Privacy Policy

Who is responsible for your data

The data controller is HDR IT Consulting, trading as Larevio, a Dutch sole proprietorship registered at Jaap ter Haarstraat 25, 1321 LA Almere, Netherlands. KVK: 75608790. VAT: NL002512926B65. Privacy contact: [email protected].

What data we collect

Depending on how you use Larevio, we may process:

• Account data: name, email address, user ID (via Google or Apple sign-in).
• Family and schedule data you add: household members, events, tasks, reminders, approvals.
• Content you send us to process: forwarded school emails, email subject lines and body excerpts, screenshots, photos of documents, voice notes, and free-text captures.
• Connected account metadata: which calendar or mailbox you connected, not the password.
• Waitlist data: email address, optional household size, signup time, and consent record.
• Technical data: app version, device type, basic usage logs, and error reports to keep the service running.

How we use AI

Larevio uses AI to read content you choose to send us and suggest calendar events, tasks, reminders, and plain-language summaries. This is core to the product. Important details:

• AI processing is done through OpenAI (currently gpt-4o-mini). Your content is sent to OpenAI only when you trigger a capture or connect a mailbox and run a scan.
• We send truncated content where possible (for example, email body excerpts), not full mailbox archives.
• We configure our systems so OpenAI does not store prompts in our organisation logs (`store: false` on API calls).
• OpenAI may retain API content under its applicable abuse-monitoring and service terms unless a written zero-retention arrangement applies. We do not claim Zero Data Retention until OpenAI confirms it for our organisation and eligible endpoints.
• AI output is a suggestion. Nothing is added to your calendar until you approve it.
• A person stays in the loop: you review, edit, or reject every AI suggestion before it affects your family plan.
• If you use the voice assistant, the transcript of what you say is shared with the other members of your household, like other shared family data.
• We store structured results and short excerpts needed to show you the original source. We do not store full email bodies in our database.
• AI may misread content. You can edit, reject, or delete suggestions.

Why we are allowed to use your data (legal bases)

Under GDPR we need a lawful basis for each type of processing:

• Waitlist signup: your consent (you tick the box before joining).
• Running your account and delivering the service: performance of a contract / steps at your request before a contract.
• AI processing of content you submit or connect: performance of the service, based on your explicit choice to use those features.
• Security, fraud prevention, and service reliability: legitimate interests, limited to what is necessary.
• Legal obligations: where required by law (for example, responding to valid legal requests).

Who we share data with (processors)

We use trusted providers to run Larevio. They process data on our instructions, not for their own marketing:

• Supabase: database, authentication infrastructure, and edge functions.
• OpenAI Ireland Ltd: optional AI text, image, document and transcription processing. Current contract, transfer and retention evidence is maintained in our provider register; we do not claim Zero Data Retention without written approval.
• Google: sign-in and Google Calendar integration, when you choose to connect.
• Apple: sign-in, when you choose to use Apple.
• Microsoft: Outlook mail and calendar integration, when you choose to connect.
• Cloudflare: website hosting, waitlist storage, and privacy-friendly analytics.
• Expo / EAS: mobile app build and distribution infrastructure.
• RevenueCat: subscription entitlement and purchase-event processing.
• Sentry: scrubbed crash and technical diagnostic events.
• Zoho EU: support, privacy, security and other business correspondence.
• Apple and Google: app-store purchase, subscription and platform-notification processing; Expo, APNs and FCM route minimal push data.

International transfers

Some providers or their subprocessors may process data outside the European Economic Area. We record the contracting entity, region and applicable transfer mechanism for each active provider. Where required, transfers use an adequacy decision, Standard Contractual Clauses or another lawful safeguard. Contact [email protected] for current details.

How long we keep data

Retention depends on the data type:

• Account and family data: kept while your account is active, then deleted or de-identified under the account-deletion process. Shared household records may remain for other members where necessary and lawful.
• Raw photo, audio or document capture artifacts: normally deleted after successful processing and subject to an absolute seven-day cleanup limit.
• Temporary AI-agent artifacts: normally retained for no more than 30 days unless a shorter terminal cleanup applies.
• Source evidence stored with an approved household record: limited to the documented excerpt, currently capped at 800 characters, and retained with that record until it is deleted or no longer necessary.
• Waitlist email: kept until we contact you about access, plus a reasonable follow-up period, or until you ask us to remove it.
• AI usage and security logs: kept only as long as needed for billing, debugging, and security, then deleted or aggregated.
• Legal records: kept longer only where required by law.

Children and family data

Larevio accounts are for adults organising family life. Children should not create or control their own accounts. A parent or guardian may enter information about children, such as names, school events, or schedules. We treat that information as personal data and protect it the same way as other account data.

Your GDPR rights

If you are in the EU/EEA (including the Netherlands), you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to be erased").
• Export your data in a portable format (available in the app).
• Restrict or object to certain processing.
• Withdraw consent at any time (for example, waitlist or optional features). Withdrawal does not affect processing that was lawful before withdrawal.
• Lodge a complaint with your supervisory authority. In the Netherlands: Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

How to exercise your rights

Email [email protected] or use in-app tools: Settings for data export, and Settings → Security → Delete my account for deletion. We respond within one month, as required by GDPR, unless a lawful extension applies.

Waitlist

If you join the waitlist, we store your email, optional household size, timestamp, and a record that you agreed to this policy. We use it only to manage beta access and founding pricing. You can withdraw consent and ask us to delete your waitlist entry at any time.

Cookies and analytics

Our website does not use advertising cookies, cross-site tracking, or a visitor analytics script. Cloudflare processes connection data to deliver and protect the website. See our Cookies page for details. We do not sell personal data.

Security

We use encryption, access controls, and secure authentication. No system is perfectly secure. If you believe your account has been compromised, contact us immediately at [email protected].

Changes to this policy

We may update this policy as Larevio grows or as law changes. We will update the date at the top and, for important changes, notify you by email or in the app. Continued use after changes means you accept the updated policy where the law allows.