Privacy Policy

Version 1.0 · Updated 10 July 2026 · EU General Data Protection Regulation (GDPR)

This policy describes how Luviamo (the “Service”) collects, uses, retains, and shares personal data. Luviamo is a marketing lifecycle platform for Nordic small and medium-sized businesses: ideation, planning, content creation, publishing, and analytics in a single application.

1. Data Controller

2. Personal data we process

We process the following data arising from use of the Service:

• User account: email address, name, password hash (unless you use OAuth-only sign-in), role, language preference, creation time.
• Organization: company name, business/VAT ID, subscription plan, and Stripe customer and subscription identifiers (no card data).
• Security log (audit log): actor, IP address, user agent, and action metadata. Purpose: abuse prevention and security (GDPR Art. 32).
• Newsletter subscribers (Messaging module): recipient email addresses and subscription status that your organization imports. These are your own contacts, which we process on your behalf.
• Sessions: refresh tokens in a temporary key–value store (KV) with time-based expiry.
• Media: images and media files you upload, stored in object storage (R2).

3. Purposes and legal bases

• Providing the Service (account, content creation, publishing, reporting) — legal basis: contract (Art. 6(1)(b)).
• Security and abuse prevention (audit log, rate limiting) — legitimate interest (6(1)(f)).
• Billing and subscription management — contract and legal obligation (accounting).
• Sending newsletters on your behalf — you act as the controller for your own contacts; Luviamo is the processor.

4. Google user data (Google Analytics 4 and Google Ads)

If you connect your own Google account, Luviamo reads your reporting data on a read-only basis. We never modify, create, or manage your accounts, campaigns, or settings.

What data is retrieved

• Google Analytics 4 (Data API): sessions, users, conversions, and traffic source breakdown. The Admin API is used to list properties so you can select the property to report on.
• Google Ads: campaign performance — impressions, clicks, cost, conversions, and conversion value. The account list is retrieved so you can select the account to report on.

How the data is used

The data is displayed back to the same user in their own analytics dashboard and PDF reports. It is not used for anything else and is not combined with other customers’ data (per-organization isolation).

Retention, sharing, and deletion

• Account-level aggregate metrics are stored in the organization database to provide the Service (trends, comparison). They are deleted when the organization account is deleted.
• Google data is not shared with any third party or with AI. This is verified in code: only a derived, de-identified numeric performance-index value is sent to AI — no raw data, account identifiers, source breakdown, or personal data.
• OAuth refresh tokens are stored encrypted with AES-256-GCM; they are never returned to the browser or written to logs. Access tokens are derived at fetch time and not stored.
• When you disconnect a channel, the integration and its tokens are deleted.

5. Meta data (Facebook and Instagram)

If you connect your Facebook Page and its linked Instagram Business account, we process for publishing purposes:

• Page access tokens: long-lived, stored encrypted with AES-256-GCM on the server; never sent to the browser or logs.
• Account information: Facebook Page ID and name, Instagram account ID and username, and an app-scoped user ID (for webhook mapping).
• Published content and its metadata (posts), which you publish on your own initiative.

When you remove the app from Facebook or request data deletion, Meta sends a signed request to our callback URL. We verify the signature (HMAC-SHA256) and delete the stored connection data (the encrypted Page access token and the account linkage). See data deletion.

6. AI (content creation)

We use Anthropic’s AI to assist with content creation. Only the following is sent to the AI:

• your own content-creation input (ideas, briefs, brand voice) that you provide; and
• a derived, de-identified numeric performance-index value for the analytics summary.

We do not send Google or Meta raw data, email addresses, access tokens, or account identifiers to the AI. The AI produces suggestions that the user reviews and edits; this is not automated decision-making producing legal effects within the meaning of GDPR Art. 22.

7. Subprocessors

We use the following subprocessors. A data processing agreement (DPA) under GDPR Art. 28 is in place with each — click a subprocessor's name to open its DPA. Transfers outside the EU/EEA are covered by the EU Standard Contractual Clauses (SCC).

8. Data location and transfers

Application data (database) and media files are stored on Cloudflare’s EU servers (Frankfurt, Germany). Some subprocessors (Anthropic, Stripe, Resend) operate outside the EU; those transfers are covered by the EU Standard Contractual Clauses (SCC).

9. Retention periods

10. Your rights

You have the rights under GDPR Art. 15–22: access, rectification, erasure, restriction, data portability, and objection.

• Access and portability: you can request a machine-readable export of your data; the download link is HMAC-protected and time-limited.
• Erasure: you can delete your account and organization; related data is deleted in a cascade. You can also disconnect any channel.
• Consent management: you manage your consents in settings.

To exercise your rights: tietosuoja@luviamo.app.

11. Security

Access tokens and sensitive identifiers are encrypted (AES-256-GCM); passwords are stored as hashes. Application secrets reside only on the server, never in the browser. Organizations’ data is isolated from one another through three-layer tenant isolation (query-level scoping, static analysis, and an integration test).

12. Cookies and analytics

The application itself (app.luviamo.app) uses only strictly necessary session tokens for sign-in.

This marketing website (luviamo.app) uses Google Analytics 4 for visitor analytics only if you consent in the cookie banner. Nothing is loaded before you make a choice. If you choose "Necessary only", no analytics are used at all. Your choice is stored in your browser's local storage (localStorage), and you can change it at any time via the Cookie settings link in the page footer.

When analytics is allowed, Google Analytics collects information about how the site is used (e.g. page views and visited pages) with IP anonymisation. The data is processed by Google Ireland Ltd; transfers are covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework.

13. Right to lodge a complaint

If you believe we process your data unlawfully, you may lodge a complaint with the supervisory authority: the Office of the Data Protection Ombudsman (tietosuoja.fi), Finland.

14. Luviamo’s own marketing communication (newsletter)

When you subscribe to Luviamo’s own newsletter from the marketing website (luviamo.app), Sunrise Software Oy acts as the controller — unlike our customers’ own newsletters, where Luviamo is a processor (see section 2).

• Data processed: your email address and subscription status (confirmed / unsubscribed), plus the confirmation timestamp and IP address as proof of consent.
• Purpose: product news, tips and Luviamo marketing.
• Legal basis: consent (GDPR Art. 6(1)(a)). Subscription uses double opt-in: you receive a confirmation link by email and are not added to the list until you confirm.
• Unsubscribe: you can unsubscribe at any time via the link at the bottom of every newsletter. It is immediate and requires no sign-in.
• Retention: your address is kept until you unsubscribe; after that, consent records are retained as evidence that the communication was permitted.
• Your rights (access, rectification, erasure, etc.) are as in section 10. Delivery is via the sub-processor Resend (section 7).

15. Changes to this policy

We may update this policy. Changes are published on this page; the “updated” date and version number indicate the latest version.