LAVANIO
Log inFind My Leaks

Privacy Notice

Financial data deserves careful handling. This notice explains what LAVANIO collects, why, who we share it with, how long we keep it, and the rights you have over it.

Last updated 13 August 2026

1. Who we are and our role

LAVANIO ("LAVANIO", "we", "us") provides the LAVANIO financial leak-detection software. For the personal data you provide when you create an account and use the Service, LAVANIO is the data controller — we decide what data is collected and why, and we are responsible for how it is handled. For payment data collected at checkout, our reseller Paddle.com acts as Merchant of Record and as controller of that payment data. Privacy questions can be sent to privacy@lavanio.com.

2. Personal data we collect and why

We collect only what we need to run the Service:
  • Account data — name, email address and login credentials (hashed): to create and secure your account, authenticate you and contact you about the Service.
  • Business profile data — business name, industry, size, revenue band, currency, location and focus areas: to tune the detection engine to your business.
  • Uploaded business data and extracted transactions — dates, descriptions, vendor or customer names, amounts, quantities, unit prices, hours, categories and reference numbers: to run the analysis you asked for and produce findings, action plans and recovery records.
  • Findings, action plans, recovery events and evidence files you attach: to provide the savings tracker and reporting features.
  • Support and assistant messages: to answer your questions and improve responses.
  • Usage, device and log data — including IP address, browser type, pages viewed and an audit log of significant actions such as running an analysis or deleting data: for security, fraud prevention, troubleshooting and product improvement.
  • Subscription records — plan, status, billing period and the Paddle customer and subscription identifiers: to grant the right level of access and show your billing history.

3. What we ask you not to upload

The Service does not need full bank account numbers, full card numbers, government identifiers or health data. Please remove them from your exports before uploading. If you do upload them, we will delete them on request.

4. Legal bases for processing

Where data protection law such as the UK/EU GDPR applies, we rely on:
  • Performance of a contract — to create your account, run analyses, produce findings and provide paid features you have subscribed to.
  • Legitimate interests — to keep the Service secure, prevent fraud and abuse, maintain audit logs, and improve the product; we balance these against your rights.
  • Legal obligation — to keep records we are required to keep and to respond to lawful requests from authorities.
  • Consent — for optional marketing emails, which you can withdraw at any time by unsubscribing.

5. AI processing

When you use the AI assistant or AI Autopilot, a summary of your findings — not your raw uploaded files — is sent to our AI model provider so it can explain findings and draft recovery plans and outreach messages. The provider processes this data on our instructions as a service provider and does not use it to train its models.

6. Who we share data with

We do not sell your data. We share it only with these categories of recipient:
  • Merchant of Record — Paddle.com, which handles the sale of our subscriptions, checkout, payments, subscription management, invoicing, tax compliance and refunds. Payment and billing details you enter at checkout are collected and processed by Paddle; we receive only your subscription status, plan, billing period and identifiers, and we never see or store your full card details.
  • Service providers and subprocessors — cloud hosting and database providers, our AI model provider and our transactional email provider, all bound by contract to process data only on our instructions.
  • Professional advisers — legal, accounting and audit advisers where necessary.
  • Authorities — where we are legally required to disclose data, or to protect our rights or the safety of others.
  • Successors — a buyer or successor entity in the event of a merger, acquisition or sale of assets, subject to this notice.

7. International transfers

Our providers may process data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses or an adequacy decision, so your data remains protected to an equivalent standard.

8. Retention

We keep data only as long as we need it:
  • Uploaded files, transactions, analyses, findings, action plans and assistant history: for as long as your account is active. You can delete all of it at any time from Settings — deletion is immediate and irreversible.
  • Account and business profile data: for the life of your account, then deleted or anonymised within 90 days of account closure.
  • Audit logs and security logs: up to 12 months, for security and fraud investigation.
  • Subscription and billing records: for as long as required by tax and accounting law (typically 6–7 years); Paddle keeps its own records as Merchant of Record.

9. Security

We apply technical and organisational measures appropriate to the sensitivity of financial data: encryption in transit (TLS) and at rest, row-level security in the database so records are readable only by the account that owns them, private storage buckets with signed short-lived links for evidence files, least-privilege access for our own systems, hashed credentials, and an audit log of significant account actions. No system is perfectly secure, so we also keep an incident response process and will notify you and any relevant authority where the law requires it.

10. Your rights

Subject to applicable law, you have the right to:
  • access the personal data we hold about you and receive a copy
  • have inaccurate data corrected
  • have your data erased — you can do this yourself from Settings, or ask us
  • restrict or object to processing based on our legitimate interests
  • receive your data in a portable format, including the CSV exports available in the app
  • withdraw consent for marketing at any time
  • complain to your data protection authority — in the UK the Information Commissioner's Office, or your local supervisory authority in the EEA

11. How to exercise your rights

Email privacy@lavanio.com. We will respond within one month, and will tell you if we need longer because a request is complex. We may need to verify your identity before acting on a request.

12. Cookies

We use strictly necessary cookies and local storage for sign-in sessions, security and remembering your theme preference — these are required for the app to work. Paddle sets its own cookies during checkout to process your payment and prevent fraud. We do not use advertising cookies. If we introduce analytics or marketing cookies, we will ask for your consent first and provide a way to manage your preferences.

13. Children

LAVANIO is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

14. Changes to this notice

We will update this notice when our practices change and will tell you in the app or by email about material changes before they take effect.

15. Not financial advice

Findings are statistical signals from the data you provide. They can include false positives and should be verified against your own records before you act on them.

Estimates are based on the data provided and are not financial, accounting, or legal advice. Verify material findings with your accountant or financial professional.