Privacy Policy

1. Information We Collect

1.1 Information You Provide Directly

• Account Information: We collect your name, email, password, and other details when you create an account.
• Payment Information: If you make purchases, we collect secure payment details via third-party providers.
• Communications: When you communicate with us, we may retain records of your interactions.

1.2 Information We Collect Automatically

• Usage Data: Includes access times, features used, and pages viewed.
• Device & Log Data: Includes IP, browser type, OS, and logs for security and performance.
• Cookies & Browser Storage: The Lodol app uses only the cookies and browser storage it needs to work: to keep you signed in, to keep your account secure, and to remember choices you make, such as your theme and how you've set up your lists. We don't use cookies for analytics or advertising, and we don't track you across other websites, so there is nothing to opt in to and no cookie banner. Our website, lodol.com, sets no cookies. If you choose to sign in with Google, Google may set its own cookies under Google's Privacy Policy. Clearing them in your browser signs you out of Lodol and resets your preferences.

1.3 Information from Third Parties

• Third-Party Integrations: When linking accounts like Google/GitHub, we may receive limited info.

2. How We Use Your Information

• To operate and improve the services
• To personalize your experience
• To ensure security and compliance
• To communicate with you
• To analyze performance and improve functionality

2.1 Legal Basis for Processing (for EU/UK Residents)

Where applicable, we process your personal information on the following legal bases:

• Your consent (e.g., for marketing communications)
• To perform a contract (e.g., to provide account access)
• Our legitimate interests (e.g., to secure and improve our services)
• To comply with legal obligations

3. How We Share Your Information

We do not sell your personal information.

We may share it:

• With trusted third-party service providers (subprocessors) who help us operate, improve, and secure our services. A current list of subprocessors is available on our Subprocessors page.
• For legal or security purposes.
• As part of a business transition, such as a merger, acquisition, or sale of assets.

4. Your Rights & Choices

You have the right to:

• Access and update your data
• Request a copy of your data
• Manage marketing preferences
• Request data deletion

You can download a copy of your data at any time from Settings › Privacy & Data in Lodol, and delete your account from Settings › Account & Security. Deleting your account deletes it and every workspace only you belong to. Workspaces you share with others keep what you made in them, and audit log entries that name you are kept for two years, as Data Retention & Security explains. For anything else, contact our Data Privacy Officer at privacy@lodol.com. We will respond to your requests in accordance with applicable laws.

Consent to receive marketing emails is entirely optional and not required to use our services. You can opt out at any time by unsubscribing from your user settings or contacting us directly.

We may need to verify your identity before fulfilling certain data requests. We aim to respond to all verified requests within 30 days (or as required by law). You will not be discriminated against for exercising your privacy rights.

If you are a California resident, you have the right to know what personal information we collect, use, disclose, and sell (we do not sell your data). You also have the right to request access to or deletion of your personal data. To submit a request, contact us at privacy@lodol.com.

We do not collect sensitive personal information as defined under the California Privacy Rights Act (CPRA).

5. Data Retention & Security

We retain your data for as long as necessary to provide our services, comply with legal obligations, resolve disputes, and enforce our agreements. The specific retention period may vary depending on the nature of the data and applicable legal requirements.

Audit logs: Each workspace keeps an audit log, a record of who did what in it, such as changing a workflow, connecting an app, or inviting someone. Each entry names the person who acted and, when the action concerned someone else, such as an invitation, records that person's email address. We also keep a record of account activity, such as signing up, signing in or trying to, resetting a password, downloading your data, or deleting an account. Each of these entries records the account or email address involved, the IP address the request came from, and the browser or app that sent it (its user agent). Only Lodol staff can see this record, except that your own account activity is included in the copy of your data you can download.

We keep each of these entries for two years, then delete it permanently. An entry stays for its full two years even if the account or workspace it relates to is deleted sooner, so the record of what happened stays complete for security and compliance. If a workspace sends its audit log to its own logging service, that copy is kept on that service's terms.

We implement appropriate technical and organizational measures to protect your data, including:

• Encryption in transit and at rest
• Access controls and authentication safeguards
• Regular security assessments and monitoring
• Employee training on data protection

While no system is completely secure, we continuously assess and improve our safeguards. You are responsible for maintaining the confidentiality of your credentials and notifying us of any unauthorized access.

If we become aware of a data breach that affects your personal information, we will notify you and applicable authorities without undue delay, as required by law.

6. International Data Transfers

Your information may be processed in the United States or other countries with different data protection laws.

While we do not currently implement formal cross-border transfer mechanisms (such as Standard Contractual Clauses), we take reasonable steps to ensure that your information is treated securely and in accordance with this Privacy Policy.

As we expand our operations, we intend to implement additional safeguards in accordance with applicable privacy regulations such as the GDPR and LGPD.

7. Children's Privacy

Our services are not intended for individuals under the age of 18. If we learn we've collected information from a minor, we will promptly delete such information.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Your continued use of the services after any updates constitutes your acceptance of those changes.

This policy is reviewed at least annually. A change log or previous versions are available upon request.

We will notify users of material changes via email or in-app notifications and update the "Last updated" date at the top of this policy.

9. Contact Us

If you have questions or concerns about this policy, please contact us at privacy@lodol.com.