This policy explains what personal information Lunvero collects, why, and how it’s handled. Lunvero is operated by Charlie & Co., operating as Lunvero, of 5204 Easton Rd, Burlington, Ontario, Canada, and is committed to handling personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario law.
1. Who this policy covers
This policy covers two kinds of people: business owners and staff who sign up for and use Lunvero (“Workspace users”), and the clients of those businesses who interact with quotes, invoices, or a client portal generated by a Workspace (“End clients”). If you are an End client, the business that invoiced you is the one that decides what information about you is entered into Lunvero — contact them directly about their use of your information, or contact us at [email protected] and we will direct your request appropriately.
2. Information we collect
Account and Workspace information: your name, email address, and business details you provide when creating a Workspace.
Client and business records you enter: client names, contact details, addresses, and the quotes, invoices, payment records, time entries, and expenses you create in your Workspace. This is Your Content under our Terms of Use; we process it on your behalf to provide the Service.
Payment information: your subscription payment method is collected and stored directly by Stripe, not by us — we never see or store full card numbers. When you connect your own Stripe account to collect from your clients, Stripe similarly handles that payment information directly.
Usage and device information: log data such as IP address, browser type, and pages visited, collected automatically when you use the Service or our marketing site, including through Google Analytics (see Section 5).
Support messages: anything you send us through the Support page or by email, including your name, email address, and message content.
3. How we use information
- To create and operate your Workspace, including generating invoices, quotes, and reports;
- To process subscription billing and communicate about your account;
- To send transactional email on your behalf to your clients (invoice and quote notices, payment receipts, reminders) through our email provider;
- To provide customer support;
- To detect, prevent, and address fraud, abuse, or security issues; and
- To understand aggregate usage of the Service and improve it.
We do not sell personal information, and we do not use the business or client data you enter into your Workspace to advertise to you or to third parties.
4. Multi-tenant data isolation
Lunvero is built so that each Workspace’s data is isolated at the database level and is not accessible to other Workspaces. Lunvero platform staff do not access Workspace content except as needed to provide support you request, investigate a security issue, or comply with law.
5. Cookies and analytics
We use Auth0 session cookies to keep you signed in, and Google Analytics to understand traffic to our marketing pages and application, which sets its own cookies and receives your IP address and browsing activity on our site. You can block or clear cookies in your browser settings, though this may affect your ability to stay signed in.
6. Who we share information with
We share information with service providers who help us operate Lunvero, including:
- Stripe — subscription billing, and payment processing for any Workspace that connects its own Stripe account;
- Auth0 — authentication and sign-in;
- Brevo — sending transactional email (invoices, quotes, reminders, receipts, support replies);
- Google Analytics — site usage analytics;
- DigitalOcean — application hosting; and
- Cloudflare — content delivery and security filtering for our domains.
Each of these providers processes information under its own privacy terms and only for the purpose of providing their service to us. We may also disclose information if required by law, to protect the rights and safety of Lunvero or others, or in connection with a merger, acquisition, or sale of assets, with notice to affected users where required.
7. Data retention
We retain Workspace data for as long as your subscription is active and for a reasonable period after cancellation in case you resume service or as needed for legitimate business, tax, or legal purposes. You can request deletion of your Workspace data by contacting [email protected], subject to records we are required to retain by law (for example, financial records relevant to tax obligations).
8. Data security
We use encryption in transit (TLS) for all traffic to the Service, database-level access controls that isolate each Workspace’s data, and restrict administrative access to platform credentials. No system is completely secure, and we cannot guarantee absolute security of information transmitted to or stored by the Service. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and report the breach to the Office of the Privacy Commissioner of Canada, as required by PIPEDA.
9. Your rights and choices
Subject to applicable law, you may request access to, correction of, or deletion of personal information we hold about you, or withdraw consent you previously gave for us to collect, use, or disclose it, by contacting [email protected]. Withdrawing consent may limit our ability to provide the Service and may not apply retroactively or to information we are required to retain by law. If you are a Workspace user, you can update most account and business information directly in your Workspace settings. We do not currently offer a fully self-serve data export tool; requests for a copy of your data can be made through support and will be fulfilled within a reasonable time.
If you are not satisfied with how we’ve handled your personal information, you may file a complaint with our Privacy Officer at [email protected], or with the Office of the Privacy Commissioner of Canada at priv.gc.ca.
10. International data transfers
Lunvero and its service providers may process and store information outside of the province or country where you or your clients are located, including in the United States (where several of our providers operate infrastructure). We take steps to ensure appropriate protection for information transferred in this way, consistent with PIPEDA.
11. Children’s privacy
The Service is intended for business use and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children.
12. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, such as by email or an in-product notice, before the changes take effect.
13. Contact
Questions about this policy or your information, or requests to exercise the rights described in Section 9, can be sent to our Privacy Officer at [email protected] or through our Support page.