This Privacy Notice explains how Lafio ("we", "us", "our") collects, uses and protects your personal data when you use the Lafio app and website (the "Service"). Lafio is the data controller for the personal data described here.
1. Personal data we collect
- Account information — name, email address, password (stored as a secure hash), and profile preferences.
- Household content — chores, meal plans, grocery lists, expenses and other content you and your household members create in the Service.
- Usage and device data — pages viewed, features used, IP address, browser/device type, approximate location derived from IP.
- Support communications — messages and attachments you send when contacting support.
- Payment data — billing details are collected and processed directly by our payment provider Paddle. We receive only limited data such as the subscription status, plan, billing country and a customer reference.
2. How we use your data
- To create and operate your account and household.
- To provide the Service and the features you and your household use.
- To process subscriptions, invoicing and tax compliance (via Paddle).
- To respond to your support requests.
- To detect, prevent and respond to security incidents and fraud.
- To improve and develop the Service through aggregated, non-identifying analysis.
- To comply with legal obligations.
3. Legal bases (UK / EU GDPR)
- Contract — to provide the Service you've signed up for.
- Legitimate interests — to keep the Service secure, prevent abuse, and improve our product.
- Legal obligation — for tax, accounting and regulatory compliance.
- Consent — where required, for example for non-essential cookies or marketing communications. You can withdraw consent at any time.
4. Who we share data with
We share personal data only with the following categories of recipients:
- Hosting and infrastructure providers — to run our servers, database and file storage.
- Paddle (Merchant of Record) — for the sale of subscriptions, billing, payments, tax compliance and invoicing. See Paddle's Privacy Notice.
- Analytics and error-monitoring tools — to understand product usage and diagnose issues.
- Professional advisers — legal, accounting and similar professionals where necessary.
- Authorities — where required by law, court order or to protect our rights or those of others.
We do not sell your personal data.
5. International transfers
Some of our service providers may process personal data outside the UK or EEA. Where this happens, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or an adequacy decision.
6. Data retention
We keep your personal data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within a reasonable period, except where we need to retain it to meet legal, tax or accounting obligations, or to defend legal claims.
7. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you;
- Request correction of inaccurate data;
- Request deletion of your data;
- Restrict or object to certain processing;
- Receive a copy of your data in a portable format;
- Withdraw consent where we rely on it;
- Lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk.
To exercise these rights, email support@lafio.me. We will respond within one month.
8. Security
We use appropriate technical and organisational measures to protect your data, including encryption in transit, encrypted storage, access controls and routine backups. No system is perfectly secure — please use a strong, unique password and keep your account details private.
9. Cookies
We use a small number of essential cookies and similar technologies to keep you signed in and remember your preferences. We may also use analytics cookies to understand how the Service is used. Where required, we'll ask for your consent before setting non-essential cookies, and you can manage preferences in your browser at any time.
10. Children
The Service is not intended for children under 16. If you believe a child has provided personal data to us, contact support@lafio.me and we will take appropriate steps.
11. Changes to this Notice
We may update this Privacy Notice from time to time. If changes are material, we will notify you via the app or by email.
12. Contact
For privacy questions or to exercise your rights, contact us at support@lafio.me.