Privacy Policy

lavela Privacy Policy

Effective date: September 24, 2026 Last updated: October 17, 2026 Policy version: 2026-10-22

This Privacy Policy explains how lavela ("lavela," "we," "us," or "our") collects, uses, shares, and protects personal data when you use the lavela platform — including our web console, our MCP (Model Context Protocol) server used by AI agents such as Claude or Cursor, and the related APIs and services (together, the "Service").

lavela is a "launch and operations" platform. Acting as your agent under authority you grant us at signup, we provision and operate cloud infrastructure on your behalf — web hosting, compute/containers, databases, domains, and transactional email — connect your payment and advertising accounts, and run day-1-to-90 operations such as monitoring, security scans, compliance documents, and daily AI summaries. lavela never modifies your source code.

If you have questions about this policy or your data, contact us at legal@lavela.dev (see Contact).

---

A Plain-English Summary

This summary is not a substitute for the full policy, but here is the short version:

• We collect the minimum we need to run the Service: your account email, the projects and infrastructure you ask us to provision, usage/metering data so we can bill correctly, audit logs of the actions we take for you, identifiers for the accounts you connect (such as your Stripe or ad accounts), and the time, IP address and browser of your consent, so it is on record.
• We do not store your card numbers — Stripe holds those.
• We do not sell your personal data, and we do not share it for cross-context behavioral advertising.
• You can request access, export, correction, and deletion of your data (handled manually today — see Section 9).
• We use a small set of trusted infrastructure providers ("subprocessors") to run the Service — they are listed below. One of them (DeepSeek, used for AI summaries, compliance drafts and stack detection) processes data outside the EEA, including in China — see Section 7.
• We use automated logic for provisioning, billing, welcome-credit eligibility, and stopping servers when a balance runs out — see Section 3.
• lavela is not a backup service. Fly keeps a daily snapshot of each disk for up to 5 days and lavela cannot restore it for you, and lavela takes no backups of your databases — what each kind of delete removes or keeps is in Section 8.
• To keep the welcome credit to one per person, we keep a one-way hash of your normalized email address, even after you close your account — see Section 2.9. If you save a card, we also keep a one-way hash of its fingerprint and its type to give the card bonus once per card, for as long as your account exists and 12 months after you delete it.

---

1. Who We Are and Our Role

lavela operates lavela. For the purposes of data protection law:

• lavela is the data controller for your account and platform data — the information you give us to create and use your lavela account and to operate the Service (for example, your email, your project configuration, usage/metering, billing records, audit logs, and your consent record). We decide how and why this data is processed.
• lavela is a data processor for the data and systems we provision and operate on your behalf. When you direct us (through the console or your AI agent) to stand up a database, hosting, email sending, or other infrastructure for your app, you are the controller of the personal data your app collects from your end users, and lavela processes that data only on your instructions as your agent and service provider. As your processor, we act only on your documented instructions, engage subprocessors under written terms that pass through equivalent data-protection obligations, assist you with data-subject requests and breach notification, and delete or return the data we provisioned on your behalf when our relationship ends. If you need a data processing agreement (for example under GDPR Article 28), we will provide one on request at legal@lavela.dev.

In short: we control the data about you as a lavela customer; we process — on your behalf — the data inside the infrastructure we run for your app.

---

2. Data We Collect

We collect only what we need to operate the Service. We do not collect special categories of data (such as health, biometric, or political data), and we ask you not to put such data into fields where it isn't required.

2.1 Account identity

• Account email (and, where applicable, the identifier from the sign-in provider you use — if you sign in with Google, the name and profile picture Google provides). This is how we create your account, authenticate you, and contact you about the Service.

2.2 Your projects and provisioning configuration

• The projects you create, your provisioning configuration (for example: which hosting, database, domain, email, compute, or ad modules you want and their settings), and the status of those modules.

2.3 Usage and metering data

• Usage and metering of the infrastructure we operate for you (for example: compute time, including when a server is awake or asleep, build runs, resource counts, ad-spend totals routed through us). We use this to operate the Service and to bill you accurately.
• Wallet and payment records — your prepaid balance, top-ups, promotional credit (the welcome credit and the card bonus), automatic top-up settings and consent, refund requests, and payment status (including whether a payment needed card authentication, failed, or was disputed).

2.4 Audit logs of delegated actions

• Because lavela acts on your behalf, we keep an audit log of the actions you or your agent ask us to take — what was requested, by which surface (web console or a named MCP agent), the tool or route invoked, whether it succeeded, error codes, and timing. For privacy, the audit log stores a cryptographic hash of input/output payloads (a fingerprint, not their content) rather than the raw payload. The entry still records identifying metadata such as your account, the project, the surface used, the timing, and the result, which we keep as our accountability record. Automatic actions lavela takes on its own (such as an automatic rollback) and a connection you complete on another provider's page (such as connecting GitHub) may not be recorded; some requests lavela refuses before acting on them (for example over a rate limit, or before you have accepted the current Terms) are not recorded; and a project's entries are deleted with the project (see Section 8).

2.5 Connected-account identifiers

• Identifiers for the accounts you connect — such as your Stripe / Stripe Connect account ID, your connected advertising account IDs, your domain names, and similar references. These let us operate those services for you.
• GitHub connection (only if you connect GitHub). We store your GitHub username and numeric id and the OAuth access token you grant (scope repo; a connection made before October 2026 may also carry read:user). GitHub describes the repo scope as broad access to your repositories; lavela uses it only to read — to list your repositories, read files and download the source we analyze and build — and does not push to or change your repositories. The token is stored server-side in lavela's database (encrypted at rest by the database provider) and is never readable from your browser. You can disconnect GitHub at any time on the GitHub connection page of the console: lavela then asks GitHub to revoke its access and deletes the stored token (if GitHub cannot be reached we still delete our copy and tell you to remove lavela under Settings → Applications in your GitHub account). Closing your lavela account also deletes the stored token. If GitHub tells us the token is no longer valid, we delete it.
• We do NOT collect or store your payment card numbers. When you set up billing, your card details go directly to Stripe, which stores them; lavela receives only a token/reference and basic billing metadata about the card: its brand, last four digits, expiry month and year, issuing country and type (credit, debit, prepaid or unknown), and — for the card bonus — the card fingerprint described in Section 2.9. If you turn on automatic top-up, we keep the reference to the card you chose so Stripe can charge it under the limits you agreed to.

2.6 Consent record

• When you accept our clickwrap agreement at signup or first provisioning, we record the policy/consent version you accepted, the language and a fingerprint (hash) of the exact text you were shown, the timestamp, and your IP address (and user-agent string). This is your legal record of what you agreed to and when.
• When you save a card, we also record the card-saving and data notice you accepted, which includes your agreement to automatic top-up where the card window asks for it: a hash of the exact wording you were shown (and a stored copy of that wording, including the sentence next to the box, where there is one), the screen it appeared on — and, where the box carries the agreement, that it was unticked when the screen appeared and that you ticked it, or, where a card form has two buttons, which one you pressed — the numbers shown to you, the time, and your IP address and browser information. We keep this record as evidence in case of a dispute. When we delete your account, we erase the IP address and browser information in this record as a step of that deletion. What you agreed to, and when and how (the hash of the wording, the time, and what you ticked or pressed), is kept for three years after your account is closed in case of a dispute (Section 8).

2.7 Operational and diagnostic data

• Standard logs and error/diagnostic data generated while running the Service (for example, request metadata, error events, and performance traces), used to keep the Service reliable and secure.
• Logs of the servers we run. Everything a server that lavela runs for you writes to its output and error streams, and the logs of lavela's own infrastructure, are collected into one shared logging service (Axiom) so they can be shown back to you and used to operate the platform. This is not an opt-in setting — see Section 5 — so keep personal data out of what your app prints.

2.8 Communications

• If you email us or contact support, we keep that correspondence to respond and for our records.
• We send you service and billing emails (for example, low-balance notices, the time your servers will stop, and automatic top-up problems) and keep a record that they were sent.

2.9 Welcome credit eligibility, billing location, and referrals

• One-per-person check. When you claim the welcome credit, we store a one-way cryptographic hash of your email address in a normalized form (ignoring letter case and anything after a "+" before the @, and, for Gmail addresses, dots). We compare it to earlier claims so the credit is given only once per person. The hash does not contain your address and can't be turned back into it, but someone who already knows an address could compute the same hash and check whether it matches.
• Card country and billing location. To decide whether a direct top-up is available to you, we use the country that issued your card, as Stripe reports it. For a top-up through Stripe's Link checkout, we record the billing country Link collected (it decides the tax), the tax Link added and the total you paid. To apply the right taxes, we record your billing country and region (and, where needed, a postal code) from what you enter at checkout or what Stripe returns for your card. For a direct top-up with a card issued in South Korea (where lavela offers it), we add Korean value-added tax and keep its rate and amount with the order.
• Card fingerprint (only for a card you save or pay with directly — not for a Link payment). To give the one-time card bonus once per card and to prevent fraud, we store a one-way hash of the card "fingerprint" that Stripe provides (the same physical card always gives the same value; Stripe is in the United States, Section 5) and the card type (credit, debit, prepaid or unknown). It does not contain the card number and can't be turned back into it. We use it for nothing else — not for advertising, and we do not sell it. We keep it while your account exists and for 12 months after you delete it, then delete it (Section 8). The card-saving screen explains this before you agree.
• Referral source. If you open lavela's homepage or guide through a creator, referral or campaign link — one carrying utm_… parameters — we keep those parameters, the page you opened and when, in a first-party cookie for up to 30 days (see Section 11). If you create an account in that time, we record them with your new account once, to see which links bring sign-ups; an account created before that visit is not recorded. If you sign up through an email link (a confirmation or sign-in link), that link carries the same parameters, so the sign-up still counts when you open it in another browser or app. It does not affect your eligibility or anything else. Visitors in the EU/EEA (including its outermost regions), the UK (and its Crown Dependencies and Gibraltar) and Switzerland don't get this cookie, so their sign-ups are not attributed.

Note on your app's end users: when your app, running on infrastructure we provision for you, collects data from your customers, lavela handles that data as your processor under your instructions (see Section 1). This policy governs lavela's own collection from you; you are responsible for the privacy notice your app shows your end users. If you are an end user of a lavela customer's app and you contact us directly (for example, to access or delete your data), we will refer your request to that customer — the controller of your data — and assist them in responding, rather than acting on it ourselves.

---

3. How We Use Your Data

We use the data described above for the following purposes:

• To operate the Service — provision, configure, run, monitor, and tear down the infrastructure and operations you (or your AI agent) request; act as your agent for the delegated actions you authorize.
• To bill you — process top-ups (including automatic top-ups you turned on), deduct compute usage from your prepaid balance, grant, track and revoke promotional credit (the welcome credit and the card bonus), process refunds, charge the ~10% commission on the advertising spend in the ad account lavela set up for you, pass through other infrastructure costs (such as email and domains) at provider cost if we ever charge for them, and send low-balance and stop notices.
• For security and integrity — authenticate you, prevent fraud and abuse (including repeat or multi-account claims of the welcome credit or the card bonus, and payment disputes), enforce usage limits and consent gates, run security scans, and maintain the audit log of delegated actions.
• For support — respond to your requests, diagnose problems, and operate your account.
• For product operation and improvement — keep the Service reliable, understand aggregate usage, measure which of our campaign and referral links bring sign-ups (Section 2.9), and improve features.
• For legal and compliance — comply with applicable law, respond to lawful requests, and enforce our Terms.

We do not use your data to build advertising profiles, and we do not sell it. A user's own AI agent (such as Claude or Cursor) performs most in-conversation generation on the user's side; lavela's own AI use is limited to the server-side tasks described below (daily summaries, compliance-document drafts you request, and stack detection for repositories you connect).

Automated processing & AI

We use automated logic for provisioning, metering, billing, welcome-credit eligibility, and stopping servers when a balance runs out (after the notices and 48-hour grace period in the Terms, or — with a paid balance — sooner, once the unpaid amount passes the limit in Terms Section 7.1(2), or at once, without a grace period, in the other cases Section 7.1 lists; stopped servers and their data are kept until you delete them, except that an account that has used only the welcome credit has a stopped server's machine removed after a notice — Terms, Section 7.1(4) — and except on the older monthly card plan — Terms, Section 6.13). We also use a server-side AI provider (DeepSeek) to generate daily summaries (when turned on) from your project and operational data, to draft the compliance documents you ask for from the business details you enter for the draft (including the contact email you want the policy to show), and to detect the stack of a repository you connect from its package name, dependency list and which configuration files it has. These processes do not produce legal or similarly significant effects about you without a human-reviewable basis — the daily-brief and suggestion outputs are advisory, and billing, eligibility, and stopping follow the terms and timelines you agreed to, with the ability to reach a person at support@lavela.dev to review a decision or resolve a payment issue. The data sent to DeepSeek is limited to what the task requires (itemized in the DeepSeek row of Section 5): daily summaries and stack detection never include your account email or name, a compliance draft carries only what you enter for it, and we never send your payment details or your app's end-user data. What you control today: the daily summary is off until you turn it on (Settings → Notifications) and you can turn it off there at any time; a compliance draft is made only when you ask for one; stack detection may use DeepSeek when you analyze or launch a repository while signed in and lavela's own rules cannot tell the stack — there is no separate switch for that. If you object to any of this, write to legal@lavela.dev. See Section 7 for where DeepSeek processes this data.

Important: we take 0% of your sales (but we are the merchant for our own charges to you)

lavela charges no fee on your revenue. Your customers pay you directly through Stripe Connect; you are the merchant of record for your sales, funds settle to your account in full, and lavela is not a party to those transactions. We therefore do not process your end-customers' payment data for our own purposes.

Separately, for lavela's own charges to you (top-ups of your prepaid balance and the advertising commission), lavela is the merchant of record and Stripe processes those payments on our behalf — except top-ups you pay through Stripe's Link checkout, where lavela offers it: for those, Link (Link, LLC — Stripe's merchant-of-record service) sells you the credit and collects your name, email, billing address and payment details for that purchase as its own controller, under its own privacy policy (link.com/privacy); lavela receives the payment result, the amounts (credit and tax) and your billing country. Your card is held by Stripe, not by lavela (see Section 2.5). In other words: your sales are entirely yours (0%, you are the merchant, you settle in full); our charges to you are processed by Stripe with lavela as the merchant.

---

4. Legal Bases for Processing (GDPR / UK GDPR)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR (and UK GDPR):

Where we rely on legitimate interests, you have the right to object (see Section 9). Where we rely on consent, withdrawing it does not affect processing already carried out.

---

5. Subprocessors

We use the following service providers ("subprocessors") to run lavela. Each processes personal data only as needed for its function and under contractual data-protection terms. We may update this list as the Service evolves; material changes are reflected here (see Section 14).

If you are in the Republic of Korea, this table is also the overseas-transfer disclosure under the Personal Information Protection Act; it appears in Korean at the top of this page.

We may also use general business tools (such as our own email provider for support correspondence).

A current, dated subprocessor list is available on request at legal@lavela.dev. If you are an EU/UK controller of personal data we process for you, we give you advance notice of an intended new or replacement subprocessor by email to your account address, and you may object as the Terms (Section 9.5) describe.

---

6. How We Share Data

We share personal data only:

• With the subprocessors above, to run the Service.
• At your direction — when you ask us to connect or operate a third-party account (such as Stripe or an advertising platform), we exchange the data needed to perform that action with that provider, which then handles it under its own privacy policy.
• For legal reasons — to comply with law, enforce our Terms, or protect the rights, safety, and security of lavela, our users, or the public.
• In a business transfer — if lavela is involved in a merger, acquisition, or sale of assets, your data may transfer as part of that transaction, subject to this policy.

We do not sell your personal data, and we do not share it for cross-context behavioral advertising (see Section 10).

---

7. International Data Transfers

lavela uses providers that may process data in the United States and other countries, so your data may be transferred outside your home country, including from the EEA/UK to the United States. The recipients, their countries and the data each one receives are listed in Section 5; we send each provider only the data its function needs.

lavela's own platform data (your account, audit logs, consent records, and billing data) is primarily processed in the United States.

Transfer to China (DeepSeek). Our server-side AI provider, DeepSeek, is based in China, which is not covered by an EU adequacy decision. When we generate a daily summary, a compliance draft, or a stack detection, the data that task requires (the DeepSeek row of Section 5) is transferred to DeepSeek and may be processed outside the EEA and the US, including in China. DeepSeek processes it under its own terms and privacy policy, which we do not control. We limit what is sent to what the task requires (never your account email or name for a daily summary or stack detection, never your payment details or your app's end-user data), and what you can switch off is described in Section 3.

Transfers from the Republic of Korea. If you are in Korea, your personal data is transferred abroad to the recipients in Section 5 — each with its contact, country, the data, the purpose, the retention period, and how to refuse — over encrypted connections (TLS) whenever the Service needs it. The same disclosure is given in Korean at the top of this page.

EU regions. You or your agent can place a server run from an image, or a disk, in an EU region (Frankfurt, Amsterdam, Paris or Stockholm) when you create it; a server attached to a disk runs in that disk's region. A lavela Postgres database is created in the region the Neon row of Section 5 describes and stays there. lavela does not currently offer an EU-only data-residency setting: builds run in Tokyo, Japan, and servers built from a repository run there too unless they are attached to a disk you or your agent created in another region (see the Fly.io row of Section 5); one-off and scheduled jobs run next to their server, and the regions of the other subprocessors (Supabase, Vercel, Resend, Cloudflare R2, Sentry, Axiom, and DeepSeek) are set per provider. Contact legal@lavela.dev to discuss EU residency.

---

8. Data Retention

We keep personal data only as long as needed for the purposes in this policy:

• Account and project data — for as long as your account is active. After you close your account or request deletion, we delete or anonymize it within up to 90 days, except where we must keep it longer (see below).
• Audit logs of delegated actions — kept as a record of actions taken on your behalf (audit entries store hashes of payload content, plus identifying metadata) for up to 24 months; a project's entries are deleted when you delete that project, and the rest when your account is deleted.
• Billing and transaction records — including wallet, top-up, refund, and dispute records — retained as required by tax, accounting, and legal obligations (commonly several years).
• Welcome-credit hashes — the one-way email hash from Section 2.9 is kept for as long as we run the welcome-credit program, including after account closure, so the credit cannot be claimed again. It is not used for any other purpose.
• Card fingerprint — the one-way card-fingerprint hash and card type from Section 2.9 are kept while your account exists and for 12 months after it is deleted, and then deleted. We keep them after deletion so that deleting an account and registering again cannot be used to claim the card bonus a second time. They are not used for any other purpose.
• Stopped servers — when servers are stopped because a balance ran out, they and their data are kept until you delete them; lavela does not delete them automatically (see the Terms, Section 7) — with one exception: for an account that has used only the welcome credit, lavela removes the machine of a stopped server 7 days after it emails you, keeps that server's settings, built image and variables 30 more days, and then deletes them (Terms, Section 7.1(4)). An account still on the older monthly card plan follows that plan's schedule: after a failed monthly payment its servers are suspended, and deleted with their data 30 days after the failure if it stays unpaid (Terms, Section 6.13).
• Disks and their snapshots — a disk (persistent volume) is kept until you delete it or its project (the older monthly card plan follows its own schedule, above). Fly keeps a daily snapshot of each disk for up to 5 days. It is not a backup service, and lavela cannot restore a snapshot for you.
• What each delete removes — Deleting a project deletes its servers, its disks and their snapshots at once; this cannot be undone. Deleting a disk deletes it now; Fly keeps its daily snapshots for up to 5 days, which cannot be restored through lavela, and then deletes them. Deleting a server stops it being charged, and its own disk is lost; an attached volume (still billed), its daily snapshots and your managed databases stay until you delete them or the project. A server without an attached volume leaves no disk or snapshot behind.
• Managed databases — a lavela Postgres database (on Neon) is kept until you delete it; deleting a project keeps its databases unless the delete confirmation says they are deleted with it. lavela takes no backups of a database — the database provider keeps only a short point-in-time history, so take your own dumps. lavela no longer creates new managed Redis; one created earlier is kept until you delete it.
• Preview environments — a pull request's preview environment (its deployment, and a branch of your project's database that starts as a copy of it) is deleted when the pull request is closed, or about 72 hours after the pull request was opened or last pushed to (about an hour after a failed build); see the Terms, Section 7.5.
• Consent records — retained on an append-only basis for the life of your account (and a reasonable period afterward) so we have a durable record of what you agreed to and when. The card-saving consent record (the hash of the wording you were shown, the screen it appeared on and, where the box carries the agreement, that it was unticked when shown and that you ticked it — or which button you pressed —, the numbers shown, the time, and your IP address and browser information, Section 2.6) is kept as evidence in case of a dispute: when we delete your account, we erase the IP address and browser information in it as a step of that deletion, and the rest of that record (the hash of the wording, the time, and what you ticked or pressed) is kept for three years after your account is closed.
• Backups — automated backups of lavela's own database are encrypted and deleted after 30 days. A copy taken just before database maintenance is kept, access-restricted, by lavela's administrator until it is no longer needed for recovery.
• Logs — lavela's own log-like records are deleted on a fixed schedule: error reports after at most 30 days; security-scan results, ad-conversion records and payment-webhook receipts after at most 90 days; processed wallet-payment webhook receipts after 45 days; AI-usage records after 180 days; the audit log as above. Logs kept by our providers (such as Axiom, Vercel and Sentry) follow those providers' retention (Section 5).
• Campaign and referral source — the campaign-link cookie expires after 30 days (or is deleted once a new account records it); the source recorded with your account is kept while your account exists and deleted with it.

When we no longer need data, we delete it or irreversibly anonymize it.

---

9. Your Privacy Rights

Depending on where you live, you have rights over your personal data. lavela honors the following for all users:

• Access — get a copy of the personal data we hold about you.
• Export / portability — request an export of your account and project data in a portable, machine-readable format (see how to request it below).
• Correction — fix inaccurate or incomplete data.
• Deletion — ask us to delete your data (subject to the legal-retention exceptions in Section 8).
• Object / restrict — object to or restrict certain processing (for example, processing based on legitimate interests).
• Withdraw consent — where we rely on consent, withdraw it at any time.
• Non-discrimination — we will not deny you service or charge you differently for exercising your rights.

How to exercise your rights: email legal@lavela.dev. Every request is currently handled manually by our team; self-serve in-console controls for these rights are planned but not yet available. We will verify your identity (typically via your account email) and respond within the timeframe required by law — generally within 30 days (extendable where permitted). You may authorize an agent to act on your behalf, subject to verification. You also have the right to lodge a complaint with your local data protection authority; in the EEA you may contact your national supervisory authority, in the UK the Information Commissioner's Office (ICO), and in Korea the Personal Information Protection Commission (report center: privacy.kisa.or.kr, phone 118).

If you are an end user of a lavela customer's app, please direct your request to that customer (the controller of your data). If you contact us, we will refer your request to them and assist them in responding (see the end-user note in Section 2).

---

10. California Privacy (CCPA / CPRA)

If you are a California resident, you have the rights to know/access, delete, correct, and opt out of sale or sharing of your personal information, and the right not to be discriminated against for exercising them.

lavela does not "sell" your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. Because we do not sell or share, there is no "Do Not Sell or Share My Personal Information" action required — but you may still exercise your access, deletion, and correction rights using the methods in Section 9.

The categories of personal information we collect, the purposes, and the third parties we disclose to are described in Sections 2, 3, 5, and 6. We retain each category as described in Section 8.

---

11. Cookies and Analytics

We keep cookies and tracking to a minimum.

• Essential cookies — we use cookies that are strictly necessary to sign you in and keep your session secure (set by our authentication layer, Supabase). The Service does not work without these.
• Analytics — lavela's public homepage (console.lavela.dev/) and quick-start guide (console.lavela.dev/guide) count visits with Plausible, a privacy-friendly, cookie-free analytics service: it records the page, referrer (including a link's campaign parameters), browser and device type, and country, and does not store your IP address. The signed-in console and the sign-in, payment, and connection pages run no analytics script. You can block Plausible with your browser or an ad blocker without losing anything.
• Campaign-link cookie — when you open the homepage or the guide through a campaign link (one with utm_… parameters, for example from a creator's post), we set one first-party cookie, __Host-lv_attr, holding only those parameters, the page and the time, for up to 30 days. If you create an account in that time, it is recorded with your account once (Section 2.9) and the cookie is deleted. It is not used for advertising and not shared. Visitors in the EU/EEA, the UK and Switzerland (see Section 2.9) don't get it; you can also delete or block it in your browser at any time without losing anything.
• No advertising or cross-site tracking cookies — we do not use third-party ad-tracking or cross-context behavioral advertising cookies on lavela.

Note: any analytics on your own app (for example, the Plausible snippet we hand you for your site) is added by you/your agent to your app and is governed by your privacy notice — lavela never edits your code.

---

12. Children's Privacy

The Service is intended for adults who are operating a business: users must be at least 18 years old and at least the age of legal majority where they live (whichever is higher; see the Terms, Section 1.3). We do not knowingly provide the Service to, or collect personal data from, anyone below that age. If you believe someone below that age has given us personal data, contact legal@lavela.dev and we will delete it.

---

13. Security

We take reasonable and appropriate technical and organizational measures to protect your data, including:

• Encryption of data in transit (TLS) and at rest with our infrastructure providers.
• Scoped, least-privilege access — access to data and to the actions performed on your behalf is gated by per-scope authorization (for example, our provisioning scope refuses to act until your current consent is on file), and tenant data is isolated.
• Audit logging of the actions you or your agent ask us to take, so there is an accountable record of what was done for you.
• Secret handling — credentials and tokens are stored and brokered securely; card data is held by Stripe, not by lavela.
• Monitoring — error and security monitoring, plus security scans.

No system is perfectly secure. If we become aware of a personal-data breach, we will notify you and the relevant authorities where required by law and without undue delay.

Breaches affecting data we process on your behalf (processor duty). If we become aware of a personal-data breach affecting data we process on your behalf (your app's end-user data), we will notify you without undue delay, and in any event within 72 hours of confirming the breach, with the information you reasonably need to meet your own notification obligations (including your GDPR 72-hour clock to your supervisory authority and to affected individuals).

---

14. Changes to This Policy

We may update this Privacy Policy as the Service or the law evolves. When we make changes, we update the Last updated date at the top (and the policy version, for a change you must re-accept) and post the new policy.

• Every change applies to you from the time you accept the new version, except that a new subprocessor follows Sections 8.4 and 9.5 of the Terms instead: the current list is maintained in Section 5 of this Policy and in the Terms, and if you are an EU/UK controller you also get advance notice by email and a right to object.
• For material changes — especially any change that affects a processing activity based on your consent — we will require your active re-acceptance of the new version before the change applies to you. Our consent record tracks which version you accepted, so continued use alone is not treated as acceptance of a material, consent-based change.

---

15. Governing Law

This Privacy Policy is governed by the laws of the Province of British Columbia and the federal laws of Canada that apply there, without regard to conflict-of-laws rules, except where mandatory local data-protection law (such as the GDPR, the CCPA, or Korea's Personal Information Protection Act) applies to you.

Language. This policy is written in English. A Korean summary, including the overseas-transfer disclosure, appears at the top of this page; if it differs from the English text, the English text controls to the extent the law allows.

---

Contact Us

For privacy questions, to exercise your rights, or to request our subprocessor list or a data processing agreement:

• lavela
• Email: legal@lavela.dev
• Privacy officer (개인정보 보호책임자): Lavela, privacy team (개인정보 보호 담당) — legal@lavela.dev
• Postal address: Canada (mailing address available on request at legal@lavela.dev)