Privacy policy

3.1. Account and sign-in

• Data: e-mail address, name (if you enter it), interface language and the time of your last sign-in.
• Sign-in codes: we send a code by e-mail. We store only its hash, the number of wrong attempts and the IP address. The code is valid for 10 minutes.
• Sessions: for each sign-in session we store a hash of the session key, the IP address and the browser identifier.
• Bot protection: Google reCAPTCHA protects the sign-in form.
• Purpose: to create your account, let you sign in and keep others out of it.
• Basis: performance of a contract. We handle the IP address and browser identifier on the basis of our legitimate interest in protecting accounts from unauthorised access.

3.2. Companies, members and invitations

• Data: the company name, its members and their roles (owner or member), who invited whom, and notification settings. For an invitation we store the invited person's e-mail address, entered by a company owner.
• Purpose: to let a team work together and to control who sees and does what.
• Basis: performance of a contract. We handle the invited person's address on the basis of a legitimate interest: the company wants to invite a colleague. If you don't want the invitation, don't accept it: it expires after 14 days.

3.3. Conversations with a company's customers (we are the processor)

• Data: the customer's name, e-mail address or the ID the company passes from its own system, messages, screenshots, screen recordings and other files, e-mails with their headers, and for widget conversations the visitor's technical data (the page, browser and device, country, IP address; full list below).
• Purpose: to deliver the customer's message to the company, let the company reply in the widget or by e-mail, and show the same person's earlier conversations.
• Basis and terms: we handle this data on behalf of the company, which is the controller, under the Terms of service. The company is responsible for having a legal basis and for informing its customers.
• Spam rules: if a company turns on a rule that blocks a sender by IP address, we keep a hash of that address (for IPv6, computed from the /64 network), not the address itself. Company members see only a masked address. We keep the hash while the block lasts and 30 days after it ends. Basis: legitimate interest in protecting the company's support inbox from abuse.
• Trash: a conversation a company member deletes is kept for 30 days in Trash, where it can be restored. After 30 days it is deleted for good with its messages and files. A conversation marked as spam moves to Trash by itself after 30 days and is deleted 30 days after that.

3.4. AI features (we are the processor)

• Data: the text an AI feature has to work on: customer messages, part of a conversation, knowledge base articles or a search query.
• Purpose: to prepare a draft answer, find the right article, check or translate a text. AI features are on by default, so some of them run automatically: a draft answer is prepared for each new customer message, and knowledge base articles are indexed for search when they are created or changed. A company can turn AI features off in its settings. AI never sends anything to a customer by itself.
• Who receives it: one of the AI providers: Anthropic, OpenAI or OpenRouter. OpenRouter passes the request to the maker of the chosen model, for example Google.
• Retention: we keep every AI request and answer for 90 days to fix problems and track costs. Only the platform administrator sees this log. After 90 days the entries are deleted automatically.
• Training: we do not use the data to train AI models. Under their API terms, Anthropic and OpenAI do not use the data they receive to train their models.

3.5. Legal answers (we are the processor)

• Data: the legal question a company member asks or an AI feature writes from a conversation. It may contain part of a customer's message.
• Who receives it: teisesdi.lt, operated by MB Gerbora in the European Union. It updates the legal acts from e-tar.lt every night.
• Retention: teisesdi.lt keeps an answer for 30 days. We keep the question and the answer we receive for 90 days to fix problems, then they are deleted automatically. If a member puts the answer into a message to a customer, that message is kept like the other messages of the conversation.

3.6. Chat widget and knowledge base statistics (we are the processor)

• Data: how many times the chat widget loaded and was opened, how many times knowledge base pages were opened, what people searched for in the knowledge base without a result, how many times a video was played and watched to the end, the page address without query parameters, the country, and the device and browser type.
• We count visitors without cookies. From the IP address and the browser identifier we make a code that the address cannot be recovered from. The code changes every day and is deleted within 2 days. We do not store the IP address itself.
• Purpose: to show the company how many people see its chat widget and read its knowledge base, and what they look for but do not find.
• Basis: we handle this data on behalf of the company, which is the controller, under the Terms of service.
• Retention: we keep the counted statistics for 60 days, then they are deleted automatically.

3.7. Payments

• Data: the company name, billing address, VAT number if you give one, the e-mail address for invoices, the add-ons bought and the invoices.
• You enter card details on a Stripe page. We never receive or store them.
• Purpose: to take payments for add-ons and issue invoices.
• Basis: performance of the contract and our legal obligation to keep accounting records.

3.8. Mailboxes

• A company can connect its own mailboxes (Gmail, another IMAP and SMTP server, Amazon SES) or forward the mail of its support address to us.
• We store sign-in details (passwords and keys) encrypted and use them only to receive and send mail on the company's behalf.
• We keep the originals of received e-mails for 30 days; after that only the message text and selected headers remain.
• Sending from the company's Microsoft 365, Outlook or Google (Gmail) address: the company owner can sign in with their Microsoft or Google account and let HRC pagalba send replies from that address. We ask only for permission to send e-mail (the Microsoft Graph permission Mail.Send, the Gmail permission gmail.send). We do not ask for permission to read the mailbox and do not read mail through this permission; the company forwards incoming mail to the service or connects it separately over IMAP.
• What we then store: the account's e-mail address and name, as provided by Microsoft or Google, and an encrypted refresh token that lets us send e-mail. We do not store the short-lived access token: we get one for each send and keep it in memory only. After sign-in we send a test e-mail to the e-mail address of the member who signed in.
• We then send each reply through Microsoft Graph or the Gmail API. We pass them the whole e-mail: the sender name (the name of the team member who replied and the mailbox name), the recipient's address, the subject, the text of the reply, the signature, a quote of up to three earlier public messages and technical header fields (the reply address, the conversation identifier). We do not pass internal notes. Microsoft or Google may keep a copy of the e-mail in the company's sent mail folder; they handle it under the company's agreement with them. If sending through Microsoft or Google stops working (for example, the permission was withdrawn or Microsoft does not allow sending from that address), we send replies through Amazon SES.
• Purpose: to send replies from the company's address. Basis: performance of a contract; for the company's conversation data we act as its processor.
• Disconnecting: when the company turns off this kind of sending or deletes the mailbox, we delete the stored refresh token. We then also withdraw the Google permission ourselves, unless another connected mailbox uses the same Google address. We cannot withdraw the Microsoft permission, so you can remove it in your account: account.microsoft.com or myapps.microsoft.com.

3.9. Telegram notices

• A company member can connect Telegram to get notices about new messages. We then store the Telegram chat identifier.
• A notice carries only the customer's name and an excerpt of up to 300 characters, never an e-mail address or files.
• Basis: performance of a contract. Notices can be turned off at any time.

3.10. This website (hrc.lt)

• The website shows no advertising. Until you click "Accept", it loads only our own scripts and our chat widget, which stores nothing until you write a message. Visit statistics are described under "Visit statistics on hrc.lt (Google Analytics)".
• The hrc_lang language cookie: when you pick a language in the language menu, we store only its code (for example "en") in your browser for one year, so the site opens in that language next time. The cookie is set for the whole hrc.lt domain, so it is also sent to app.hrc.lt and *.hrc.lt. It is strictly necessary for a feature you asked for, so we don't ask for consent.
• Language by country: when you first open the home page without this cookie, the server may open the page in your country's language, based on the country Cloudflare passes on. We don't store the country.
• The __Host-hrc_consent consent cookie: when you click "Accept" or "Reject", we store only your choice and its version for 6 months. The cookie is set without a domain, so it belongs only to the site where you made the choice: you choose separately on the hrc.lt website and in the app.hrc.lt app, and each asks once. Your browser does not send this cookie to other *.hrc.lt addresses, so companies' knowledge base sites at *.hrc.lt cannot read or change it. We no longer use the old hrc_consent cookie, which was set for the whole hrc.lt domain, and we delete it. It is strictly necessary to remember your choice, so we don't ask for separate consent. You can change your choice at any time with the "Cookie settings" link at the bottom of every page, and in the app in the account menu or under the sign-in form; a change applies only to the site where you make it.
• The server keeps a short technical request log (time, page address without query parameters, IP address and browser identifier) to keep the site running and safe.
• Basis: our legitimate interest in keeping the website running and secure.

3.11. AI apps you connect (we are the processor)

• A company member can connect their own AI app, such as ChatGPT, Claude or Cursor, over MCP, OAuth or a personal key. The company owner allows this by turning on AI agent access.
• What the app receives: only what it asks for and what the permissions of the chosen AI agent allow, for example conversations with customers and their contacts, tasks, knowledge base articles, files and statistics. The app can also change data where the permissions allow it.
• Who receives it: the app's provider, for example OpenAI (ChatGPT) or Anthropic (Claude). The company chooses it, and it handles the data under its own terms and privacy policy, as a separate recipient. We pass data to it only on the company member's instruction.
• What we store: the AI agent's name and permissions, hashes of the sign-in keys (never the keys themselves), and one entry per call in the "What the AI agents did" log: who, when and on what, never the texts. We keep the log for 90 days.
• How to disconnect: app.hrc.lt, Settings, AI agents. You can pause, revoke or delete the AI agent or its connection at any time. What the app already received stays with its provider under its terms.
• Basis: we handle this data on behalf of the company, which is the controller, under the Terms of service.

3.12. Visitor technical data from the chat widget (we are the processor)

When a visitor writes through the chat widget, we store this technical data with the conversation and with each message:

• The IP address and the country derived from it.
• The device type (computer, tablet or phone), the browser and the operating system with their versions, and the full browser identifier.
• The full address of the page the visitor wrote from, including the parameters after the question mark and the part after the hash (#), the page title, and the address the visitor came to it from. Before storing them we mask values that look secret, such as tokens, codes, passwords, keys and e-mail addresses.
• The screen and browser window size, language, time zone and connection type.
• The chat widget version.
• The latest JavaScript errors on that page at the moment the message is sent. We mask secret values in them, such as passwords and keys.

Purpose: to answer the visitor's request and find out why something is not working for them.

Basis: we handle this data on behalf of the company, which is the controller, under the Terms of service. For the company this is a legitimate interest in providing customer support (GDPR Article 6(1)(f)).

Who sees it: the company's members in app.hrc.lt, next to the conversation.

Retention: with the conversation. A deleted conversation is first kept up to 30 days in Trash; when it is deleted for good, this data is deleted too.

3.13. Page errors from the chat widget (we are the processor)

If a company turns on “Collect page errors” for its chat widget (off by default), the widget records JavaScript errors on that company's pages, even when the visitor does not write. With each error we store:

• The error text and its stack.
• The page address and the address the visitor came to it from. Before storing them we mask values that look secret.
• The browser, operating system, device type, language, window size and country. We do not store the IP address.
• The time the error happened.

If the visitor has already written through the widget, we link the error to their contact.

Purpose: to help the company find and fix errors on its pages and answer visitors for whom something is not working.

Basis: we handle this data on behalf of the company, which is the controller, under the Terms of service. For the company this is a legitimate interest in providing customer support and fixing errors (GDPR Article 6(1)(f)).

Who sees it: only the company's members in app.hrc.lt.

Retention: 60 days, then it is deleted automatically. It is deleted earlier when the company turns the setting off, deletes the chat widget or deletes the contact the error is linked to.

3.14. Visit statistics on hrc.lt (Google Analytics)

• Only after you click "Accept" does the website load Google Tag Manager and Google Analytics 4. They are provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); Google LLC in the United States may also process the data. Before you choose, and after you click "Reject", these scripts are not loaded and nothing is sent to Google Analytics.
• Purpose: to understand how visitors find and use the website (where they come from, which pages are read, which language people pick, how many click "Start for free") and to improve it. We don't use this data to show or tailor advertising, and we keep Google signals (linking with your Google account) and advertising features turned off.
• Data: the page address (including the part after the question mark, such as utm campaign tags) and title, the address of the previous page, where you came from (a search engine, another site or a campaign), the language, the approximate location (country and city) that Google derives from the IP address (Google Analytics does not store the IP address itself), the device type, browser, operating system and screen size, a random browser identifier in cookies whose names start with _ga, and the time of the visit.
• Google Analytics also records automatically: how far a page is scrolled (when you reach its bottom), clicks on links to other sites (the link address and domain, its identifier and CSS classes), site search (what you searched for, when the search words are in the page address), form use (that you started or sent a form, which form and its identifier, where it is sent, how many fields it has, the identifier, name, type and position of the first field you used and the label of its send button, but not what you typed), embedded video viewing (start, progress and end, the video's title, provider, length and address, and whether it is visible on screen), file downloads (the file name and extension, the link's text, address, domain, identifier and CSS classes) and page changes without a full reload.
• Our own events: clicks on the main buttons and links (which button and in which part of the page), viewing the pricing section, the plan you pick, starting sign-up, changing the language, opening the chat widget, opening an answer in the frequently asked questions (which question), and viewing the documentation or the legal pages. These events never carry text you type, a name or an e-mail address.
• If you accepted on the hrc.lt website, Google Analytics adds a linker parameter _gl, which carries the browser identifier, to links from hrc.lt to app.hrc.lt; it is visible in the page address. The app uses it only if you also accept there; then your visit to the website and the app is joined into one and can be linked to your pseudonymous user identifier; see "Usage statistics in the app.hrc.lt app (Google Analytics)".
• Basis: your consent. You can withdraw it at any time: click "Cookie settings" at the bottom of any page, then "Reject". Withdrawing applies to the hrc.lt website; in the app.hrc.lt app you withdraw separately. Statistics are then no longer collected, and we delete the _ga cookies the website can reach. Withdrawing does not affect the lawfulness of processing before it.
• Retention: Google Analytics keeps data linked to the browser identifier for 14 months from collection; after that only aggregated reports without identifiers remain. The _ga cookies last up to 2 years after your last visit unless you delete them or withdraw consent sooner.
• Our Google Analytics account has the data sharing setting "Google products & services" turned on. Google may therefore also use these statistics, and those collected in the app.hrc.lt app, for its own purposes, to improve its products and services, under its own terms. For that use Google is a separate controller and is responsible for it itself. This applies only to data collected with your consent. More: Google's privacy policy and how Google uses information from sites or apps that use its services.
• Google LLC may process the data in the United States; this relies on the EU-US Data Privacy Framework, in which Google participates, and on the standard contractual clauses approved by the European Commission.

3.15. Usage statistics in the app.hrc.lt app (Google Analytics)

• Only after you click "Accept" in the app.hrc.lt app (a choice made on the hrc.lt website does not apply in the app; the app asks separately) does the app load Google Tag Manager and Google Analytics 4. They are provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); Google LLC in the United States may also process the data. Before you choose, and after you click "Reject", these scripts are not loaded and nothing is sent to Google Analytics.
• Purpose: to understand how companies and their members use HRC pagalba (which features are used, at which setup step people stop, which plans they choose) and to improve the service. We don't use this data to show or tailor advertising, and we keep Google signals (linking with your Google account) and advertising features turned off.
• Automatic measurement is turned off in the app: the app does not send the real addresses of pages and links, search words or form data. Google Analytics 4 still sends its own automatic events that cannot be turned off (the first visit, the start of a visit and active time: first_visit, session_start, user_engagement and the like); apart from those, the app sends only the data listed below.
• Identifiers: a random browser identifier in the _ga cookies; your user identifier, which we create from your account's internal identifier with a one-way hash function and a secret key (it is not your e-mail address, your name or the internal identifier itself), so that your visits from different devices are linked; and a company identifier created the same way. They do not reveal your name or e-mail address, but we can link them to your account, so they are pseudonymous personal data.
• The _ga cookies are set only for app.hrc.lt in the app and only for hrc.lt on the website, so each site has its own browser identifier. If you accepted on the hrc.lt website and go to the app, a linker parameter _gl is added to the link, which carries the website's browser identifier; if you also accept in the app, your visit to the website and the app is joined into one and can be linked to your user identifier. Your browser does not send these cookies to other *.hrc.lt addresses, so companies' knowledge base sites at *.hrc.lt cannot read them.
• Account properties: the company's plan, your role (owner or member), the company's size (a range of the number of members), how long the company has used the service (a range), the interface language, a range of the number of chat widgets, and whether a chat widget is installed, a mailbox is connected, a knowledge base is published and AI features are on.
• Events: screens viewed, only as a template (for example /c/:companyId/inbox), without the real address, identifiers, query parameters or title; setup steps (sign-up, creating the company, a getting-started step, installing a chat widget, the first conversation, the first reply, connecting a mailbox, publishing a knowledge base, creating a task, inviting a member); plans (viewing the plans, a plan bought with its name and price in euros, a plan cancelled); feature use (replying in a conversation and its channel, using or dismissing an AI draft, closing a conversation, a bulk action with its type and a range of the number of items, a filter applied with its name, creating a knowledge base article, publishing a news entry, creating a contact, saving settings with the section's name); using search, without the search words; clicking a link to another site, only with a fixed category (for example a help link or a customer's link), without the address; downloading a file, only with the file type, without its name.
• With these, Google receives the same technical data as on the website: the language, the approximate location from the IP address (Google Analytics does not store the IP address itself), the device type, browser, operating system, screen size, the start of a visit and how long you were active.
• We never send: the text of messages or notes, data of customers or contacts, people's names, e-mail addresses, addresses of pages or links, file names, or any text you type.
• Events from our servers: if you are an owner of the company and click "Accept" in the app, our servers also send three events about the company to Google Analytics, even when the app is closed: the first time a chat widget of the company shows on a website, the first conversation of the company (with its channel, chat widget or e-mail), and the start of a paid plan (with the name of the plan, without the price). With them, our servers send the browser identifier from the _ga cookie of the app, your user identifier and the company identifier described above; the text of messages and data of customers are never sent. This stops when you click "Reject" in the app (if you click it under the sign-in form, then when you next open the company in the app), when another owner of the company clicks "Reject" in the app, when you are no longer an owner of the company, and at the latest 180 days after the app last passed on your consent. If the company has several owners, the choice the app passed on last applies.
• Basis: your consent. You can withdraw it at any time: in the app, click "Cookie settings" in the account menu (on a phone, under "More") or under the sign-in form, then "Reject"; on the hrc.lt website you withdraw separately. Statistics are then no longer collected, and we delete the _ga cookies the app can reach. Withdrawing does not affect the lawfulness of processing before it.
• Retention: Google Analytics keeps data linked to the browser or user identifier for 14 months from collection; after that only aggregated reports without identifiers remain. The _ga cookies last up to 2 years after your last visit. If you ask us, we also delete the statistics linked to your identifiers from Google Analytics.
• Google's use of the data for its own purposes and the transfer to the United States are described under "Visit statistics on hrc.lt (Google Analytics)".