PRIVACY
Privacy policy
Effective from 13 October 2026.
Who processes data
panembrivdienu.lv and its API are run by SIA Valksor (registration number 40203690663), Mores iela 36-1, Riga, LV-1034, Latvia. Send questions and requests about your data through the contact form.
What the site does not do
The site has no advertising, analytics or tracking tools, and does not set cookies itself. Data is not sold, shared for advertising or used for profiling.
Data you enter in calculations
The details you enter in the planner and the leave estimate (such as your employment start date, birth date and workload) are sent to the server only to calculate the result. The server does not store them or write them to its logs.
Contact form
The email address and message you enter in the contact form are delivered to our inbox on our own server and kept there for at most 90 days; the inbox also deletes its oldest messages by itself when it is full. On the way to the inbox, the message is kept by our own mail service for at most 90 days, and its encrypted backups can hold it up to 30 days longer. Everything runs on our own infrastructure; no third-party email provider is involved at this stage. The legal basis is our legitimate interest in answering your question (GDPR Article 6(1)(f)).
Technical logs
For each request the server writes a technical log entry: the time,
the request method and URL path (without parameters or entered data),
the response status and duration, a request identifier, the IP
address, and the browser or program name and version from the
User-Agent header (without device or operating system
details). For MCP requests it also records the method, the tool name
and the client program's name and version, but not the arguments
passed to the tool. Logs are used only to keep the service running, fix errors
and limit abuse. Each container's log is capped at about 30 MB and is
normally cleared at the nightly restart of the service, so logs are
usually kept for no more than a day. The legal
basis is legitimate interests (GDPR Article 6(1)(f)).
Rate limiting
To prevent overload, the server briefly keeps the IP address (or an API key identifier) and a request counter in memory. Entries whose limit has fully reset are removed by a sweep that runs every minute: within about a minute after the last API request, or about 15 minutes after the last contact form message. They are never written to disk and are lost when the server restarts.
Choices saved in your browser
Your choice of light or dark theme, the site language and any extra
days off you add are saved in your browser's local storage
(localStorage, keys panembrivdienu-theme,
panembrivdienu-lang and
panembrivdienu-days-off). The theme and language are not
sent to the server. The extra days off are sent only with a planner
request, and the server does not store them. You can remove all of it
by clearing this site's data in your browser.
Recipients
Two service providers receive data on our behalf: our hosting provider, which runs the servers (located in Germany, see below), and Cloudflare. Both act as processors.
Cloudflare
The site runs through Cloudflare's network (its CDN and a secure tunnel to our servers), which provides secure connections and protection against attacks. As a processor, Cloudflare handles connection data (such as the IP address) and may set technical security cookies. Cloudflare's parent company is based in the United States, so data may be transferred there; such transfers rely on safeguards such as the European Commission's standard contractual clauses or the EU–US Data Privacy Framework. See the Cloudflare privacy policy ↗.
When you start filling in the contact form, a Cloudflare Turnstile bot check loads. To tell people from bots, Cloudflare processes your IP address and browser signals, such as the User-Agent header and the TLS fingerprint. Cloudflare runs the check on our behalf, and acts as its own controller to improve its bot detection; see the Turnstile privacy addendum ↗. The lawful basis is our legitimate interest in preventing abuse of the contact form (GDPR Article 6(1)(f)).
Where the servers are
The servers are located in Germany, in the European Union.
API keys
API keys can be requested through the contact form. The server stores only a hash (SHA-256) of the key, never the key itself.
Your rights
Under the General Data Protection Regulation (GDPR) you have the right to access, correct and delete your data, to restrict its processing and to object to it. Because the site has no user accounts, include the approximate time of your visit and your IP address in a request. You also have the right to lodge a complaint with the Data State Inspectorate ↗.
Changes
Changes to this policy will be published on this page with a new effective date.