Privacy policy

This policy covers oats.lv, including the website scan at oats.lv/scan/, and the tools at pension.oats.lv and bmx.oats.lv.

Who is responsible

SIA "OATS", registration number 40203754767, Latvia.

Write to info@oats.lv about anything on this page.

Your rights

Under the GDPR you can ask for a copy of the personal data I hold about you, ask me to correct it, ask me to delete it, ask me to restrict how it is used, ask for it in a portable form, and object to processing based on legitimate interest.

Email info@oats.lv to exercise any of these. I answer within one month. If you are not satisfied, you can complain to the Data State Inspectorate, the Latvian supervisory authority, at dvi.gov.lv.

The website scan

When you enter an address at oats.lv/scan/, the scan reads that website from the outside. The security scan reads the homepage and its response headers, the HTTPS certificate, the domain's public DNS and registry records, robots.txt, security.txt and a short list of common file paths.

The AI readability scan reads the homepage as a browser, as two AI search crawlers and as a Markdown request, plus robots.txt, the sitemap and llms.txt.

Nothing on the website is changed.

Only scan a website you own or are allowed to test.

What is kept: the address you entered and the findings of both scans. They are stored on a server in Germany run by Hetzner, the hosting company, and deleted after 72 hours.

oats.lv is hosted by Netlify, and scan requests pass through its servers, so Netlify handles your IP address and the address you entered while forwarding them.

Your IP address is stored with the time of each scan or order, to limit each visitor to five new scans and three orders an hour. These records are deleted after 72 hours.

Anyone who has the link to a report can open it until it is deleted after 72 hours. A scan of the same website within 24 hours shows the stored report.

The scan pages set no cookies and store nothing in your browser.

Legal basis: your request, and my legitimate interest in keeping the scan from being used to flood other websites.

Ordering a fix

The order form at the end of a report asks for your name, your email address, an optional phone number and a note.

Sending the form passes the findings you ticked and your details to info@oats.lv through Resend, an email delivery service. A copy that lists only the ticked findings goes to the email address you entered. Your note goes to OATS only.

Purpose: to agree and carry out the fixes you ordered. Legal basis: steps taken at your request before a contract.

Retention: the order is deleted 72 hours after you send it. The email in the info@oats.lv mailbox stays until I delete it. Ask me to delete it and I will.

Emails to organisations

Now and then I write to companies, associations and foundations at the general email address published on their website (for example info@) with the result of a passive check of their website. I do not write to private individuals, including sole traders, without their prior consent.

I keep the organisation's name, the email address, the page where it is published, the check result and the correspondence, for up to 24 months.

Legal basis: my legitimate interest in offering the service to organisations whose website shows security gaps (GDPR Article 6(1)(f)).

You can object at any time by replying to the email or writing to info@oats.lv. I then put the address on a do-not-contact list and delete the rest.

The contact form on oats.lv

The contact popup collects three fields: your name, your email address and your message.

Purpose: to answer you. Legal basis: your consent, given by sending the form, and my legitimate interest in responding to business enquiries.

Delivery: the form is passed to Resend, an email delivery service, which sends it to info@oats.lv. Your email address becomes the reply-to address so I can answer. Nothing is written to a database on the way through.

Retention: the message stays in the info@oats.lv mailbox until I delete it. Ask me to delete it and I will.

Analytics

These sites use GoatCounter. It sets no cookies, records no IP address and builds no profile. It counts page views and referrers only. There is nothing here that identifies you.

oats.lv remembers the language of the page you viewed in a cookie named oats_lang. It holds only "lv" or "en", is shared with the other OATS sites so they open in the same language, and expires after one year.

The pension calculator

Everything you type into pension.oats.lv stays in your browser. Your figures are saved to your own device using localStorage, not to a server. Clear your browser storage and they are gone.

One action sends data to the server. Downloading the PDF report sends your age, retirement age, gross monthly salary, expected salary growth, property size and the projected capital and monthly figures for each of the three pillars.

These payloads carry no name, no email address and no account of any kind. There is nothing in them that identifies you as a person.

The report request is not stored. The server renders the PDF, returns it and keeps only a counter of how many reports have been produced.

The written commentary in the report is produced by DeepSeek, which receives the figures above and no identifier. DeepSeek is a third-party model provider outside the EU.

The web server keeps an access log, and that log records the IP address of the requesting device alongside these POST requests, as it does for any page request. The log rotates and old files are discarded. IP addresses are also held in memory for a few minutes to rate-limit the export endpoint, and are not written anywhere for that purpose.

The BMX statistics site

bmx.oats.lv collects nothing from you. There is no account, no form and no tracking beyond the analytics described above.

The site does publish personal data about riders: name, club, age group and competition results. That data comes from public Latvian BMX competition results published on sqorz.com. Legal basis: legitimate interest in reporting published sports results.

If you are a rider, or the parent of one, and you want your data removed from the site, email info@oats.lv and I will remove it.

The rider report PDF includes a written summary generated by DeepSeek from the same public results. Download counts are kept as a plain number. IP addresses are used only to slow repeated requests and are not stored.