Skip to content

Privacy policy

Draft – to be reviewed by a lawyer before final publication. This is a translation; if it differs from the Lithuanian text, the Lithuanian text applies.

This policy explains how MB „Stiega Bros“ ("we"), the provider of Prekio, operating from Lithuania (EU), collects, processes, stores and uses personal data under the EU General Data Protection Regulation (GDPR).

1. What data we collect

  • Sign-up details: company name, contact e-mail address, password hash.
  • Payment details: processed directly by Stripe – we do not store card details.
  • Usage data: sign-in times and IP address, for security and fraud prevention.
  • Where you came from to sign up: the page on our site where you clicked to sign up, and the website or ad campaign that brought you there. We record this with your account, without cookies, so we know which pages help customers find us.
  • Site statistics, only if you agree: which pages of our site you opened, where you came from, your browser type and approximate location (country, city). See section 10.
  • Your system's data (products, orders, buyer details): this is kept in a separate, isolated database for each customer, and we use it for no purpose other than providing the Service to you.

2. Legal basis for processing

We process data to perform our contract with you (providing the Service), on the basis of legitimate interest (security, fraud prevention) and, where applicable, with your consent.

3. Subprocessors

We use the following providers, which may process personal data on our behalf:

  • Stripe – payment processing.
  • Resend – transactional e-mail (sign-up, invoices, notifications).
  • Cloudflare – DNS and content delivery.
  • Microsoft Azure – storage for encrypted backups.
  • Google (Gemini) – AI assistant answers and translations, if you enter a Google API key in your Prekio settings. Without a key, no data goes there.
  • Google (Analytics) – statistics about visits to our website, only if you accept statistics cookies.
  • The infrastructure provider where the servers run (EU).

4. Connecting eBay and Shopify

When you connect an eBay or Shopify store to your Prekio system, the sign-in goes through prekio.com, because these platforms only return to one address registered in advance. The access tokens received are kept encrypted only until your Prekio system collects them (no longer than 10 minutes), and are then deleted. We keep only which eBay or Shopify account belongs to which Prekio system.

eBay notifies us when one of its users asks for their data to be deleted. We keep these notices for 30 days only as irreversible hashes, so that your Prekio system can delete that buyer's data. We pass Shopify data requests to our team, which carries them out in your Prekio system.

5. Where data is stored

Your account and your system's data are stored in the European Union. Google processes our website statistics and may transfer them to the US under the EU-U.S. Data Privacy Framework.

6. Your rights (GDPR)

You have the right to:

  • receive a copy of your data (data portability);
  • have inaccurate data corrected;
  • have your data deleted (the "right to be forgotten"), subject to legal retention obligations (for example, accounting records);
  • object to processing in certain cases;
  • lodge a complaint with a supervisory authority.

To exercise these rights, e-mail info@prekio.com.

7. How long data is kept

An active account's data is kept for as long as the account is active. When the contract ends, the data is kept for a limited period (so you can download a backup) and then removed for good, except where the law requires longer retention (for example, accounting records).

8. Security

Each customer has an isolated database and containers. Passwords are stored only as hashes, from which a password cannot be recovered. Infrastructure access keys and secrets are stored encrypted. An encrypted backup is made every night – more on the security page.

9. Contact

Data controller: MB „Stiega Bros“, Lithuania.
Data protection questions: info@prekio.com.

10. Cookies

The site uses these necessary cookies. Without them it does not work the way you chose:

  • session – signing in and form protection. It lasts until you close the browser.
  • prekio-lang – the language you chose on the site. Kept for 1 year.
  • prekio-consent – your answer about statistics cookies. Kept for 180 days.

Statistics cookies (_ga, _ga_*) are set by Google Analytics only if you click “Accept” in the bar at the bottom of the page. Until then our site sends nothing to Google. These cookies show us which pages help customers find us and where they stop while signing up. They are kept for up to 2 years.

  • We do not use this data for advertising or ad personalization. Google signals are off.
  • Google Analytics does not store IP addresses. Google receives page addresses without query parameters, except ad campaign tags (utm).
  • Google Analytics keeps the statistics for no longer than 14 months.
  • Statistics are collected only on the public website. The customer portal and your Prekio system have none.
  • The legal basis is your consent. You can withdraw it at any time: click “Cookie settings” at the bottom of the site, then “Decline”. We then delete the Google cookies.

This policy is published in Lithuanian and English. If they differ, the Lithuanian text applies.