Legal
Privacy Policy
Draft for legal review — not yet in force. Prepared 2026-09-02. All source checks carried out 2026-09-02. This draft was not prepared by a lawyer and must be reviewed by a qualified data protection lawyer before publication. Every PLACEHOLDER must be filled in.
Last updated: 2026-09-22 Effective from: 2026-09-22 Version: 1.0
1. Who we are and how to contact us
Bit State, MB ("we", "us", "our") is a company registered in the Republic of Lithuania under registration number 307056143, with its registered address at Šeduvos g. 29-14, Padubysio k., LT-83250 Pakruojo r..
We are the data controller for the personal data described in this policy. This means we decide why and how your personal data is processed.
Contact for all privacy matters: privacy@assaygrade.com
We have not appointed a Data Protection Officer, because we are not required to do so under Article 37 of the General Data Protection Regulation (Regulation (EU) 2016/679, the "GDPR"). All privacy questions go to the address above and are handled by us directly.
This policy applies to [https://assaygrade.com](https://assaygrade.com), the web reader, the downloadable PDF, our emails, and our private Discord community — together, the "Service".
2. Summary
We sell a one-off, lifetime-access digital information product about nutrition and general wellbeing. We charge once and you keep access.
We do not collect health data. We do not ask about your symptoms, diagnoses, medications or wellbeing, and we do not keep a wellbeing diary for you.
We do not sell your personal data, and we do not share it with advertising networks.
We do not use your data to build advertising audiences or to profile you.
Payment is handled by Lemon Squeezy, which is the merchant of record. We never see your full card number.
You can ask us to delete your data at any time.
This summary is for convenience only. The sections below are what governs.
3. The personal data we process, why, and on what legal basis
| Data | What it is | Why we process it | Legal basis (GDPR Art. 6) | How long we keep it |
|---|---|---|---|---|
| Account identity | Your email address, your name (if you give it), a hashed password or authentication token | To create your account, let you sign in, and give you the access you paid for | Art. 6(1)(b) — performance of our contract with you | While your account exists. Deleted within 30 days of your deletion request |
| Purchase record | Lemon Squeezy order ID, product purchased, date, amount, country | To confirm your entitlement to lifetime access, to handle refunds and support | Art. 6(1)(b) — contract; and Art. 6(1)(c) — our legal accounting obligations | Identifiable purchase data is deleted or pseudonymised on request. A pseudonymised financial record (transaction ID, amount, date, country — with no name or email) is retained for the period required by Lithuanian accounting law |
| Reading progress | Which chapter you are on, percentage read, bookmarks, last-read timestamp | So the reader resumes where you left off and syncs between your devices — this is a feature of the product you bought | Art. 6(1)(b) — contract | While your account exists; deleted with your account |
| Support correspondence | Your email address and the content of your messages to us | To answer your question and to keep a record if there is a dispute | Art. 6(1)(b) where it concerns your purchase; Art. 6(1)(f) — our legitimate interest in answering pre-sale enquiries and defending claims | 24 months from your last message, or until any dispute is finally resolved |
| Discord link | Your Discord user ID and username, and the link between it and your purchase | To grant you access to the private community that forms part of the product, and to moderate it | Art. 6(1)(b) — contract; Art. 6(1)(f) — our legitimate interest in moderating the community | While your account exists |
| Server and security logs | IP address, browser user agent, timestamp, requested page, error information | Security, fraud prevention, detecting shared accounts, investigating incidents | Art. 6(1)(f) — our legitimate interest in keeping the Service secure and in preventing unauthorised sharing of paid content | 30–90 days, then deleted or anonymised |
| Website analytics (Plausible) | Page visited, referring source, country, device type, and a hash that is discarded daily | To understand how many people visit and which pages work | Art. 6(1)(f) — our legitimate interest in measuring traffic in a privacy-preserving way. Plausible does not use cookies and does not store anything on your device | Aggregated only. No individual visitor records are kept |
| Checkout analytics (PostHog), only if you consent | A pseudonymous identifier, session and device identifier, events on the checkout path, and — if you consent separately — a session recording | To find and fix problems in the checkout flow | Art. 6(1)(a) — your consent | Events: [6 or 12] months. Session recordings: 30 days |
| Marketing emails, only if you consent | Your email address, plus a record of your consent (date, time, and the wording you agreed to) | To send you occasional emails about our products | Art. 6(1)(a) — your consent | Until you unsubscribe. We keep the record of consent for 3 further years as proof |
| Testimonials, only if you consent | Your name, your words, and a photo if you provide one | To show what customers think, on our website | Art. 6(1)(a) — your consent | Until you withdraw consent |
Legitimate interests
Where we rely on legitimate interests (Art. 6(1)(f)), we have assessed our interest against your rights and freedoms. In summary, our interests are: keeping the Service secure and available, preventing paid content being shared without payment, understanding aggregate traffic, moderating the community, and establishing or defending legal claims. You can ask us for more detail about this assessment, and you can object at any time — see section 8.
We do not process special category data
We do not ask for, and do not knowingly collect, data concerning your health, your racial or ethnic origin, your political opinions, your religious or philosophical beliefs, trade union membership, genetic or biometric data, or data concerning your sex life or sexual orientation (Article 9 GDPR).
Please do not send us health information in support messages. If you do, we will use it only to answer your message and will delete it as soon as the matter is closed.
We do not make automated decisions about you
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR).
What happens if you do not give us your data
The email address and the payment information are necessary to enter into and perform our contract with you. Without them we cannot give you access to the product. Everything else — analytics, marketing, testimonials — is optional, and refusing has no effect on your purchase or your access.
4. Who receives your data
We use the following service providers. Most act as processors on our instructions under Article 28 GDPR. Two — Lemon Squeezy and Discord — act as independent controllers, which means they decide for themselves how they use your data and you should read their own privacy policies.
| Provider | Role | What they receive | Where | Their privacy information |
|---|---|---|---|---|
| Lemon Squeezy (Sold through Link, LLC, f/k/a Lemon Squeezy LLC — 222 South Main Street, Suite 500, Salt Lake City, UT 84101, USA) | Independent controller. Lemon Squeezy is the merchant of record — it is the seller you contract with for the payment, and it issues your receipt | Your name, address, email, payment details, purchase history. Lemon Squeezy then shares your name, email and purchase history with us | United States | https://www.lemonsqueezy.com/privacy |
| Discord (Discord Netherlands BV for EEA users) | Independent controller. We do not control Discord and there is no data processing agreement between us for your Discord account | Your Discord account and everything you post in the community | Netherlands, United States | https://discord.com/privacy |
| Supabase | Processor — our database, authentication and file storage | Account identity, purchase record, reading progress, product files | Our project is hosted in the European Union (eu-west-1 (Ireland)) | https://supabase.com/privacy |
| Vercel | Processor — hosting and delivery of the website and web reader | Server logs, IP address, request data | United States | https://vercel.com/legal/privacy-policy |
| Cloudflare | Processor — DNS, security, and file delivery (R2) | DNS and connection metadata, IP address, delivered files | Global network | https://www.cloudflare.com/privacypolicy/ |
| Resend | Processor — transactional email (receipts, access links, password resets) | Your email address, your name, the content of the email, delivery logs | United States | https://resend.com/legal/privacy-policy |
| Plausible Analytics (Plausible Insights OÜ, Estonia) | Processor — website analytics | Page, referrer, country, device type. No cookies, no persistent identifier, no data leaves the EU | European Union | https://plausible.io/privacy |
| PostHog (PostHog, Inc., United States) — only with your consent | Processor — checkout analytics and session replay | Pseudonymous identifier, checkout events, and session recording if you consent | PostHog Cloud EU — Frankfurt, Germany | https://posthog.com/privacy |
We may also disclose personal data to our accountant, our lawyers, or to a public authority where we are legally required to do so, and to a buyer or successor if we ever sell or reorganise the business — in which case we will tell you first.
We do not sell your personal data. We do not share it with advertising networks or data brokers, and we do not use advertising or conversion tracking pixels.
5. International transfers
Some of the providers above are established outside the European Economic Area, principally in the United States. Where your personal data is transferred outside the EEA, we rely on the following safeguards under Chapter V GDPR:
Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, together with the UK International Data Transfer Addendum where UK data is involved. These are in place with Lemon Squeezy, Supabase, Vercel, Cloudflare, Resend and PostHog.
Some of these providers are additionally certified under the EU–U.S. Data Privacy Framework. We treat that certification as an additional safeguard only, and not as our sole transfer mechanism, so that our transfers remain lawful independently of it.
We have chosen EU hosting wherever it is available: our database and file storage are in the European Union, our website analytics provider is in the European Union, and our checkout analytics use PostHog's EU cloud in Frankfurt.
You can request a copy of the relevant safeguards by emailing privacy@assaygrade.com.
6. Cookies and similar technologies
Under Article 5(3) of the ePrivacy Directive (2002/58/EC), as implemented in Lithuania by the Law on Electronic Communications, we need your consent before storing information on your device or accessing information stored on it — unless it is strictly necessary to provide the service you asked for.
We use the following.
Strictly necessary — no consent needed
| What | Purpose | Duration |
|---|---|---|
| Authentication session cookie | Keeps you signed in | Session / 400 days |
| Security token (CSRF) | Prevents cross-site request forgery | Session |
| Cookie preference record | Remembers your cookie choice so we do not ask again | 12 months |
| Reading position in local storage | Lets the reader resume where you left off, offline | Until you clear it |
Analytics — Plausible
Plausible does not set cookies, does not use local storage, and does not create a persistent identifier. It counts unique visitors using a hash that includes a salt which is rotated and deleted every 24 hours, so visitors cannot be tracked from one day to the next. Raw IP addresses and user agents are not stored. Because nothing is stored on or read from your device for tracking purposes, we do not ask for consent for Plausible. We rely on our legitimate interest in measuring traffic, and you may object under section 8.
Checkout analytics — PostHog — consent required
If you consent, PostHog sets a cookie (ph_<project key>_posthog, valid for 365 days) and stores information in your browser's local storage, including a device identifier and feature flag settings. Separately, and only if you consent to it specifically, PostHog records your session on the checkout pages. We mask all form inputs and block the payment form from recording, so we never see what you type into payment fields.
PostHog runs only on the checkout path, not across the whole site.
Managing your choices
Our consent banner presents "Accept" and "Reject" as equally prominent and equally easy choices, with nothing pre-ticked. You can change or withdraw your choice at any time via the Cookie settings link in the footer of every page — withdrawing is as easy as consenting. Withdrawal does not affect anything done before you withdrew.
Checkout is hosted by Lemon Squeezy on its own domain, and Lemon Squeezy sets its own cookies there as an independent controller. Please see Lemon Squeezy's privacy policy for those.
⚠️ LAWYER: the controller/processor characterisation above is carried over from the previous provider and has NOT been verified against the Lemon Squeezy DPA (https://www.lemonsqueezy.com/dpa). Two questions remain open: whether Lemon Squeezy acts as an independent controller or as an Art. 28 processor, and which Chapter V transfer mechanism it relies on (SCCs, EU-US Data Privacy Framework, or both). Resolve both before publication — see research/03-teise.md section 8.3a.
7. How we protect your data
We use encryption in transit (HTTPS/TLS) and at rest, row-level access controls on our database so that one customer cannot read another's data, hashed passwords, multi-factor authentication on our administrative accounts, and a policy of collecting the minimum data needed. Access to production data is limited to 1 person(s).
No system is perfectly secure. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, and we will notify the State Data Protection Inspectorate within 72 hours where required by Articles 33 and 34 GDPR.
8. Your rights
Under the GDPR you have the right to:
Access — get a copy of the personal data we hold about you (Art. 15).
Rectification — have inaccurate data corrected (Art. 16).
Erasure — have your data deleted (Art. 17). We will do this, except where we are required by accounting law to keep a financial record; in that case we remove your name and email and keep only a pseudonymised record.
Restriction — ask us to pause processing while a dispute is resolved (Art. 18).
Portability — receive the data you gave us in a machine-readable format, or have it sent to another provider where technically feasible (Art. 20).
Object — object at any time to processing based on our legitimate interests (Art. 21), including our security logging and our analytics. You have an absolute right to object to direct marketing.
Withdraw consent — at any time, where we rely on consent (Art. 7(3)). This does not affect the lawfulness of what we did before you withdrew.
Deleting your account also deletes your access to the product. Because access is lifetime and tied to your account, we cannot restore it afterwards. We will make this clear before we act on a deletion request.
How to exercise your rights: email privacy@assaygrade.com. We will respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you within the first month if we do. There is no charge, unless a request is manifestly unfounded or excessive.
We may ask you to confirm your identity — normally by replying from the email address on your account — before we act on a request.
Complaints
If you are unhappy with how we have handled your data, please tell us first at privacy@assaygrade.com. You also have the right to lodge a complaint with the Lithuanian supervisory authority, or with the supervisory authority of the EU country where you live or work:
Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate of the Republic of Lithuania) L. Sapiegos g. 17, LT-10312 Vilnius, Lithuania Institution code: 188607912 Email: ada@ada.lt Telephone: +370 5 271 2804, +370 5 279 1445 Consultations: +370 5 212 7532 Website: https://vdai.lrv.lt
(VDAI contact details verified 2026-09-02 at https://vdai.lrv.lt/lt/struktura-ir-kontaktai/kontaktai-1/)
You may also bring proceedings before a court.
9. Children
The Service is intended for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. In Lithuania, the age at which a child can consent to information society services in their own right is 14 under the Lithuanian Law on Legal Protection of Personal Data — but our terms require purchasers to be at least 18 in any event, because a purchase is a contract.
If you believe a child has given us personal data, please contact privacy@assaygrade.com and we will delete it.
Our product concerns nutrition and general wellbeing and is not a substitute for medical advice. It is not intended for children.
10. Retention — summary
We keep personal data only for as long as we need it for the purposes set out in section
In summary:
Account and reading data: while your account exists.
Financial records: for the period required by Lithuanian accounting law, in pseudonymised form once you ask us to delete your account.
Support correspondence: 24 months.
Server logs: 30–90 days.
PostHog session recordings: 30 days.
Consent records: for the life of the consent plus 3 years.
Inactive accounts. Because access is lifetime, we do not delete accounts for inactivity alone. If you have not signed in for 3 years we will email you. If you have not signed in for 5 years and do not respond, we may close and delete the account. We will always email you before doing so.
11. Changes to this policy
We may update this policy. When we do, we will change the "Last updated" date at the top and keep the previous version available on request. If a change materially affects how we use your data — for example, a new purpose or a new category of recipient — we will email registered customers at least [14 or 30] days before it takes effect, and where the change requires your consent we will ask for it.
Continuing to use the Service after a change takes effect means the updated policy applies to you, except where your consent is required.
12. Notes for the reviewing lawyer — DELETE BEFORE PUBLICATION
Confirm the Lithuanian accounting retention period and the exact legal instrument. This draft deliberately does not cite an article number, because it was not verified. Do not publish a number that has not been checked.
Confirm the Law on Electronic Communications article governing storage on terminal equipment. The current consolidated numbering appears to be Article 99; many secondary sources still cite the pre-2022 Article 61(4).
Confirm the digital-content withdrawal right interaction (Directive 2011/83/EU Art. 16(m) and the Lithuanian Civil Code) — this belongs in the Terms, not here, but the two documents must be consistent about refunds.
UK representative (UK GDPR Art. 27) — decide whether to appoint one or to accept the risk, and record the decision.
Confirm PostHog retention figures once configured, and fill in
[6 or 12] months.Decide whether Plausible goes behind the consent banner. This draft treats it as not requiring consent, which is defensible but not risk-free.
Check consistency with the Terms of Service, the Cookie Policy (if kept separate), and the Refund Policy.
This draft was prepared by a non-lawyer on 2026-09-02 as a starting point only.