Legal
Privacy policy
Last updated
This policy explains what personal data LAVESSO collects, why, who we share it with, how long we keep it and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
LAVESSO is run by [LEGAL ENTITY NAME], a company registered in [COUNTRY OF REGISTRATION: for example England and Wales] (company number [COMPANY NUMBER]), registered office [REGISTERED OFFICE ADDRESS]. We are registered with the Information Commissioner's Office (ICO) under number [ICO REGISTRATION NUMBER].
For the personal data described in this policy we are the controller. You can contact us about privacy at support@lavesso.com.
LAVESSO is an AI platform. Businesses use the LAVESSO API to add AI features to their own products, such as listing text suggestions, text safety checks, support triage and help-centre answers, and pay for what they use from prepaid credit. A workspace for people and teams is in development.
When we act for a business
When a business sends text about its own customers to the LAVESSO API, for example a seller's listing or a support ticket, the business decides why and how that text is processed. For that text the business is the controller and LAVESSO is its processor: we process it only to provide the service the business asked for and under our agreement with it. If you are a customer of a business that uses LAVESSO, please read that business's privacy notice and contact it first about your rights.
LAVESSO does not moderate photos or other content for the businesses it serves and does not receive their moderation data. Each business is responsible for its own moderation.
What we collect
Account and sign-in
- Your email address, used to create your account and sign you in by email and password or by email link.
- If you sign in with Google (or, when available, Apple): the email address it confirms, and the name and profile picture that account shares, which our sign-in provider (Supabase) stores with your account.
- Sign-in session records, such as when a session started, so sessions can be checked and ended.
Organisations and members
- The organisations (businesses) you belong to, their names and the country they give us.
- Member records: who is a member, their role (such as owner or admin), the permissions they hold and who invited them.
- Projects, environments, API key records (a key id, name, scope, status and dates, never the secret key itself after it is shown once) and budgets.
Usage, cost and billing
- Usage and cost records for each request: the capability used, the model, token counts, the charge, and the business's own customer reference if it sends one.
- Prepaid credit balances, top-ups, receipts and statements.
- Payment records from Stripe: amount, currency, status and dates, and the business details given at payment. We never receive or store full card numbers.
API requests
- Request metadata: the key id that made the request, timestamps, the model, token counts, request ids and the outcome.
- The text a business sends for AI processing and the reply. How long each kind is kept is set out under "How long we keep data" below: in short, most request records are deleted after 24 hours, and for text safety checks and help-centre answers we keep a fingerprint of the request rather than the text itself.
Support and security
- Emails you send to support and our replies.
- Security logs, such as sign-in attempts, refused requests and rate-limit events, which may include IP addresses.
- Error reports, only when error reporting is switched on. They are scrubbed before they leave our servers and your browser: no request bodies, cookies, IP addresses, emails or customer text.
Google sign-in
If you choose to sign in with Google, LAVESSO requests only the openid, email and profile scopes. We use them only to sign you in to your account; your name and picture are stored with your account by our sign-in provider (Supabase), and we may show them in your account in future. We do not request access to your Gmail, Drive, contacts or any other Google data, and we do not use information from Google for advertising.
LAVESSO's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements. Read the Google API Services User Data Policy.
How we use data and our lawful basis
UK data protection law requires a lawful basis for each use of personal data. These are ours.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create and run your account, sign you in and keep you signed in | Account and sign-in data | Contract with you or your business. For members added by a business: our legitimate interests in providing the service the business asked for. |
| Run organisations, roles, projects, keys and budgets | Organisation and member data | Contract; legitimate interests in letting businesses manage their own access. |
| Process API requests and return results | API request data and text sent for processing | Contract with the business. For text about a business's own customers we act as its processor. |
| Charge prepaid credit, take payments and issue receipts | Usage, credit, payment and billing data | Contract; legal obligation to keep tax and accounting records. |
| Send service emails such as budget and balance alerts, key reminders and receipts | Email address, organisation and usage data | Contract; legitimate interests in keeping you informed about your account. |
| Answer support requests | Support emails and related account data | Contract; legitimate interests in helping you. |
| Keep the service secure and prevent fraud and abuse | Security logs, request metadata and account data | Legitimate interests in protecting LAVESSO, our customers and their customers. |
| Find and fix errors | Scrubbed error reports | Legitimate interests in a working service. |
| Meet legal duties and enforce our terms | Any of the above as needed | Legal obligation; legitimate interests in establishing, exercising or defending legal claims. |
We do not rely on consent for any of this today. If we ever ask for your consent, for example for optional marketing emails, we will say so clearly and you can withdraw it at any time.
We do not sell personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
AI processing by Anthropic
To produce AI results we send the text a business submits to Anthropic, the provider of the Claude models, under Anthropic's standard commercial API terms and default data retention. We do not set a processing region with Anthropic, so the text may be processed outside the UK. See Anthropic's privacy policy.
We send only what the request needs. Businesses should not send more personal data than a request requires.
International transfers
Some of our providers process data outside the UK, including in the European Union and the United States. When personal data leaves the UK we make sure it is protected by one of these safeguards:
- UK adequacy regulations, where the UK has decided the country protects personal data adequately (this covers the European Union, and United States companies certified under the UK Extension to the EU-US Data Privacy Framework).
- The UK International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses.
You can ask for more information about these safeguards at support@lavesso.com.
How long we keep data
We keep personal data only as long as we need it for the purposes above. Where a period is set by our systems it is stated exactly.
| Data | How long |
|---|---|
| Account and profile (email, name, picture) | While your account is open. When you ask us to close your account (email support@lavesso.com), we delete this within 30 days, except records the law requires us to keep. |
| Organisation, member and role records | While the organisation is open. When an owner asks us to close it (email support@lavesso.com), we delete these within 30 days, except records the law requires us to keep. |
| Usage, cost, credit, payment and receipt records | [RETENTION PERIOD: financial, tax and payment records] |
| Listing text suggestions | A suggestion can be read for 15 minutes after it is ready. The request record is removed after 24 hours. |
| Text safety checks and help-centre answers | We store a fingerprint (a SHA-256 hash) of the request, never the text or question itself, with the reply. Completed records are deleted after 24 hours; failed requests, which hold no reply, after 30 days. |
| Support triage | We store a fingerprint of the request and the reply, which holds at most 500 characters of the ticket with email addresses, phone numbers, links and card-like numbers removed. Completed records are deleted after 24 hours; failed requests, which hold no reply, after 30 days. |
| Text processed by Anthropic | Kept by Anthropic under its standard commercial API terms and default data retention. |
| Support emails | [RETENTION PERIOD: support emails] |
| Security logs | [RETENTION PERIOD: security logs] |
| Error reports (when switched on) | [RETENTION PERIOD: error reports] |
| Sign-in cookies | See the cookie policy. |
Backups may keep data for a short time after deletion until they are overwritten in the normal cycle.
How we protect data
We use encryption in transit, access controls that limit each person and system to what it needs, scoped API keys that are stored only as hashes after they are shown once, sign-in cookies that scripts cannot read, and scrubbing that keeps secrets and customer text out of logs and error reports. No system is completely secure; if a breach puts your rights at risk we will tell you and the ICO as the law requires.
Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you and get a copy of it;
- have inaccurate data corrected (rectification);
- have your data deleted (erasure);
- restrict how we use your data;
- receive your data in a portable, machine-readable form (portability);
- object to processing based on our legitimate interests;
- withdraw consent at any time where we rely on it.
To use any of these rights, email support@lavesso.com. We may need to confirm your identity first. We reply within one month, and may extend this by up to two further months for complex requests, in which case we will tell you why. Using your rights is free unless a request is clearly unfounded or excessive.
If your request is about text a business sent to LAVESSO about you, we will pass it to that business, which as controller decides how to answer it, and help it respond.
Complaints
If you are unhappy with how we handle your data, please tell us first at support@lavesso.com. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk, telephone 0303 123 1113.
Children
LAVESSO is not for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
Changes to this policy
We will update this policy when our practices change. The date at the top shows the latest version. If a change matters to you, we will tell you by email or in the app before it takes effect.
Contact
Email support@lavesso.com or write to [LEGAL ENTITY NAME], [REGISTERED OFFICE ADDRESS].