Privacy Policy

Loviso Ltd, a company registered in England and Wales, is the data controller for the personal data described in this policy. You can contact our privacy team at support@myloviso.com.

We only collect what we need to run Loviso for you. That falls into four groups:

• Account data — your name, email address, hashed password (or social sign-in identifier), profile photo, language and time zone.
• Keepsake content — photos, audio recordings, video, handwritten notes, written stories, contributor names and any messages family members send inside a keepsake. This is the material you upload; it belongs to you.
• Billing data — plan, invoice history, VAT status, billing address and the last four digits of your payment card. Full card numbers are handled by our payment processor and never stored by Loviso.
• Technical data — device type, browser, IP address, approximate location derived from IP, timestamps, referring pages, error logs and a small number of privacy-friendly analytics events.

We use your personal data for the following purposes:

• To create your account, deliver your keepsakes and provide the Service.
• To process payments, prevent fraud and comply with tax obligations.
• To let you invite and collaborate with the people you choose.
• To send essential service messages (invoices, security alerts, changes to these terms).
• To send product updates and marketing — only where you have opted in — which you can unsubscribe from at any time.
• To keep the Service secure, diagnose faults and improve performance.
• To meet legal and regulatory obligations.

We do not sell your personal data. We do not use your keepsake content to train machine-learning models. We do not run behavioural advertising on Loviso.

• Contract — providing the Service, processing payments and delivering keepsakes you have asked for.
• Legitimate interests — keeping Loviso secure, preventing abuse, understanding how the Service is used and communicating important service updates.
• Consent — optional marketing emails, optional analytics cookies and any special-category data you choose to include in a keepsake (for example, information about a person's health or religion in a tribute).
• Legal obligation — bookkeeping, tax records and responding to lawful requests.

We use a small number of first-party cookies that are strictly necessary to keep you signed in and to remember your preferences. With your consent we also use privacy-friendly analytics to understand which pages help people and which don't. You can change your cookie choices at any time from the cookie banner or your browser settings.

The only people who see your keepsakes are you and the family or friends you invite. Nobody at Loviso reads your keepsakes for any reason other than to help you when you ask, or where required by law.

We share limited personal data with the following categories of trusted processors:

• Cloud infrastructure and database hosting (encrypted at rest and in transit).
• Payment processing (card details go directly to the processor).
• Transactional email delivery (for invoices, invitations and security alerts).
• Error monitoring and privacy-friendly product analytics.
• Customer support tooling, when you contact us.

Each processor is bound by a written data-processing agreement and is only permitted to use the data to provide the service we have contracted them for. We may also disclose personal data where we are legally required to (for example, in response to a valid court order) or to protect the rights and safety of Loviso and its users.

Loviso is based in the United Kingdom. Some of our processors are located in the European Economic Area, the United States and other countries. When we transfer personal data outside the UK/EEA we rely on appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses or adequacy decisions.

• Keepsake content — kept for as long as your account or one-time keepsake is active. When you delete a keepsake it is removed from the Service within 30 days and from encrypted backups within a further 30 days.
• Account data — kept until you close your account, then deleted or anonymised within 90 days, subject to legal retention (e.g. tax records held for up to 7 years).
• Support and security logs — kept for up to 24 months to help us protect the Service.

We use encryption in transit (TLS) and at rest for keepsake content, hashed passwords, role-based access controls, audit logging, regular vulnerability scanning and least-privilege access for our team. Only a small number of trained staff can access production systems, and never keepsake content itself except to help you when you ask.

Depending on where you live, you may have the right to:

• access the personal data we hold about you;
• correct data that is wrong or out of date;
• delete your data (subject to a few legal exceptions);
• export your data in a portable format;
• restrict or object to certain processing;
• withdraw consent at any time, without affecting past processing;
• lodge a complaint with your local data-protection regulator (in the UK, the ICO at ico.org.uk).

You can exercise most of these rights directly from your account settings, or by emailing support@myloviso.com. We respond within one month.

Loviso is not intended for children under 16 to hold their own account. Parents and guardians may of course include children in a keepsake — for example a Baby Story — and are responsible for the material they choose to upload.

Your keepsakes are designed to outlast you. You can nominate a trusted contact in your account settings who can request access to your keepsakes if you pass away, subject to appropriate verification. Contact support@myloviso.com for legacy requests.

If we make material changes to this policy we will let you know by email or through the Service before they take effect. Older versions are kept for reference and are available on request.

For any privacy question, please email support@myloviso.com. You can also review our Terms of Service or reach the wider team via the Contact page.