Privacy Policy

Last updated: 4 November 2026

This Privacy Policy explains how we collect, use, store, and protect personal data when you visit the Ukeepi early-access website or subscribe to our early-access mailing list.

This policy applies to the early-access website and mailing list. It does not cover the future Ukeepi application, which may have additional data processing activities.

1. Who we are

Ukeepi is operated by:

Validit, MB
Anglų g. 16-2
Vilnius, Lithuania

Privacy contact: [email protected]

Validit, MB is the data controller responsible for the processing described in this policy.

For questions about your personal data or this policy, please contact us using the email address above.

2. Early-access mailing list

When you join our early-access list, we collect:

• Your email address.
• Information documenting your consent, such as the signup date, signup source, and consent wording presented to you.
• Subscription status and unsubscribe information.

We use this information to:

• Send you a welcome email.
• Contact you about Ukeepi’s early access, availability, and launch.
• Manage your subscription and unsubscribe requests.
• Maintain records demonstrating compliance with applicable privacy requirements.

Legal basis: Your consent under Article 6(1)(a) of the General Data Protection Regulation (GDPR).

Providing your email address is voluntary. Without it, we cannot send you early-access communications, but you can still browse our website.

We use MailerLite to manage our subscriber list and deliver emails.

We use a single opt-in process. By submitting the signup form, you consent to receiving the communications described above.

You may withdraw your consent at any time by clicking the unsubscribe link in our emails or contacting [email protected].

Withdrawing consent does not affect the lawfulness of processing performed before withdrawal.

Joining the early-access list does not subscribe you to unrelated marketing communications.

3. Email delivery and engagement

Our email service provider, MailerLite, processes information necessary to manage subscriptions and deliver emails.

Depending on the features enabled, this may include email delivery status, unsubscribe activity, and email engagement information, such as opens and clicks.

We use subscription and delivery information to manage the mailing list and ensure that communications are delivered appropriately.

Optional engagement tracking will be used only where permitted by applicable privacy and electronic communications laws, including obtaining consent where required.

You can read MailerLite’s Privacy Policy for additional information about its data processing practices.

4. Cookies and website analytics

Our website may use technologies necessary for security, reliable operation, and essential website functionality.

We also plan to introduce optional website analytics to understand how visitors use Ukeepi and improve the website.

These analytics may include:

• Page visits and navigation.
• Interactions with website elements.
• Scroll depth and signup conversions.
• Session recordings used to identify usability problems.

Optional analytics and session recording technologies will not be activated until the required consent has been obtained.

When introduced, visitors will be able to accept or reject non-essential tracking through our consent interface. Consent can be withdrawn through the website’s privacy settings.

The legal basis for processing personal data through optional analytics is consent under Article 6(1)(a) GDPR. Where required, consent will also be obtained under applicable electronic communications and cookie rules.

We will update this policy to identify the analytics providers and explain their specific processing activities before enabling those services.

5. Website operation and security

When you visit our website, our hosting and security providers may process technical information, including:

• IP addresses.
• Request dates and times.
• Requested URLs.
• Browser and device information.
• Technical error and security event information.

We process this information to:

• Deliver the website.
• Maintain availability and performance.
• Diagnose technical problems.
• Prevent abuse and unauthorized access.
• Protect the security of our services.

Legal basis: Our legitimate interest under Article 6(1)(f) GDPR in operating a secure and reliable website.

Our hosting and security providers are:

• Cloudflare: Website security, traffic delivery, and protection against malicious activity.
• DigitalOcean: Website hosting and infrastructure services.

These providers may process technical information as necessary to deliver their services.

6. Who receives your data

We share personal data with service providers only where necessary for the purposes described in this policy.

Our service providers include:

• MailerLite: Subscriber management and email delivery.
• Cloudflare: Website delivery and security.
• DigitalOcean: Website hosting and infrastructure.

Where these providers act as our processors, they process personal data under applicable data processing agreements and our instructions.

We may also disclose personal data where required by law or where necessary to establish, exercise, or defend legal claims.

We do not sell your personal data.

7. International data transfers

Some of our service providers or their subprocessors may process personal data outside the European Economic Area (EEA).

Where personal data is transferred to countries outside the EEA, we rely on applicable legal transfer mechanisms, including:

• European Commission adequacy decisions, where applicable.
• European Commission Standard Contractual Clauses.
• Additional safeguards where required.

Information about our providers’ data processing arrangements is available through their respective documentation:

• MailerLite Data Processing Agreement
• Cloudflare Privacy Policy
• DigitalOcean Privacy Policy

You can contact us at [email protected] to request further information about applicable safeguards and how to obtain a copy.

8. How long we keep your data

We retain personal data only for as long as necessary for the purposes described in this policy, subject to applicable legal requirements.

Our intended retention periods are:

Early-access subscriber information

Until you unsubscribe or 12 months after Ukeepi’s public launch, whichever occurs first.

Unconfirmed or failed signup records

Up to 30 days, where such records are collected.

Website and security logs

Normally up to 30 days. Records associated with security incidents may be retained longer where necessary for investigation, compliance, or legal claims.

Unsubscribe and consent records

After you unsubscribe, we may retain a minimal suppression record to prevent further marketing communications.

We may also retain limited evidence of your previous consent for up to 3 years after withdrawal, where necessary to demonstrate compliance or defend legal claims, unless a longer period is legally required.

The legal basis for this limited processing is our legitimate interest under Article 6(1)(f) GDPR or compliance with a legal obligation under Article 6(1)(c), as applicable.

Backups

Personal data remaining in backups is deleted according to the applicable backup retention and rotation schedules. Until deletion, backup data is protected and is not used for ordinary processing.

9. Your rights

Under the GDPR, subject to applicable conditions, you have the right to:

• Access: Request a copy of your personal data.
• Rectification: Correct inaccurate or incomplete personal data.
• Erasure: Request deletion of your personal data.
• Restriction: Request restrictions on certain processing activities.
• Data portability: Receive applicable personal data in a structured, commonly used, machine-readable format.
• Objection: Object to processing based on legitimate interests.
• Withdrawal of consent: Withdraw your consent at any time.
• Direct marketing objection: Object to direct marketing at any time.

To exercise your rights, contact [email protected].

We may request proportionate information to verify your identity before responding.

We will respond within the time limits established by applicable data protection law, generally within one month.

You also have the right to lodge a complaint with a data protection supervisory authority, particularly in the EU country where you live, work, or believe an infringement occurred.

Our relevant supervisory authority is:

State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija)
L. Sapiegos g. 17
LT-10312 Vilnius, Lithuania

Website: https://vdai.lrv.lt/en/

10. Automated decision-making

We do not use your personal data to make solely automated decisions, including profiling, that produce legal or similarly significant effects on you.

11. Changes to this policy

We may update this Privacy Policy when our website, services, or data processing practices change.

The current version will always be available on our website, together with its last updated date.

Where changes require additional consent, we will request that consent before carrying out the relevant processing.

For questions about this Privacy Policy, contact [email protected].