Privacy Policy

lAvArt is operated by LAS LEICESTER LTD, a company registered in England and Wales, number 15207933, based in Leicester, United Kingdom.

For questions about this policy, or to make any request described in it, email info@lavart.ai. A person reads that address.

This is the part most policies skip, and it decides everything below.

You, the studio. When you sign up, we decide what to collect and why. We are the controller of your account data.

Your clients. When you add a client and send them a quote, we hold their name, their email address and a record of when they opened your document — but we hold it because you asked us to, on your instructions. For that data you are the controller and we are your processor. Your client never signed up with us and, in most cases, has never heard of us. We treat that as a reason for restraint, not a loophole.

There is one honest exception, and we would rather write it here than have you find it: when you use AI drafting, your client’s name is included in the text we send our AI supplier (section 5). That was our design decision, not your instruction.

We do not use your clients’ details for anything except producing and delivering your documents. We never market to them, and we never contact them on our own account.

When you press Draft scope, Suggest line items or Polish, we send your brief to Anthropic’s Claude API. The text we send includes your practice name, the project title, the discipline and project type, the RIBA stages on your lines, the brief you typed — and your client’s name. Polishing also sends the scope text being polished, and your house-style note if you have set one.

Anthropic does not train its models on data submitted through its API. We do not train any model on your content, and we never will without asking you first, in plain terms, and letting you say no.

If you would rather your client’s name never left the platform, write the brief without it — the drafting works fine with “the client”.

Everyone on this list, and nobody else. Each is bound by its own contract with us to process data only on our instructions.

Our database and file storage are hosted by Supabase in Tokyo, Japan (AWS ap-northeast-1). Our web hosting and email delivery run in the United States and the European Union.

That means personal data is transferred outside the United Kingdom. The UK Government recognises Japan as providing an adequate level of data protection, so no additional safeguard is required for that transfer. Transfers to our other suppliers rely on the UK International Data Transfer Addendum in our contracts with them.

We would rather this data sat in the UK or the EU, and we intend to move it. When we do, this section will change and we will say so.

We set two cookies. Neither tracks you across other websites.

We use Vercel Web Analytics to count page views on this website and on the signed-in product. It sets no cookie and reads nothing from your device, which is why you are not being asked to consent to one — there is nothing stored on your equipment to consent to. It gives us aggregate counts, not profiles, and we rely on our legitimate interest in knowing whether the site works.

It is deliberately switched off on the pages your clients see. The quote and invoice links your clients open carry no analytics at all. Measuring someone who never signed up, on a page they were sent by you, is not ours to do.

We do not use advertising cookies, tracking pixels, or any third-party marketing tools.

A quote or invoice link contains a long random address. Anyone holding that address can open the document without signing in — that is the point of it, because your client should not need an account to read your quote. It cannot practically be guessed, and it is rate-limited against anyone trying.

It is not, however, a secret once you have sent it. Treat the link the way you would treat the PDF itself: a forwarded email forwards the access.

The rendered PDF is stored privately. Downloads go through a check on our side and are handed out as links that expire within a minute, so a quote link that has passed its Valid until date stops serving the document — including from an email sent months ago. Invoice links do not currently expire.

Your documents stay until you remove them. We do not delete a studio’s quotes or invoices on a schedule — they are your business records, and in most jurisdictions you are required to keep them for years.

AI prompts are cleared after about 90 days. The log of what we sent our AI supplier — which contains your brief and your client’s name — has its contents removed after roughly three months, leaving only the date, the type of request and the token count we need to apply your plan limits. We say “about” and “roughly” deliberately: the clearing runs off normal traffic rather than a timer, so on a quiet period a record can outlive the window by a while. We would rather describe that accurately than round it up into a promise.

Deleting your studio deletes everything. When you delete a studio from Settings, the clients, quotes, invoices, templates, saved blocks and stored PDFs go with it, and so does your account. We keep no backup copy to restore you from, which is the honest position rather than the comfortable one.

Under UK data protection law you can ask us to:

If one of your clients asks to be erased, email info@lavart.ai and we will do it by hand within 30 days. There is no button for it yet, and we would rather say so than ship one that quietly fails: a client named on a quote cannot simply be deleted, because the invoice that names them is your accounting record too. What we do instead is remove their identifying details and leave the figures intact.

If you think we have handled your data badly, please tell us first — but you have the right to complain to the Information Commissioner’s Office at any point, and you do not need our permission to do it.

Every studio’s data is separated inside the database itself, by rules the database enforces rather than by application code remembering to filter. Traffic runs over HTTPS and browsers are told to refuse anything else. Rendered PDFs are stored privately and reached only through links that expire within a minute. Our pages send a content-security policy that stops a script loading from anywhere but us, and refuse to be embedded in another site. Our PDF service can only reach a small set of destinations on the internet.

Your session cookie is not marked HttpOnly, and we would rather say so than let you assume otherwise. The library we use to keep you signed in reads that cookie from the page itself, so marking it would sign everyone out. It is marked Secure, so it never crosses an unencrypted connection.

Some of our server-side work necessarily runs with elevated database access, as any application’s does — sending an email on your behalf, or letting a client open a link they have no account for. Those paths are the ones we review hardest.

What we do not have: a security certification, an independent penetration test, or a formal incident-response accreditation. We are a small company and we would rather tell you that than imply otherwise. If you find a security problem, email info@lavart.ai and we will take it seriously and credit you if you would like.

lAvArt is a tool for professional practices. It is not intended for anyone under 18 and we do not knowingly hold data about children.

When this policy changes we update the date at the top. If a change materially affects how we handle your data — a new supplier, a new purpose, a new location — we will email you about it rather than quietly editing the page.