LegalLast updated 21 September 2026

Privacy policy.

What we collect, why we hold it, who else touches it, and how to make us delete it. Written to be read, because a policy nobody understands protects nobody.

Budrus is a company registered in Lithuania. For anything on this page, write to hello@budrus.co and a person will answer, in English or Lithuanian.

1. Who we are

Budrus is a search and AI visibility service for companies. When you ask us for a report, buy a plan or write to us, we decide what happens to the information you give us. That makes us the controller for it, and this page explains what we do with it.

When we work on data inside your own website or your own Google accounts, the roles are the other way round: you are the controller and we act on your instructions. That relationship is covered by our data processing terms.

2. What we collect

Very little, and only what the work needs.

When you ask for a free report: your website address and a work email. No card, no account, no name required.
When you write to us or book a call: your name if you give it, your email address, and whatever you put in the message.
When you become a customer: the contact details of the people we work with, billing details, and the invoices themselves. Card numbers never reach us. The payment provider handles those.
If you connect Google Search Console or Google Analytics on a higher plan: read-only access to that account's search and traffic figures. This is optional, it is never needed for a first report, and you can disconnect it whenever you like.

We do not buy lists of personal data, we do not add to what you gave us from other sources, and we do not build profiles of the people who visit your website.

3. Why we are allowed to hold it

The law requires a reason for each piece of data. Ours are these.

To do what you asked. Producing the free report and running your plan is performance of a contract with you.
To run the business properly. Keeping a record of what we sent to whom, protecting the service from misuse and improving how the work is done is our legitimate interest, weighed against your rights.
To follow the law. Invoices and accounting records have to be kept for a set period.
Your consent, for connecting a Google account and for anything we send that you are not required to receive. You can withdraw it at any time, and doing so does not undo what was lawful before.

4. Who else sees it

We keep the list of companies we depend on short, and every one of them is under a written contract that limits what it may do with the data. By category:

The platform that hosts this website and stores what the forms collect.
The provider that delivers our email.
The provider of the market and search data behind our reports. It receives website addresses and search terms, not the personal details of your staff.
Our payment and invoicing providers.
Google, where you have connected your own Search Console or Analytics account, read-only and only to read your own figures.

If you want the current list by name, ask and we will send it. We do not sell data and we do not share it for advertising.

5. Where it is kept

Inside the European Economic Area wherever the provider allows it. Where a provider processes data outside the EEA, that transfer rests on an adequacy decision or on the European Commission's standard contractual clauses, and we will tell you which one if you ask.

6. How long we keep it

A free report request that never becomes a customer: up to 24 months, then deleted.
Emails and messages: up to 24 months after the last exchange.
Customer records and reports: while you are a customer, and 12 months after you leave so we can still answer questions about past work.
Invoices and accounting records: for as long as Lithuanian accounting law requires.

Ask us to delete something sooner and we will, unless the law says we have to keep it.

7. Your rights

You can ask us to show you what we hold, correct it, delete it, limit what we do with it, hand it over in a portable file, or stop processing where we rely on legitimate interest. Write to hello@budrus.co. We answer within 30 days and we do not charge for it.

If you think we have handled your data badly, tell us first and we will try to put it right. You can also complain to the State Data Protection Inspectorate in Lithuania, or to the supervisory authority in the country where you live.

8. Cookies and this website

This site runs no advertising and no tracking cookies, and it does not profile visitors. The platform that hosts it sets a small number of cookies that are needed to serve the pages and to make the forms work. If we ever add analytics, this page will say so before it goes live, and you will be asked first wherever the law requires it.

9. Changes to this policy

When we change this page we change the date at the top of it. If a change actually affects you, a new category of data or a new purpose, we email customers rather than quietly editing the page.

Anything unclear, anything you want removed, or anything you think we have got wrong: hello@budrus.co. A person reads it, not an agent.