1. Who is responsible
Tutacare MB operates Tuta Care. Contact us at hello@tutacare.com about privacy, access or deletion. We act as controller for our website enquiries, business contacts, account administration and our own CRM. Where a care organisation uses Tuta Care to manage residents or staff, that organisation determines the purposes of that processing and is normally the controller; our processing on its behalf is governed by the applicable service and data-processing agreement. This notice does not replace the organisation’s own privacy notice.
2. Information we use
We process the details you provide in enquiries and chat, such as your name, work email, telephone number, organisation and message. CRM records can include business contacts, correspondence, attachments, tasks, assignees, dates and activity history. Account and security information includes user identifiers, roles, sessions and technical access logs. Please do not send resident health information or other sensitive records through the public contact form or marketing chat.
3. Google sign-in and Calendar
Google sign-in provides your Google account identifier and verified email to match an approved CRM profile. With your permission, the CRM reads the list of your calendars and events in the calendar you select, and creates, updates or deletes events to provide calendar features and synchronise eligible assigned tasks and follow-ups. Event data can include titles, dates, times, descriptions, identifiers and organiser information. If needed, the integration can create a separate application calendar. Google date changes can update the corresponding CRM dates; deleting a linked event clears the CRM date, not the underlying task. Personal Google events are shown only to the connected CRM user; shared CRM records remain subject to CRM permissions. Google sign-in does not give the CRM access to your Gmail inbox. Any separately connected email mailbox uses its own provider and credentials.
4. Why we process information
We use information to answer enquiries, arrange demonstrations, administer access, deliver contracted services, handle correspondence and support, and protect the service. Depending on the relationship, our legal basis is taking steps requested before a contract or performing a contract, our legitimate interests in business communication and secure operation, or a legal obligation. Optional processing that relies on consent can be stopped by withdrawing that consent. Google’s permission screen authorises the integration; it does not authorise unrelated advertising or other uses.
5. Sharing and Google Limited Use
Information is accessible to authorised staff and service providers as needed to deliver the service, including hosting, website infrastructure, support and connected email/calendar providers. The website uses Cloudflare infrastructure and self-hosted Chatwoot for chat; email delivery uses Titan/Hostinger. Google receives calendar requests and the CRM information you choose to synchronise. We do not sell Google user data, use it for advertising, or use it to train general-purpose AI models. Tuta Care’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Human access to Google data is restricted to authorised support with your agreement, security investigations, or legal requirements. Other disclosure may be necessary to comply with law or protect legal rights. Where processing involves transfers outside the EEA, applicable transfer requirements and safeguards must be observed; you may request details from us.
6. Storage and retention
We use access controls, HTTPS and encrypted storage for Google refresh credentials and the local Google-event cache. We retain contact and CRM records while needed for the relevant relationship, service, security, legal obligations or claims. Retention depends on the record’s purpose and any customer agreement; this is not a promise that every record is automatically deleted after a fixed period. Website analytics cover a rolling 90-day period, with old records removed during subsequent collection or report access. Restricted backups may retain earlier copies until they are replaced or removed under the applicable backup process.
7. Disconnecting Google and requesting deletion
In the CRM, open Nustatymai → Mano Google Calendar and disconnect your account to remove the stored calendar refresh credentials and cached Google events. Existing Google events and CRM records are not automatically deleted. Non-secret event mappings and the linked Google sign-in identity remain so reconnection can avoid duplicate exports. Signing in through Google again can reconnect Calendar after permission is granted. You can also revoke access in your Google Account connections. For deletion of your linked identity, mappings, account or other personal data, email hello@tutacare.com. We verify the requester’s authority and explain any records that must be retained. If your employer controls the records, we may refer or forward the request to that organisation.
8. Website storage and analytics
Necessary cookies or browser storage support sessions, language preferences and requested chat features. Our first-party statistics record page views, approximate country, coarse browser/device type, language, page and referring hostname, without full IP addresses. Persistent browser identifiers are only used after analytics consent. They are retained for a rolling 90-day period. Technical servers process connection information to deliver and protect the service. When Google Analytics is configured, it is optional and loads only after you choose “Allow analytics”. Google then processes page visits, device/browser information and interactions such as contact clicks, scroll depth and successful enquiries using analytics cookies. We do not include contact form contents, names, email addresses or URL query strings in our custom analytics events. Advertising consent remains denied; Google signals and advertising personalisation are disabled in our tag. Google may process data outside the EEA; see Google’s privacy policy and how Google uses information from partner sites. Our analytics consent choice and Google cookies are set for up to 180 days; Google property event-data retention is configured separately. Use “Cookie settings” in the footer at any time to decline or withdraw consent. This stops future collection and removes our Google Analytics cookies; it does not erase information already processed. Both analytics systems respect supported Do Not Track and Global Privacy Control signals. Legal pages show consent settings but do not initialise Google Analytics or chat. Chat can store conversation identifiers and messages when used. Country lookup is performed on our server using a local IP-country database; visitor IPs are not sent to a geolocation provider or saved in analytics records. Only after analytics consent, a random first-party browser identifier is stored for up to 90 days to deduplicate returning browsers. The server stores its keyed hash. We do not fingerprint devices. Clearing storage, private windows or different browsers can count separately. Withdrawing analytics consent removes this browser identifier; previous records expire within the rolling 90-day period.
9. Meta Pixel and advertising cookies
Only after separate consent to advertising cookies, we use Meta Pixel (ID 2175751403325194) on public marketing pages. PageView measures visits, Lead measures clicks on the contact CTA and Contact measures telephone-link or floating contact-button clicks, distinguished by the fixed categories skambinti and parasykite_mums. These are clicks, not confirmed enquiries or completed calls. These events help attribute them to Facebook and Instagram advertising and build advertising audiences. Meta receives the page URL and normal browser request data, including IP address, browser and device information; it may use _fbp and _fbc identifiers and associate activity with data it already holds. We do not send contact form fields, messages, CRM or resident data; additional automatic events are disabled. Meta Pixel does not run in the CRM, demo, editor or legal pages. We store your advertising preference in your browser for up to 180 days. You can withdraw consent through Advertising cookie settings in the footer: future events stop and our _fbp and _fbc cookies are removed; previously transmitted data is not automatically deleted. Declining does not affect use of the website. Supported DNT and GPC signals are respected. The recipient is Meta Platforms Ireland Limited; see its Privacy Policy and Cookies Policy for its processing and international transfers.
10. Your rights and contact
Depending on the circumstances, you can request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests, and withdraw consent without affecting earlier lawful processing. We respond within the period required by applicable law and explain any permitted extension. You may complain to Lithuania’s State Data Protection Inspectorate or your local supervisory authority. Send requests to hello@tutacare.com. We will update this notice when our practices change and provide additional notice or seek renewed permission where required.