Privacy Policy

1. Information we collect

• Account information: your email address, display name, and a securely hashed password. We never store your password in plain text.
• Your Content: the files you upload (e.g. license certificates and related documents) and the metadata you enter (project names, client names you choose to add, license details). Please do not upload personal data about others that you have no right to store.
• Provider connections (optional): if you connect a provider via official OAuth, we store access/refresh tokens encrypted. We never ask for or store your provider password or session cookies, and we do not browse your provider account beyond the authorised, scoped API calls you initiate.
• Payment information: processed by Stripe. We receive limited billing details (such as subscription status and card brand/last four) but do not store full card numbers.
• Usage and log data: basic technical data such as IP address, device/browser type, timestamps, and actions taken, used for security, debugging, and operating the Service.
• Cookies: a strictly necessary session cookie keeps you signed in. We keep non-essential tracking to a minimum.

2. How we use information

We use your information to: provide and operate the Service (store and organise your evidence, generate records and exports); authenticate you and secure the Service; process payments and manage subscriptions; provide support; comply with law; and improve reliability. We process your information to perform our contract with you, to pursue our legitimate interest in operating and securing the Service, and to meet legal obligations.

3. We do not sell your data

We do not sell your personal information or Your Content, and we do not share it for cross-context behavioural advertising. We do not use Your Content to train AI models.

4. Sharing and sub-processors

We share information only with service providers that help us run Licavio, under contract and only as needed: application hosting, database, and durable file storage (Railway); payments (Stripe); and, where enabled, an AI provider (Anthropic) that extracts fields from a document you submit. (We are adding dedicated object storage and offsite backups — see Security below.) We may also disclose information if required by law or to protect rights, safety, and the integrity of the Service, and in connection with a merger or acquisition (with notice where required).

5. Storage, location, and international transfer

Licavio is operated from Japan, and your information (including Your Content) is stored with the providers above, which may be located in the United States or another selected region. If you access the Service from elsewhere, you consent to the transfer of your information across borders, including to Japan and the provider regions, which may have different data-protection laws than your own.

6. Retention

We keep your information while your account is active and as needed to provide the Service. You can delete Your Content or your account at any time; we will delete or de-identify your personal information within a reasonable period after account deletion, except where we must retain limited records to comply with law, resolve disputes, or enforce our agreements. When offsite backups are in place (see Security), they are rotated and expire on a schedule.

7. Security

We use reasonable technical and organisational measures, including encryption in transit, encryption of provider tokens at rest, integrity hashing (SHA-256) of stored evidence, access controls, and durable disk storage that persists across deployments. We are in the process of adding dedicated object storage with versioning and independent offsite backups. No method of storage or transmission is completely secure, so we cannot guarantee absolute security, and you should keep your own backups of documents that matter to you.

8. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, and to object to or restrict certain processing. You can export your workspace data in-app. To delete your account, your content, or specific personal information, contact us and we will verify and process your request (deletion is currently handled on request).

• California (CCPA/CPRA): you have the right to know, access, delete, and correct your personal information, and not to be discriminated against for exercising these rights. We do not sell or “share” (as defined by the CPRA) your personal information.
• UK / EU / Canada / Australia: where those laws apply, you may have equivalent rights (access, rectification, erasure, portability, objection) and the right to lodge a complaint with your local authority.

We will verify requests and respond within the timeframe required by applicable law.

9. Children

The Service is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal information from children.

10. Changes to this policy

We may update this policy. For material changes we will provide reasonable notice (e.g. by email or in-app). The “Last updated” date reflects the latest version.