Privacy Policy

1. Important Overview & Our Core Privacy Principles

At Lovora, operated by [Business Entity Name Pending Registration — Operated by the Lovora Team] (“we”, “us”, or “our”), we treat your personal memories, messages, and photographs as strictly private.

2. Data Processors vs. Data Selling

To deliver our service reliably, we transmit data to specialized technical infrastructure providers (“Subprocessors”) such as cloud hosts, databases, and payment processors.

Clarification: Engaging these operational processors is strictly necessary to run Lovora and does not constitute the “sale” or commercial sharing of your personal data. Each processor is contractually and legally bound to process your data solely on our instructions and maintain industry-standard security.

3. What Information We Collect

A. Information You Provide as a Gift Creator

• Account Information: When you sign in using Google OAuth, we receive and store your email address, display name, Google account ID, and profile picture URL.
• Gift Customization Data: When building a gift surprise, you provide the recipient's name, sender's name, celebration birthdate, personalized messages (such as custom balloon notes and love letters), and template styling choices.
• Uploaded Photographs: You may choose to upload up to 5 images (maximum 5MB per image). Images are compressed in your browser, assigned random cryptographic identifiers, and stored in a private cloud storage bucket.

B. Transaction & Billing Data

• What We Store: We record your Razorpay order ID, payment ID, transaction amount in paise, timestamp, and credit balance.
• What We NEVER Store: We never see, collect, or store your credit/debit card numbers, CVV codes, bank login credentials, or UPI PINs. All financial details are entered directly into Razorpay Software Private Limited, an RBI-authorized PCI-DSS Level 1 compliant gateway.

C. Information Associated with Gift Recipients

Recipients are never required to create an account or disclose personal information to open and enjoy a gift. When a recipient loads a gift link, our server records only the anonymous view event, incrementing the gift's view counter and updating the last-opened timestamp visible to the gift creator.

For a “The Ask” date invitation we also store the recipient's answer (yes or no, the day, time and plan they picked, any idea of their own they typed, and how many times they tapped No) and when the link was first opened. We don't store their IP address or any other information about them with it. The answer and the first-opened time are shown only to the sender, in their dashboard, and are deleted together with the gift, whether it expires or the sender deletes it.

4. How Uploaded Photos & Assets Are Managed

• Private Storage: Your photos are hosted in a secure, private bucket on Supabase Storage (backed by Amazon Web Services).
• Cryptographic Filenames: File names are obfuscated with 128-bit UUIDs (e.g., [token]/[random-uuid].jpg) rather than sequential or predictable names.
• Signed URL Access: Direct public bucket access is prohibited. Photos are rendered using temporary, cryptographically signed URLs that expire after 1 hour.
• Creator Control: Creators can permanently delete their uploaded photos and the associated gift at any time from their dashboard.

5. 30-Day Retention & Permanent Deletion

Every gift created on Lovora has a strict retention lifecycle of 30 calendar days.

One exception: when the recipient of a “The Ask” date invitation picks a date further away than that, the gift and their answer are kept until the day after that date, and never longer than 90 days from creation, so the ticket still opens on the day.

Our automated cleanup routine executes daily to identify and purge expired gifts. When a gift expires:

1. All uploaded photos are permanently deleted from object storage.
2. The gift configuration, names, text, view counts and the recipient's answer are deleted from the database.
3. The unique gift link is invalidated and returns a 404 Not Found response.

Note: This deletion is permanent and cannot be reversed by our engineering team. We recommend creators and recipients save important photos locally before the 30-day window closes.

6. Gift Link Behavior & Visibility

Each gift is addressed by a cryptographically generated, unguessable 96-bit token (e.g. https://lovora.space/gift/a1b2c3d4e5f6...).

Access: Anyone in possession of the link can view the gift experience. You are responsible for sharing your link only with intended recipients.

Search Engines: All gift endpoints serve strict noindex, nofollow headers and are blocked in robots.txt to prevent search engine indexing.

7. Subprocessors & Technical Service Providers

We rely on the following trusted third-party service providers to deliver Lovora:

8. Security Measures

We implement defensive technical and organizational measures to safeguard your information:

• Encryption in Transit: All HTTP traffic is forced to HTTPS over TLS 1.3 with Strict-Transport-Security (HSTS).
• Database Row Level Security (RLS): Granular PostgreSQL security policies prevent cross-tenant access to gifts and account profiles.
• Rate Limiting & Burst Protection: All API routes are protected against brute-force attacks and abuse.
• Content Security Policy (CSP): Modern CSP headers protect against cross-site scripting (XSS) and unauthorized script injection.

9. Cookies & Local Storage

We do not use tracking or advertising cookies. We only use strictly necessary session cookies and local storage items required for service functionality:

• sb-*-auth-token: Essential session cookie issued by Supabase to keep you securely signed in to your creator account.
• lovora_auth_return: Browser local storage value that redirects you back to your gift creation draft after Google authentication.
• lovora_draft_*: Local storage cache that auto-saves your in-progress gift customizations on your device so your work is preserved if your browser closes.

For detailed information, please review our dedicated Cookie Policy.

10. Your Rights & Data Control

Depending on your jurisdiction, you possess the following rights regarding your personal information:

• Right to Access: You can view all gifts and credit balances associated with your account in your Dashboard.
• Right to Deletion (Right to be Forgotten): You can delete individual gifts directly from your dashboard. You may also request complete account deletion by emailing us at lovora.space@gmail.com.
• Right to Rectification: You can update draft details prior to publishing.
• Withdrawal of Consent: You can revoke Google OAuth permissions at any time via your Google Account Security settings.

11. Legal Compulsion & Law Enforcement

We will only disclose stored user information to law enforcement or governmental authorities if required to do so by a valid, binding court order, subpoena, or legal directive issued under the applicable laws of the Republic of India. We scrutinize all legal requests for validity and jurisdictional propriety.

12. Contact Information & Grievance Officer

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our team:

• Email: lovora.space@gmail.com
• Response Target: Within 24 to 48 business hours
• Grievance Redressal: For statutory concerns under the Information Technology Rules, visit our Grievance Redressal Page.