Privacy Policy

This policy explains what personal data we handle when you use Forastro, why, and what you can do about it.

Who is responsible

Forastro is operated from Lithuania, and its operator is the controller of the data described below. For any privacy question or request — including asking who we are — write to info@forastro.eu, which is monitored.

What we collect

Account data — name, email address, hashed password, and the role you hold in your company account. If you sign in with Google we receive your name, email and Google account identifier from Google.
Company profile — company name, VAT number, address, size, sectors, target countries, budget range and certifications. Business information, though it may identify a sole trader.
Usage data — saved notices, subscription and notification settings, and which awarded leads your company has marked as contacted.
Waitlist — while sign-up is invitation-only, the email address you give us to be notified at launch, and when you gave it. Nothing else, and it is not used for anything else.
Email activity — whether a verification, digest or alert email was sent, and unsubscribes.
Technical data — IP address and request metadata in server logs, kept for security and abuse prevention. Tokens that travel in a link — invitation and email-verification links — are redacted before anything is written to the log.
Billing data — when paid plans launch, Stripe processes your payment details. We receive the subscription status and invoice records, never full card numbers.

Why, and on what legal basis

To provide the service — creating your account, matching notices to your profile, sending the alerts you configured. Basis: performance of a contract.
To secure the service — authentication, rate limiting, abuse investigation. Basis: legitimate interests.
To send service email — verification, password reset, invitations, and the digests you enabled. Basis: contract, and your settings. Every digest carries an unsubscribe link and one-click unsubscribe headers.
To comply with the law — accounting and tax records for payments. Basis: legal obligation.
To run the waitlist — telling you when sign-up opens. Basis: your consent, given when you submitted the form; ask us and we delete the address.

We do not sell personal data, and we do not use it to train machine-learning models.

Procurement notice data

The tender and award information in the Service comes from official public sources, principally Tenders Electronic Daily (TED). It may include names and contact details of buyer and contractor representatives that those authorities published. We process it to help businesses find contracting opportunities, on the basis of legitimate interests. If you are named in a published notice and want to discuss its appearance here, contact us — though we cannot change the official source.

Who else processes it

Hosting — our servers and database run on Hetzner Online GmbH, Nuremberg (Germany).
Amazon Web Services (SES) — delivers our email, EU region.
Zoho — hosts the mailbox that receives your support, billing and privacy email, EU datacentre.
Google — only if you choose Google sign-in.
Stripe — payment processing, once paid plans launch.

These are processors acting on our instructions, except Stripe and Google, which are also controllers for their own purposes. Where a provider processes data outside the EEA, it is covered by the European Commission's standard contractual clauses.

How long we keep it

Account and company data for as long as the account exists, and then up to 90 days in backups. Waitlist addresses until you are invited to sign up, or until you ask us to remove yours. Invoices and accounting records for as long as tax law requires. Server logs for a short rolling period. Ask us to delete your account and we will, subject to those retention duties.

Cookies

We use one strictly necessary cookie to keep you signed in: a refresh token, marked HttpOnly and scoped to the authentication endpoints. Your session token itself is held in memory only and is gone when you close the tab — we deliberately do not put it in local storage. There are no advertising or analytics cookies and no third-party trackers, so there is no consent banner.

Your rights

Under the GDPR you may request access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interests. Where processing rests on consent you may withdraw it at any time. Write to info@forastro.eu and we will respond within one month.

If you are unhappy with how we handled it, you can complain to the Lithuanian State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija) or to the supervisory authority where you live.

Changes

We will update this page when our processing changes, and note the date below. Material changes affecting you will be notified by email.