’s published table for the /v1/moderations endpoint lists no abuse-monitoring or application-state content retention and no training use. This is not a promise that all operational metadata or legally required records are immediately erased. Google map logs use purpose-based provider retention; Cloudflare retains operational/security information under its published policy. Contact us for requests involving provider-held personal data so we can assess the request and coordinate with the relevant provider.