Effective 23 October 2026 · Version 2026-10-23-9bb664358d14
OxyLens privacy notice
Who is responsible
MB Evelaina, company code 307863457, Europos pr. 34-47, LT-46370 Kaunas, Lithuania, operates OxyLens. Contact hello@oxylens.com about privacy, access or deletion.
Data and purposes
We process your email and any supplied name, account/workspace identifiers and sign-in/session information to create your account, send sign-in links, verify access and provide the service. We process necessary IP/browser information, request outcomes and security logs to prevent abuse and investigate faults.
If you request access or contact us, we process your name, email, company, trading context, message, submission time and referring-page/campaign information to answer the inquiry and understand which page led to it.
On the public website we count page views per day, per page, per referring site and per campaign tag. These are totals only: we set no cookies for this and store no IP addresses or other personal identifiers with them. When you create an account, we record which website link you used to reach the signup page, so we can see which pages lead to signups.
From 19 October 2026 we also count a few steps on the way to an account as daily totals: clicks on the signup and Full Access buttons, signups started and completed, Preview opened, checkout started and seller form entries. Each total is kept per day, per step and per website link, with no IP address, cookie or account identifier. The only cookie involved is an opt-out cookie that the OxyLens team sets in its own browsers, for oxylens.com and app.oxylens.com, so that our own checks are not counted.
Your workspace may contain requirements, marks, saved briefs, supplier/contact details, conversation notes and other sourcing answers you enter. We use these to provide your private working features. Public-source business contact information may also appear in shared research shown to customers using that research. It comes from official registers, company publications and other cited business sources, not from another customer's private notes. Contact us to correct it or object to processing where applicable.
For billing we process personal or business billing name, billing address/country, email, applicable tax identifiers, customer/subscription references, invoices, payment/access status, accepted policy versions, immediate-start requests, withdrawal submissions and payment correction/refund records. Payment details are entered into the hosted billing service; OxyLens does not store your full card number. Support correspondence is used to answer and resolve your request.
We use contract necessity for an individual customer's contracted service, legitimate interests for managing a business's representatives, security, support and proportionate sourcing research, and legal obligations for required accounting records. Optional consent applies only where separately requested. Required account/billing fields are needed for access and accurate invoicing; without them we may be unable to provide the relevant service.
Seller form
From 19 October 2026 the used cooking oil page on oxylens.com has a short form for sellers, and from 21 October 2026 the same form is also on the animal fats, glycerine, Germany, Spain and Poland Category 3 fat pages. It stores which page it was sent from, what you want (buyers, or from 23 October 2026 a correction or removal of a record), the country where the material is loaded, a monthly volume band, an ISCC or REDcert certificate number if you give one, a short note of up to 500 characters if you write one, your company email and the time the entry arrived. We use a buyer entry to count seller demand and decide which buyer research to build next, under our legitimate interest in understanding that demand, and we use the email only if we reply to your entry. A request to correct or remove a record is how you ask us to correct or delete what OxyLens shows about your company or about you: the note says which record and what should change, we answer by email at the address you gave within one month, and we keep the request and its note for 12 months as a record that we received and handled it. We may ask you to confirm that you act for the company before we change a record. A bot check by our security provider runs before an entry is accepted. No IP address or browser identifier is stored with the entry. It is never shown on any page or shared outside OxyLens, and it is deleted automatically 12 months after it arrives.
Workspace privacy
Private workspace content is separated between customers. We do not disclose it to other customers or use it to enrich their research. Authorised operational/support access is limited to service, security and legal needs. When you act as controller and determine why personal data in supplier notes is processed, we process that content on its instructions under the workspace processing appendix included with the Terms. We remain responsible for our own account, security and billing purposes.
Recipients and international processing
We use providers for hosting/infrastructure, account authentication, transactional email, payments/billing, security/logging and map/content delivery. They receive the information needed for those functions; map/content requests include connection information needed to deliver the resource. Payment providers may also process information for their own regulatory and fraud-prevention duties. Professional accounting/legal advisers and authorities may receive information where required. We do not sell personal data or use private supplier answers for marketing.
Processing may take place in the EEA and outside it, including the United States. For transfers outside the EEA, our service-provider arrangements use applicable European Commission adequacy decisions or appropriate safeguards, including the Commission’s standard contractual clauses and additional measures where required. You can ask us for more information about the relevant recipients and safeguards, including a copy where applicable. We do not promise that all service data stays in the EU.
Retention and deletion
| Data | Retention criteria |
|---|---|
| Account/workspace content | While the account is active. Closure/deletion requests are handled manually after identity verification; we explain the proposed return/deletion date and any specifically retained legal-claim or obligation records. Cancellation alone does not start deletion. |
| Unused Preview accounts | No automatic inactivity deletion currently operates. Unused Preview accounts remain until closure/deletion is requested or we notify the holder of a manual inactivity review. |
| Sign-in links/sessions | Links expire and can be used once; sessions expire or are revoked. Expiry invalidates access; expiry alone does not delete stored identity records. Those records are removed through the verified account-closure process or a documented security review. |
| Security logs | Routine service request logs are retained for 3 days on the current plan. Separately saved incident/audit evidence is restricted and reviewed when its documented incident, release or claim purpose ends. |
| Support correspondence | Until the request and necessary follow-up are resolved; a specific dispute/claim or obligation can require longer restricted retention. We review resolved correspondence on a deletion request. |
| Seller form entries | Deleted automatically 12 months after the entry arrives. A deletion request removes an entry sooner. |
| Access/contact inquiries | Until the inquiry and necessary follow-up are finished; a deletion request prompts a review unless an active matter or specific claim requires retention. |
| Invoices/billing records | VAT invoices are retained for 10 years from issue. Other billing/contract evidence is retained for its applicable accounting obligation or identified dispute/claim, with restricted longer retention only where required. Account deletion does not erase required invoices; we explain separately retained records on request. |
Cancelling a subscription alone does not delete the workspace. Request account closure or deletion through hello@oxylens.com. We may verify your identity and explain records that must be retained. The current database recovery history covers 7 days. Separately retained operational snapshots are restricted, inventoried and reviewed after their recovery/audit purpose ends. Restoration must reapply approved deletions. No automatic purge of those manual snapshots is represented as already operating.
Rights and service storage
Where applicable you can request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Any optional consent can be withdrawn without affecting earlier lawful processing. You may complain to the Lithuanian State Data Protection Inspectorate or your competent supervisory authority.
Essential sign-in/session storage supports access and security. Local browser storage also remembers preferences and caches workspace marks for normal product use. This notice does not authorise new advertising tracking. Access/payment status and abuse controls use automated checks; contact us about an incorrect result. We do not use sourcing research to make decisions about employment, credit or similar personal eligibility.