Privacy policy

How Hafory uses account information and the data you provide.

Updated: 2026-09-20

Service provider and data controller

MB „Mantita“

Company code: 306201059 · VAT: LT100015559814

Audruvės g. 1, LT-84155 Joniškis, Lithuania

1. Data we process

We process your account identifier, name and email, inventory, locations, warranties and reminders, uploaded documents and photos. Technical request and sign-in data, such as IP addresses and timestamps, are processed to operate and protect the service.

2. Sign in with Google

We request openid, email and profile permissions for your account identifier, email and basic profile information. We use this information to authenticate you and link your Hafory account. We do not receive your Google password. Signing in does not grant access to Gmail messages, Google Drive files or contacts.

3. Sign in with Facebook

When you choose Facebook, we request public_profile and email permissions. We receive an app-scoped account identifier, basic profile information and email if provided, for sign-in and account linking, not advertising. We do not receive your Facebook password or request posts, friend lists or photo albums. Meta handles sign-in under its privacy policy and operates globally, including outside the EEA. Linking an existing Hafory account may require additional proof of account ownership.

4. Sign in with Apple

When you choose Apple, we request the name and email permissions for the app-specific account identifier, the first and last name supplied on first authorization, and your real or Apple private relay email address. We use them only to display your profile, sign you in and link your account. We do not receive your Apple password and we have no access to iCloud content. Apple handles sign-in under its own privacy policy. Linking an existing Hafory account requires proof of account ownership; if you use a private relay address it may differ from the address on your account, so we do not promise an automatic merge.

5. Purposes and legal bases

We process account and inventory data to provide the service you request (GDPR Article 6(1)(b)). Technical security processing serves our legitimate interest in protecting accounts and operating the service (Article 6(1)(f)). Specific legal obligations may require processing under Article 6(1)(c). Any optional consent-based processing must be explained separately, and consent can be withdrawn.

6. Document recognition and AI

When you request recognition, your text, document or image is sent to Microsoft Azure document recognition and AI services. You review and confirm the resulting proposal before saving an item. This is not solely automated decision-making with legal or similarly significant effects. Do not upload unnecessary third-party or special-category personal data.

7. Recipients

We use server hosting, Microsoft Azure AI and account-email delivery providers. Google handles sign-in under its own privacy policy. Authorized service administrators or legally entitled authorities may also receive data. We do not use Google sign-in data to build advertising profiles.

8. Retention

Confirmed inventory and linked documents are retained while you use your account or until you delete them. Recognition proposals are scheduled for removal 30 days after confirmation, dismissal or expiry. Unlinked originals are scheduled for cleanup 7 days after processing or review ends, with an additional safety delay of at least 6 hours; failed cleanup is retried. Backup copies can remain until replaced or removed under the backup schedule. When handling deletion requests, we explain applicable periods and any legally required retention.

9. Processing locations

Azure AI services are configured in European regions, and account-email delivery uses a European data location. Google operates globally and may process sign-in data outside the European Economic Area under its privacy policy. You may request information about specific service processors, transfers and applicable safeguards at support@hafory.lt.

10. Your rights

You may request access, correction, deletion, restriction and, where applicable, a portable copy of your data, or object to processing based on legitimate interests. Use the address on our contact page. We normally respond within one month and explain any lawful extension. You may complain to Lithuania’s State Data Protection Inspectorate at vdai.lrv.lt.

11. Cookies and browser storage

Authentication uses session and security cookies. Browser session storage helps resume document processing and avoid duplicate operations. The current website code does not include advertising or visitor-analytics trackers. Blocking necessary cookies may prevent sign-in.

Google privacy policy · Meta privacy policy · State Data Protection Inspectorate