Privacy Policy

1. Who We Are

Izlūks is operated by Partners F&E (“we”, “us”, “our”). We are the data controller for the personal data described in this Privacy Policy. You can reach us at support@izluks.lv.

2. Data We Collect

2.1 Account Data

When you register, we collect your name and email address. You may optionally provide a Latvian personal identification code or company registration code for identity verification purposes.

2.2 Authentication Events

We log login, signup, and password change events — including IP address and browser user agent — to protect against unauthorized access and brute-force attacks.

2.3 Payment Data

We do not store your credit card details. Payments are processed by Stripe, which handles your payment information in accordance with PCI DSS standards. We store a Stripe customer identifier, transaction amounts, and credit pack details to maintain your account balance.

2.4 Chatbot Queries

When you use the AI analytics chatbot, we log the query text, the generated database query, execution time, and result count for audit and quality improvement purposes. No personal data is included in the chatbot context sent to AI providers.

2.5 Usage Data

We may collect standard usage data such as pages visited, features used, and interaction patterns through analytics tools. See our Cookie Policy for details.

2.6 Feedback Submissions

When you submit feedback, a feature request, or a bug report through our contact form, we collect the following data:

• Message content — the text of your feedback or request;
• Email address — so we can follow up on your submission;
• Name — if you choose to provide it (optional for guests);
• Category — the type of feedback (feature request, bug report, enterprise inquiry, or other);
• IP address and browser user agent — for rate limiting and abuse prevention;
• Source page — which page the feedback form was submitted from.

If you are logged in at the time of submission, your feedback is linked to your user account. Guests may submit feedback without creating an account.

3. How We Use Your Data

We process your personal data to:

• Provide, maintain, and improve the Service (account management, credit tracking, report generation);
• Process payments and manage subscriptions;
• Protect the security of the Service (fraud prevention, brute-force detection, audit logging);
• Communicate with you about your account, billing, and Service updates;
• Analyze usage patterns to improve the Service (in aggregate, non-identifying form);
• Collect and review user feedback and feature requests to prioritize product improvements.

4. Legal Basis for Processing

Under the General Data Protection Regulation (GDPR), we process your data on the following bases:

• Contract: Processing necessary to provide you with the Service you signed up for (account management, payments, credit system);
• Legitimate interest: Security logging and fraud prevention, service improvement through usage analytics, and abuse prevention for feedback submissions (IP address and user agent logging);
• Consent: Non-essential cookies (where applicable — see our Cookie Policy).

5. Who We Share Data With

We do not sell your personal data. We share data only with the following categories of service providers, who process it on our behalf:

• Stripe — payment processing (transaction data, billing details);
• Google and OpenAI — AI analytics chatbot processing (query text and database schema context only; no personal data);
• Analytics providers — aggregated usage data (when analytics tools are enabled).

We may also disclose data where required by law, regulation, or court order.

6. Cookies

We use essential cookies to operate the Service. For full details on the cookies we use and how to manage them, please see our Cookie Policy.

7. Data Retention

We retain your personal data for up to five (5) years from the date of your last account activity. This includes account data, authentication event logs, payment records, chatbot query logs, and feedback submissions.

For feedback submissions, IP addresses and user agent data used for rate limiting are retained alongside the feedback message for the same period. This data is used solely for abuse prevention and is not shared with third parties.

If you request account deletion, we will anonymize or delete your personal data within 30 days, except where retention is required for legal or regulatory purposes (e.g., financial record-keeping obligations).

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you;
• Rectification — ask us to correct inaccurate or incomplete data;
• Erasure — request deletion of your personal data (“right to be forgotten”);
• Restriction — ask us to limit processing of your data in certain circumstances;
• Data portability — receive your data in a structured, machine-readable format;
• Objection — object to processing based on legitimate interest;
• Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, contact us at support@izluks.lv. We will respond within 30 days.

You also have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv), the supervisory authority for data protection in Latvia.

9. Children

The Service is not intended for individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

10. International Data Transfers

Some of our service providers (Google, OpenAI, Stripe) may process data outside the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or the provider’s participation in recognized data protection frameworks.

11. Security Measures

We implement technical and organizational measures to protect your data, including:

• Password hashing with Argon2id (industry-leading algorithm);
• HTTPS encryption for all data in transit;
• HttpOnly, Secure session cookies;
• Rate limiting and brute-force protection on authentication endpoints;
• Read-only database access for AI chatbot queries.

While we take reasonable precautions, no system is completely secure. We encourage you to use a strong, unique password for your account.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Service. The “Last updated” date at the top of this page indicates when the policy was last revised.

13. Contact

For any privacy-related questions or to exercise your data rights, contact us at support@izluks.lv.