Privacy Policy

Who is responsible for your data

The data controller is HDR IT Consulting (Larevio), based in the Netherlands. Contact: [email protected]. For privacy requests, use the same address with "Privacy request" in the subject line.

What data we collect

Depending on how you use Larevio, we may process:

• Account data: name, email address, user ID (via Google or Apple sign-in).
• Family and schedule data you add: household members, events, tasks, reminders, approvals.
• Content you send us to process: forwarded school emails, email subject lines and body excerpts, screenshots, photos of documents, voice notes, and free-text captures.
• Connected account metadata: which calendar or mailbox you connected, not the password.
• Waitlist data: email address, optional household size, signup time, and consent record.
• Technical data: app version, device type, basic usage logs, and error reports to keep the service running.

How we use AI

Larevio uses AI to read content you choose to send us and suggest calendar events, tasks, reminders, and plain-language summaries. This is core to the product. Important details:

• AI processing is done through OpenAI (currently gpt-4o-mini). Your content is sent to OpenAI only when you trigger a capture or connect a mailbox and run a scan.
• We send truncated content where possible (for example, email body excerpts), not full mailbox archives.
• We configure our systems so OpenAI does not store prompts in our organisation Logs (`store: false` on API calls).
• AI output is a suggestion. Nothing is added to your calendar until you approve it.
• A person stays in the loop: you review, edit, or reject every AI suggestion before it affects your family plan.
• We store structured results and short excerpts needed to show you the original source. We do not store full email bodies in our database.
• AI may misread content. You can edit, reject, or delete suggestions.

Why we are allowed to use your data (legal bases)

Under GDPR we need a lawful basis for each type of processing:

• Waitlist signup: your consent (you tick the box before joining).
• Running your account and delivering the service: performance of a contract / steps at your request before a contract.
• AI processing of content you submit or connect: performance of the service, based on your explicit choice to use those features.
• Security, fraud prevention, and service reliability: legitimate interests, limited to what is necessary.
• Legal obligations: where required by law (for example, responding to valid legal requests).

Who we share data with (processors)

We use trusted providers to run Larevio. They process data on our instructions, not for their own marketing:

• Supabase: database, authentication infrastructure, and edge functions.
• OpenAI Ireland Ltd: AI text, image, and document analysis under a signed Data Processing Addendum.
• Google: sign-in and Google Calendar integration, when you choose to connect.
• Apple: sign-in, when you choose to use Apple.
• Microsoft: Outlook mail and calendar integration, when you choose to connect.
• Cloudflare: website hosting, waitlist storage, and privacy-friendly analytics.
• Expo / EAS: mobile app build and distribution infrastructure.

International transfers

Some providers process data outside the European Economic Area. OpenAI Ireland Ltd is our EU-facing AI processor under a signed DPA. Where processing still involves transfers outside the EEA, we rely on appropriate safeguards such as Standard Contractual Clauses. You can ask us for more detail.

How long we keep data

Retention depends on the data type:

• Account and family data: kept while your account is active, then deleted or anonymised within about 30 days after you delete your account.
• Waitlist email: kept until we contact you about access, plus a reasonable follow-up period, or until you ask us to remove it.
• AI usage and security logs: kept only as long as needed for billing, debugging, and security, then deleted or aggregated.
• Legal records: kept longer only where required by law.

Children and family data

Larevio is for parents and guardians organising family life. Children under 13 should not create their own accounts. A parent or guardian may enter information about children (such as names, school events, or schedules). We treat that information as personal data and protect it the same way as other account data.

Your GDPR rights

If you are in the EU/EEA (including the Netherlands), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be erased").
• Export your data in a portable format (available in the app).
• Restrict or object to certain processing.
• Withdraw consent at any time (for example, waitlist or optional features). Withdrawal does not affect processing that was lawful before withdrawal.
• Lodge a complaint with your supervisory authority. In the Netherlands: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

How to exercise your rights

Email [email protected] or use in-app tools: Settings for data export, and Settings → Security → Delete my account for deletion. We respond within 30 days.

Waitlist

If you join the waitlist, we store your email, optional household size, timestamp, and a record that you agreed to this policy. We use it only to manage beta access and founding pricing. You can withdraw consent and ask us to delete your waitlist entry at any time.

Cookies and analytics

Our website does not use advertising cookies or cross-site tracking. We use Cloudflare Web Analytics, which is cookieless on your device. See our Cookies page for details. We do not sell personal data.

Security

We use encryption, access controls, and secure authentication. No system is perfectly secure. If you believe your account has been compromised, contact us immediately at [email protected].

Changes to this policy

We may update this policy as Larevio grows or as law changes. We will update the date at the top and, for important changes, notify you by email or in the app. Continued use after changes means you accept the updated policy where the law allows.