Privacy Policy

1. Who is responsible for your data

“Lavenity” is a live-chat widget for websites and a shared inbox for teams.

Lavenity is operated by Myroslava Ihorivna Bachynska (Бачинська Мирослава Ігорівна), registered in Ukraine as an individual entrepreneur, who is the controller of the personal data described here.

Data protection contact: privacy{'@'}lavenity.com.

2. Two roles: controller and processor

For visitors of our own sites and for operator accounts we are the controller — we determine the purposes of processing; this is governed by this Policy.

For the messages and data of end visitors who write in the chat on a customer's website, we act as a processor — on the customer's instructions, with the customer being the controller. That processing is governed by our agreement and Data Processing Agreement with the customer, as well as the customer's own privacy policy.

3. What data we process

As a controller we process:

• Operator account data: name, email, role, workspace identifier. Authentication is handled by Supabase; we do not store passwords in plain text.
• Technical usage data: IP address, device and browser type, timestamps and activity logs — for security and diagnostics.
• Marketing-site data: enquiries, waitlist email and, with consent, analytics.

4. Purposes and legal bases (Art. 6 GDPR)

• Providing the service and account access — performance of a contract.
• Security, abuse prevention, logging — legitimate interest.
• Service communications — performance of a contract or legitimate interest.
• Newsletters and optional analytics/cookies — your consent (withdrawable at any time).
• Compliance with legal obligations (taxes, authority requests) — legal obligation.

5. Who we share data with

We rely on vetted providers that act on our instructions:

• Supabase — operator authentication.
• Hetzner — hosting and databases (EU).
• Email provider — transactional emails.
• Paddle — Merchant of Record: payment, invoicing and refunds. Paddle receives the buyer's name, email address and payment details under its own privacy policy.
• Analytics (with consent) — site statistics.

6. International transfers

Where data is transferred outside the EEA or Ukraine, we apply appropriate safeguards — Standard Contractual Clauses (SCC) and/or adequacy decisions, together with encryption.

7. How long we keep data

We keep data no longer than necessary for the stated purposes: account data — while the account is active and a reasonable period after closure; security logs — for a limited time; marketing data — until consent is withdrawn. After that, data is deleted or anonymised.

Billing, invoice and tax records are kept for as long as tax and accounting law requires, independently of when an account is closed.

8. Security

We use transport encryption (TLS), role-based access control, iframe isolation of the chat, signed tokens, a strict CSP and rate limiting. No system is perfectly secure, but we apply reasonable technical and organisational measures (Art. 32 GDPR).

9. Your rights

Under the GDPR and Ukrainian law you have the right to:

• access your data and obtain a copy;
• rectify inaccurate data;
• erasure (the “right to be forgotten”);
• restrict and object to processing;
• data portability;
• withdraw consent at any time.

10. Cookies

We use necessary cookies, and optional ones only with your consent. See the “Cookies” page for details.

11. Children

The service is not intended for persons under 16; we do not knowingly collect their data.

12. Complaints to a supervisory authority

You may lodge a complaint with a supervisory authority: in Ukraine — the Ukrainian Parliament Commissioner for Human Rights; in the EU/EEA — the data protection authority of your country of residence or work.

13. Changes to this Policy

We may update this Policy; we will notify you of material changes on the site or by email. The current version is always available on this page.

Contact

Privacy questions: privacy@lavenity.com

Billing and support: support@lavenity.com