Privacy Policy

Last updated: 27 August 2026

Lavabase respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store and share information when you use the Lavabase mobile application, website and related services.

1. Who we are

Lavabase is operated by:

Lavabase LDA
N328 1776
Paredes de Cima
3740-125 Pessegueiro do Vouga
Portugal

Email: support@lavabase.io

Lavabase LDA is the data controller responsible for personal data processed through Lavabase.

2. Information we collect

The information we collect depends on how you use Lavabase and which features you choose to use.

Account information

When you create a Lavabase account, we collect:

• Your name
• Your email address
• Your password or authentication credentials
• Your internal account identifier

Passwords are protected using appropriate security measures and are not stored in readable form.

Third-party sign-in information

You may create or access your account using:

• Sign in with Apple
• Google
• Microsoft

When you use one of these services, we receive the information needed to authenticate your account. Depending on your choices and the provider’s settings, this may include your name, email address, provider account identifier and authentication token.

We do not receive the password for your Apple, Google or Microsoft account. These providers also process information under their own privacy policies.

Business and work information

When using Lavabase, you may choose to enter information such as:

• Business or trading details
• Customer or client names and contact details
• Project names, descriptions and related information
• Time entries, working hours, timers and work records
• Hourly rates and other billing information
• Invoice details, invoice numbers, amounts, currencies, payment terms and payment status
• Notes or descriptions associated with customers, projects, time entries or invoices
• Business logos, invoice assets and brand preferences
• Wellbeing, mood, break or working-limit information where those features are available

We process this information to provide the features you choose to use.

If you enter personal information relating to a customer, client or another person, you are responsible for ensuring you have an appropriate legal basis to use that information in Lavabase.

Bank information

Lavabase does not connect directly to your bank and does not use a third-party bank-data aggregator such as Plaid or TrueLayer.

If you choose to add bank information for display on invoices or for receiving payments, you may manually enter information including:

• Bank name
• Account number
• IBAN or equivalent account identifier
• Bank or branch sort code

Because this information can identify a financial account, it is treated as financial data and protected accordingly.

Lavabase does not use manually entered bank information to access your bank account, retrieve transactions or initiate payments.

Files and images

If you upload files or images, such as a business logo, we collect and store the uploaded content so that we can provide the relevant Lavabase feature.

You should only upload content you are entitled to use.

Subscription and payment information

If you purchase a Lavabase subscription or make a payment through Stripe, Stripe processes the payment information required to complete the transaction.

Lavabase may receive limited information from Stripe, such as:

• Your Stripe customer or subscription identifier
• The subscription plan selected
• Subscription and payment status
• Transaction dates
• Payment amount and currency
• Limited payment-method information, such as the card type and last four digits, where provided by Stripe
• Billing or payment failure information

Lavabase does not receive or store your complete payment-card number, card security code or full payment credentials.

Payments or subscriptions purchased through an app store may also be processed by the relevant app-store provider under its own terms and privacy policy.

Communications

If you contact us for support, submit a privacy request or provide feedback, we collect the information contained in your communication. This may include:

• Your name and email address
• The content of your message
• Files or screenshots you provide
• Information needed to investigate and respond to your request

Technical, diagnostic and security information

When you access Lavabase, we may automatically process limited technical information needed to operate, secure and maintain the service, including:

• Internet Protocol address
• Device type and operating system
• App version
• Dates and times of access
• Authentication and account events
• Error and diagnostic information
• Application performance information
• Security and infrastructure logs
• Information about whether app features are functioning correctly

Lavabase does not use advertising analytics, third-party marketing trackers or cross-app tracking.

3. How we collect information

We collect personal data:

• Directly from you when you register, enter information, upload content or contact us
• Through the Lavabase features you choose to use
• From Apple, Google or Microsoft when you use third-party sign-in
• From Stripe when you purchase or manage a subscription or payment
• Automatically through essential operational, security, performance and diagnostic processes

4. How we use your information

We use personal data to:

• Create, authenticate and administer your account
• Provide time-tracking, invoicing and related Lavabase features
• Store and display the information you enter
• Calculate billable amounts using tracked time and rates
• Create, store and manage invoices
• Display your payment details on invoices when you request this
• Store files and images that you upload
• Process and administer subscriptions
• Send invoices, account messages and essential service communications
• Synchronise your information between authorised devices
• Provide customer support and respond to enquiries
• Process privacy and account-deletion requests
• Maintain the security and integrity of Lavabase
• Detect, investigate and prevent fraud, misuse and unauthorised access
• Diagnose technical problems and improve reliability
• Comply with legal, accounting and regulatory obligations
• Establish, exercise or defend legal claims

We do not:

• Sell your personal data
• Share your personal data for third-party advertising
• Use advertising networks
• Track you across apps or websites owned by other companies
• Use your information to create advertising profiles
• Use artificial intelligence to process your Lavabase information

5. Legal bases for processing

Where the General Data Protection Regulation applies, we rely on the following legal bases.

Performance of a contract

We process information necessary to create and manage your account, provide the service, administer subscriptions and deliver the features you request.

Legitimate interests

We process limited information where necessary to operate, secure, maintain and improve Lavabase, prevent misuse and respond to support requests.

We only rely on legitimate interests where those interests are not overridden by your rights and freedoms.

Consent

We rely on consent where you choose to activate an optional feature that requires it or where consent is otherwise required by law.

You may withdraw consent at any time by contacting support@lavabase.io. Withdrawing consent does not affect processing that took place lawfully before consent was withdrawn.

Legal obligations

We may process or retain information where required to comply with applicable laws, accounting requirements, court orders or other legal obligations.

6. Service providers and data sharing

We disclose personal data only where necessary to operate Lavabase, provide a feature you request, comply with the law or protect our legal rights.

Microsoft Azure

Lavabase uses Microsoft Azure for hosting and technical infrastructure, including:

• Azure App Service
• Azure Key Vault
• Azure Virtual Network
• Azure Blob Storage
• Azure Application Insights

Microsoft may process hosting data, uploaded files, application logs, performance information, diagnostic information and other data required to provide this infrastructure.

Azure Blob Storage is used to store files and images uploaded to Lavabase.

Azure Application Insights is used for essential application monitoring, telemetry, diagnostics and performance management. It is not used for advertising or cross-app tracking.

MongoDB Atlas

Lavabase uses MongoDB Atlas as its database provider.

MongoDB Atlas may store and process account information and the business, project, time-tracking, invoicing and other information users enter into Lavabase.

Resend

Lavabase uses Resend to send transactional and service-related emails.

Resend may process:

• Recipient email addresses
• Sender information
• Email content
• Delivery status
• Technical information needed to deliver and secure emails

These communications may include account verification, password recovery, invoices, service notices, deletion confirmations and other essential messages.

Stripe

Lavabase uses Stripe to process subscriptions and payments.

When you make a payment through Stripe, Stripe processes payment and billing information under its own privacy policy. Lavabase receives only the information needed to confirm, administer and support the relevant transaction or subscription.

Authentication providers

If you use third-party sign-in, relevant authentication information is exchanged with:

• Apple
• Google
• Microsoft

These providers process information under their own privacy policies when providing their authentication services.

Professional advisers and legal disclosures

We may disclose information to professional advisers, regulators, courts, law-enforcement bodies or other authorities where reasonably necessary to:

• Comply with applicable law or a valid legal request
• Protect the rights, safety or property of Lavabase, our users or others
• Investigate fraud, security incidents or misuse
• Establish, exercise or defend legal claims
• Enforce our agreements

Business transfers

If Lavabase is involved in a merger, acquisition, restructuring, financing or sale of assets, personal data may be disclosed or transferred as part of that transaction.

Any recipient will remain subject to applicable data-protection requirements.

7. International data transfers

Lavabase is based in Portugal, but some service providers may process information in other countries.

Where personal data is transferred outside the European Economic Area, we use safeguards required by applicable data-protection law. These may include:

• An adequacy decision
• The European Commission’s Standard Contractual Clauses
• Supplementary technical and organisational safeguards
• Another legally recognised transfer mechanism

8. Data retention

We retain account information for as long as your Lavabase account remains active and as necessary to provide the service.

Information you enter or upload is generally retained until you remove it, request deletion of your account or it is no longer needed to provide the service.

Payment and subscription records may be retained for the periods required by tax, accounting, fraud-prevention and other applicable laws.

Support communications are retained for as long as reasonably necessary to resolve the enquiry, maintain an appropriate record and protect our legal rights.

Technical, diagnostic and security records are retained only for as long as reasonably necessary to maintain security, investigate incidents, resolve technical problems and comply with legal obligations.

Following an account-deletion request, we delete or anonymise personal data associated with the account unless:

• Retention is required by law
• The information is needed to complete an outstanding transaction
• The information is needed to resolve a dispute
• Retention is necessary to prevent fraud or misuse
• The information is required to establish, exercise or defend legal claims

Residual copies may remain temporarily in encrypted backups until those backups are overwritten through the normal backup cycle.

Information retained for legal reasons will be restricted from ordinary use and deleted or anonymised when the applicable retention requirement expires.

9. Account and data deletion

To request deletion of your Lavabase account and its associated personal data, email:

support@lavabase.io

Use the subject line Account deletion request and send the request from the email address associated with your Lavabase account wherever possible.

We may ask you to verify your identity before processing the request. This is intended to protect accounts against unauthorised or fraudulent deletion requests.

Once your identity has been verified, we will initiate deletion of your account and associated personal data, subject to the limited retention circumstances described in this Privacy Policy.

We will confirm when the deletion process has been completed or explain if any information must temporarily be retained for legal reasons.

Deleting the Lavabase app from your device does not delete your Lavabase account or the information stored in it.

If you used Sign in with Apple, Google or Microsoft, deleting your Lavabase account does not necessarily delete your separate account with that provider.

Deleting a Lavabase account does not automatically cancel a subscription administered separately by Apple, Google or another platform. You should cancel any active subscription through the platform on which it was purchased.

10. Your privacy choices

Depending on the features available, you may:

• Review or update your account information
• Edit or delete information you have entered
• Remove files or images you have uploaded
• Withdraw consent for optional processing
• Request deletion of your account by email
• Contact us to exercise your data-protection rights

11. Your data-protection rights

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete information
• Request deletion of your personal data
• Restrict how we process your personal data
• Object to processing based on legitimate interests
• Receive certain information in a portable format
• Withdraw consent at any time
• Lodge a complaint with a data-protection authority

To exercise these rights, contact support@lavabase.io.

We may ask you to verify your identity before completing a request. We will respond within the period required by applicable law.

If you are located in Portugal, you may lodge a complaint with the Portuguese data-protection authority:

Comissão Nacional de Proteção de Dados (CNPD)
Website: www.cnpd.pt

12. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration and disclosure.

These measures include, where appropriate:

• Secure authentication
• Access controls
• Network security controls
• Encryption in transit and at rest
• Protected credential and secret management
• Security logging and monitoring
• Restricted access to production systems

No electronic transmission or storage system is completely secure. Although we work to protect your information, we cannot guarantee absolute security.

You are responsible for keeping your login credentials confidential and notifying us if you believe your account has been accessed without permission.

13. Children’s privacy

Lavabase is not specifically directed at children.

We do not knowingly collect personal data from a child in circumstances where parental or guardian consent is legally required without obtaining the necessary consent.

If you believe that a child has provided personal data to Lavabase inappropriately, contact support@lavabase.io so that we can investigate and, where appropriate, delete the information.

14. Third-party links and services

Lavabase may contain links to or integrations with independently operated third-party services.

We are not responsible for the privacy practices of those third parties. We recommend reviewing the privacy policy of any external service before providing information to it.

15. Cookies and the Lavabase website

The Lavabase website may use cookies or similar technologies that are strictly necessary for security, functionality, session management and user preferences.

Lavabase does not use advertising cookies, marketing trackers or cookies intended to track users across unrelated websites.

If non-essential analytics or marketing technologies are introduced in the future, this Privacy Policy and any relevant cookie-consent controls will be updated before those technologies are used.

16. Changes to this Privacy Policy

We may update this Privacy Policy when our service, technology, providers or legal obligations change.

When we make material changes, we will provide reasonable notice through the app, website, email or another appropriate method.

The date at the beginning of this policy indicates when it was last updated. Where required by law, we will request consent before using personal data for a materially different purpose.

17. Contact us

For privacy questions, rights requests, account-deletion requests or complaints, contact:

Lavabase LDA
N328 1776
Paredes de Cima
3740-125 Pessegueiro do Vouga
Portugal

Email: support@lavabase.io