Privacy Policy

Who is responsible for your data

The data controller is SIA “mySilva”, registration no. 40203759548, registered address: [TODO: registered address], email: info@mysilva.lv.

The website mysilva.lv describes the service. The application app.mysilva.lv is the platform itself.

[TODO: decide whether mySilva acts as a processor for employee and partner data that companies enter in their workspace, and whether a data processing agreement is offered to companies.]

What data we process

Depending on how you use the website and the platform, we may process:

• Access request data: name, email address, company name (for companies), phone number (only if you give it), chosen language and the page the request was sent from.
• Account data: name, email address, password (stored only as a hash), language preference and your role in a company workspace. If you sign in with Google, we also receive your Google account identifier and whether your email address is verified.
• Forest owner data: cadastral numbers of the properties you add and the related forest data (stands, species, volume, age), indicative timber value, alerts and your settings.
• Company workspace data: company details, members and their roles, projects, work orders, price lists, daily volumes and trips entered by operators and drivers, photos of waybills, settlements, documents and FSC/EUDR evidence. This may include names, contact details and vehicle details of employees, drivers and partners.
• Content you add as a forest owner: records of work done, photos, documents and GPS tracks, notes about stands and — if you choose to enter them — contact details of neighbouring landowners. Please enter only what you are entitled to and need.
• AI assistant data: the questions and texts you type or paste, the assistant’s answers, and the proposals it prepares (and whether you confirmed them).
• Technical data: IP address, browser and device type, request times, server logs and error reports.
• Analytics data: only if you consent — data about how the website and application are used (see the Cookie Policy).
• Correspondence: your messages and our replies.

Where the data comes from

Most data comes from you. To show forest information, we use the cadastral number you enter to look up public registers:

• open data of the State Forest Service (VMD) forest register;
• the State Land Service (VZD) real estate cadastre;
• orthophoto maps of the Latvian Geospatial Information Agency (LĢIA);
• open data of the Enterprise Register (data.gov.lv), used to verify company registration.

Why we process data and on what legal basis

We process personal data only for specific purposes and on an appropriate legal basis:

• Providing the platform, creating and managing accounts, showing forest data, the AI assistant, company workspace features and service emails — performance of a contract (Article 6(1)(b) GDPR).
• Answering access requests and verifying company registration — our legitimate interests (Article 6(1)(f) GDPR).
• Security, preventing misuse, error monitoring and improving the service — our legitimate interests (Article 6(1)(f) GDPR).
• Website and application analytics (Google Analytics 4) — your consent (Article 6(1)(a) GDPR).
• Accounting and tax requirements — legal obligation (Article 6(1)(c) GDPR).

AI assistant and document processing

When you use the AI assistant, your forest figures and the questions or texts you type or paste are sent to Google Gemini to generate an answer. In a company workspace, the assistant also sends the company records it needs to answer (for example work orders, landings, prices, invoices and machines). It can also prepare changes. A change is made only after a user confirms it, and confirmed actions are recorded in an audit log. Please do not include information the answer does not need.

Under Google’s paid API terms, prompts are not used to train Google’s models. [TODO: verify which Gemini API tier (paid or free) is used in production.]

Price lists uploaded by companies (Excel, PDF, scanned images) are processed with Google Document AI text recognition (OCR) and Gemini to extract prices in a structured form.

We do not make automated decisions, including profiling, that have legal effects on you or similarly significantly affect you.

Who receives the data

We do not sell personal data. There are no public profiles on the platform, and a forest owner’s data is not shared with other owners or buyers. Company workspace data is available only to members of that workspace, according to their roles.

These service providers (processors) handle data for us to provide the service:

• Hetzner Online GmbH — hosting in the EU (Germany and Finland);
• Google — Gemini AI, Document AI text recognition, Google Analytics 4 (only after consent) and optional Google sign-in [TODO: confirm Google sign-in is enabled in production];
• Mailgun — sending service emails (EU region);
• Sentry — error monitoring in production (EU region, Germany); error reports may include your user identifier, email address, IP address and technical request details;
• kartes.lv (SIA “Karšu izdevniecība Jāņa sēta”) — geocoding of mill and delivery point addresses entered by companies.

Transfers outside the EEA

Our servers are in the European Union. Google and other providers may also process data outside the European Economic Area. Where this happens, transfers rely on the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework. [TODO: verify the transfer mechanism for each processor.]

How long we keep data

We keep data only as long as needed for the purpose. Our retention policy:

• Account and platform data — while the account is active and for 30 days after it is deleted;
• Access requests — 12 months;
• Server logs and error reports — up to 90 days;
• Backups — up to 30 days;
• Analytics data — 14 months [TODO: confirm the Google Analytics 4 data retention setting];
• Invoices and accounting records — as required by Latvian law (5 years).

Deleting properties and your account

You can delete the properties you have added, or your whole account, at any time in Account settings. After an account is deleted, its data is permanently erased within the periods above. Copies may remain in backups for no longer than 30 days.

Security

We use appropriate technical and organisational measures. These include encrypted connections (HTTPS), hashed passwords, role-based access, backups and error monitoring. Please keep your password safe and tell us straight away if you suspect someone has accessed your account.

Your rights

Under Articles 15–22 GDPR you have the right to:

• access your personal data;
• have inaccurate data corrected;
• have your data erased;
• restrict processing;
• receive your data in a structured, machine-readable format and transfer it to another controller (data portability);
• object to processing based on legitimate interests;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

How to exercise your rights or complain

To exercise your rights, email info@mysilva.lv. We will reply within one month. To protect your data, we may ask you to confirm your identity.

If you believe we are processing your data unlawfully, you can complain to the Data State Inspectorate of Latvia (Datu valsts inspekcija, www.dvi.gov.lv).

Children

The service is not intended for anyone under 16, and we do not knowingly collect their data.

Changes to this policy

We may update this policy. The current version is always available on this page with its update date. We will tell platform users about significant changes by email or in the application. For cookies, see the Cookie Policy; for use of the service, see the Terms of Use.