What we do with your information

When you submit the form we ask for, and keep, exactly these fields:

• First name: to address you in the reply.
• Email address: so we can send the assessment back.
• Phone number: optional, only if you choose to share it.
• Your family story (free text): names, places, approximate dates of your ancestor.

Alongside the submission, we store technical context to detect spam and understand which channels bring real people:

• Marketing attribution: UTM parameters and Google Ads click IDs (gclid, gbraid, wbraid), if present and permitted by your consent.
• Referrer: the page that linked you here, if your browser sends it.
• Browser user-agent: the standard string browsers report.
• Hashed IP: a one-way SHA-256 hash truncated to 16 characters; we cannot recover the original address.

We do not ask for, and do not store, payment information or government documents at this stage.

• To read your case and email you a written assessment.
• To improve our copy and pages (which keywords brought you here, did the page load).
• To detect spam and automated submissions.

To measure which ads bring real cases, we may share a hashed (one-way) version of your email or phone with Google Ads, but only with your advertising consent and never if you have opted out or your browser sends a Global Privacy Control signal. We do not sell your data to advertisers or data brokers.

We use a small number of third-party services to operate Gabija Citizenship. Each only sees the data it needs:

• Render: hosts the website; sees server logs for security and operations.
• Supabase: stores submissions in an encrypted Postgres database.
• Resend: sends the assessment email back to you, only if you submitted the form.
• Google Analytics & Google Ads: measure traffic and ad performance. With your advertising consent, this includes Enhanced Conversions, where your email (and phone, if given) is normalized and turned into a one-way SHA-256 hash on our server and sent to Google to match a conversion to an ad click. We never send Google your family story, ancestry, nationality, religion, documents, or any case details.

We tailor consent to where you are. In the EU, EEA, UK, and Switzerland we show a cookie banner and load nothing for analytics or advertising until you accept. In the United States we do not interrupt you with a banner; instead the Privacy choices link in the footer lets you turn ad measurement, personalization, and analytics on or off at any time.

We use Google Consent Mode v2 and honor the Global Privacy Control browser signal: when it is on, we treat it as an opt-out of advertising data sharing and do not send click IDs or hashed email/phone to Google Ads. You can withdraw consent at any time from Privacy choices, which turns these signals off and clears the related tracking storage in your browser.

Part of the work, the filing that has to be done on the ground in Lithuania, is handled by a qualified specialist we partner with there. When your case qualifies, we share your details with that firm so they can review it and carry it forward for you. They are bound by strict confidentiality, may use your information only to work on your case, and may not use it for their own purposes or pass it on to anyone else. You can ask us to stop sharing, or ask them to delete your information, at any time.

If you are in the EU, EEA, or UK, the GDPR gives you the right to access, correct, delete, and port your data, and to object to certain processing. Residents of California and similar US-state regimes have parallel rights.

To exercise any of these, email us or simply reply to any Gabija Citizenship message you have received. We respond within 30 days.

For privacy questions, deletion requests, or anything else about your data:
hello@gabijacitizenship.com