This policy explains what the website agromap.lt, the customer application in the browser and the mobile application (together, the Platform) store on your device and why. The Platform is operated by UAB "Servera", company code 304051358, Architektų g. 56-101, LT-04111 Vilnius, Lithuania, e-mail info@agromap.lt.
The policy applies from 20 September 2026.
1. What a cookie is and what browser storage is
A cookie is a small text record a website leaves in your browser, which the browser then sends back automatically with every request to that website. Browser storage (localStorage) is a similar record that the website's own application reads itself and that is not sent with requests. Both can serve the same purpose - remembering who you are and what you chose - so this policy describes both.
In short: the Platform itself sets no cookies at all unless you switch the marketing group on (see Section 2). Everything it needs is kept in browser storage, and the only cookies that can appear in your browser come from the two third-party tools described in Section 4.
2. Your consent and the three groups of cookies
Cookies fall into three groups, and on your first visit a consent bar asks which of them you allow.
| Group | Consent needed | State without your consent |
|---|---|---|
| Necessary | no | always on |
| Analytics | yes | off |
| Marketing | yes | off |
Necessary records are what makes the Platform work: signing in, the basket, the language and bot protection. They do not require consent under Article 96 of the Lithuanian Law on Electronic Communications, and cannot be switched off.
The analytics and marketing groups stay off until you switch them on yourself. Nothing in the bar is pre-ticked, and "Reject all" and "Accept all" are the same size and sit side by side: refusing must be no harder than accepting. Until you consent, none of these scripts is loaded and none of their cookies is set.
The analytics group is not in use at all: there is no Google Analytics and no other visitor-tracking script on the Platform.
The marketing group runs two tools:
- the Meta (Facebook) pixel, which sets the cookies
_fbpand_fbc; - the Google Ads tag, which sets
_gcl_au,_gcl_awand similar.
Both let us show our ads to people who visited the site and count the orders that came from advertising. Both load only with your consent: without it neither script is downloaded, and if you withdraw consent the cookies listed are deleted from your browser.
Neither receives your e-mail address, phone number or name. Meta's advanced matching is switched off.
Google appends a click identifier (gclid) to the ad's link, which arrives in the address bar. It is not a cookie and does not identify you: it identifies the ad click, and is used only to tell whether that click became an order.
You can change your decision at any time. The footer carries a "Cookie settings" link that reopens the same window. When consent is withdrawn, that group's cookies are deleted from your browser at once rather than merely left unused. Withdrawal applies going forward and does not affect what was done while the consent was in force.
Your choice is stored in your own browser (the record agromap_cookie_consent) together with the date you made it. It is not sent to our server.
3. What the Platform writes to browser storage
Every record is of the localStorage type (not a cookie), set by agromap.lt itself and accessible only to it. They have no expiry date: they stay until the application deletes them (for example on sign-out) or you do (see Section 5).
3.1. Public website and shop
| Record | What it is for | How long it stays |
|---|---|---|
lang | the chosen language (lt, en, ru) | until you delete it |
agromap_cart | the basket contents: product code, quantity and membership term (no prices - the server always recalculates them) | until the order is paid or you delete it |
agromap_open_order | the number of an order not yet paid, so you can resume payment after closing the tab | until the order is paid or cancelled |
turnstile_site_key | the public Cloudflare Turnstile key, so the sign-in form can show the bot check | rewritten every time the site is opened |
agromap_cookie_consent | your choice about analytics and marketing cookies, and the date you made it | until you change it or clear your browser data |
3.2. Customer application (signed in)
| Record | What it is for | How long it stays |
|---|---|---|
agromap_token | the sign-in token, valid for 24 hours | until sign-out or expiry |
agromap_user | your name, e-mail and account number, so the application does not show an empty screen while loading | until sign-out |
agromap_refresh | a long-lived refresh token valid for 90 days; stored only when "Remember this device" is ticked | until sign-out (the token is then also revoked on the server) or 90 days |
agromap_device_id | a random identifier for this browser, which lets the server tell your sessions on different devices apart | until you delete it |
agromap_bio_cred | the key identifier for biometric sign-in (Touch ID, Windows Hello, Android). No biometric data is stored here - it never leaves your device | until you switch biometric sign-in off |
agromap_last_user | the last e-mail address that signed in, so biometric sign-in knows whom it is for | until you switch biometric sign-in off |
3.3. Mobile application (app.agromap.lt)
The application runs in the browser as a PWA and uses the same records as the customer application, with these differences:
| Record | What it is for | How long it stays |
|---|---|---|
agromap_refresh_token | the refresh token (90 days); in the application it is always stored, with no separate choice | 90 days; kept after sign-out so biometric sign-in keeps working; deleted when biometrics are switched off |
agromap_user_profile | a copy of your profile (name, company, contacts) for faster display | until you delete it |
agromap_vehicle_icons | the machine icons you chose, keyed by tracker IMEI | until you delete it |
agromap_geo_granted | a flag that you already allowed the application to show your phone's location on the map | until you delete it |
Your phone's location ("My location" on the map) is used only on your screen and is not sent to our server.
3.4. Administration area (our staff only)
admin_token, admin_identity and cms_token are staff sign-in tokens (24 hours) for the administration area. They are never set for customers.
4. Third-party tools that may set their own cookies
| Tool | When it loads | What it does | Whose cookies |
|---|---|---|---|
| Cloudflare Turnstile (challenges.cloudflare.com) | on the sign-in, registration and contact forms | checks that a human rather than a bot is filling in the form, without picture puzzles. Cloudflare receives your IP address and browser details | Cloudflare may keep technical identifiers in its own domain challenges.cloudflare.com; we neither control nor read them. See https://www.cloudflare.com/privacypolicy/ |
| Stripe (js.stripe.com) | only when you choose to pay by card at checkout | the payment form into which you enter card details directly with Stripe; they never reach us | Stripe sets the cookies __stripe_mid (1 year) and __stripe_sid (30 minutes) for fraud prevention. See https://stripe.com/cookies-policy/legal |
Other external sources the browser requests, which do not set cookies on our site:
- Map tiles from OpenStreetMap (tile.openstreetmap.org) and Esri (server.arcgisonline.com) - when you open a map. They receive your IP address and the coordinates of the map section shown.
- Address lookup (nominatim.openstreetmap.org) - only in the mobile application, when a machine's location is shown as an address; the request carries the machine's coordinates.
- Google Fonts (fonts.googleapis.com) - only in the mobile application, to load the font; Google receives your IP address.
5. How to delete the records
- Signing out of the customer application deletes the sign-in tokens and revokes the refresh token on the server. The biometric sign-in records stay until you switch biometrics off in your profile.
- In your browser settings choose "Clear site data" (Chrome: Settings → Privacy and security → Site data; Safari: Preferences → Privacy → Manage Website Data; Firefox: Settings → Privacy & Security → Cookies and Site Data). This removes both the storage records and third-party cookies. You will then need to sign in again, and the basket and language choice will be empty.
- Your browser can be set to block third-party cookies. The Platform keeps working; only card payment may fail if the browser blocks Stripe.
6. Changes
When the tools we use change, we update this policy and the date at the top. If a record ever needs consent, we will ask for it before setting it.
Send questions to info@agromap.lt. How we handle personal data is described in the privacy policy.