LOVA CObylovaco

Chapter 00 — Privacy

Privacy policy.

Last updated — 29 April 2026

In plain words

We use only the data you give us to run bylovaco. We do not sell your data, we do not run third-party advertising trackers, and we do not build advertising profiles about you. The marketing site uses first-party, cookieless analytics. The app uses essential cookies for sign-in only.

Who we are (the “data controller”)

Lova co Interiors Oy, a Finnish design studio registered in Helsinki. You can reach us at info@bylovaco.com for any privacy question, request, or complaint. The supervisory authority for personal-data complaints in Finland is Tietosuojavaltuutetun toimisto (the Finnish Data Protection Ombudsman).

What we collect, and why

We collect different data depending on how you use bylovaco. We list it all here in one table.

Marketing site visit

Cookieless first-party analytics: a per-tab session identifier (in sessionStorage, not a cookie), the pages you visit, the source you arrived from (UTM parameters in the URL), and the referrer your browser sends. No cross-device tracking, no advertising profile. Lawful basis: legitimate interest in operating the site.

Waitlist signup

Your email address, the source you signed up from, and (optionally) your country and the URL you arrived from. We use these to confirm your signup, send you the launch announcement, and segment our communications by interest. Lawful basis: your consent (the act of submitting the form).

App account

Your email address, name, country, and the design content you create inside the app — floor plans, mood boards, renders, item lists, project notes. Style DNA preferences are stored to personalise your moodboards and renders. Lawful basis: contract (we cannot deliver the service without this).

Payment

Payments are processed by Stripe Payments Europe Ltd. We do not see or store your full card number. We receive only a token, the last four digits, the card brand, and a billing receipt. Stripe’s privacy policy applies to the rest.

Operational logs & product analytics

When you use the app, we record the modules you open, the AI generations you run, your token usage, and any errors that occur. We use this to keep the service running, debug, and understand which features are useful. Lawful basis: legitimate interest in operating the service.

Who we share data with

We share data only with the processors we need to deliver the service. Each is bound by a Data Processing Agreement that meets EU standards.

  • Supabase — database and file storage. Servers in the EU.
  • Stripe — payment processing. Servers in the EU and US (Standard Contractual Clauses apply).
  • Klaviyo — waitlist and marketing email delivery. Only your email address and source.
  • Leonardo, RunwayML, Tripo3D, OpenAI — AI image, video, 3D, and text generation. Inputs you provide for a generation are sent to these providers and are subject to their respective data-handling commitments. We do not retain copies on these providers’ servers beyond what their APIs strictly require for the generation to complete.
  • Railway — application hosting.

We never sell your personal data. We do not share data with advertising networks.

Cookies and tracking

The marketing site uses no third-party tracking cookies and no advertising cookies. Our analytics are first-party, cookieless, and built on a per-tab session id stored in sessionStorage that is wiped when you close the tab. Because nothing we run on the marketing site requires consent under the EU ePrivacy Directive, we do not display a cookie banner.

The app sets essential cookies for sign-in and session continuity only. These are strictly necessary and exempt from consent under EU law.

How long we keep things

  • Waitlist email — until you unsubscribe, or until the launch is complete and we no longer need the list.
  • App account & project content — for the lifetime of your account. If you cancel your subscription, your data is preserved so you can resubscribe and pick up where you left off. If you ask us to delete your account, we erase your data and any backups age out within 30 days.
  • Operational logs — we keep usage logs indefinitely for product analytics. They are not used for marketing.
  • Payment records — we keep invoices for the period required by Finnish accounting law (currently six years).

Your rights under GDPR

You can ask us, at any time, to:

  • send you a copy of the personal data we hold about you (right of access);
  • correct any data that is wrong (right to rectification);
  • delete your account and all data we hold about you (right to erasure);
  • restrict how we process your data (right to restriction);
  • send your data to another service (right to portability);
  • object to processing based on legitimate interest (right to object);
  • withdraw any consent you previously gave at any time.

We respond within 30 days. To exercise any of these, write to info@bylovaco.com. If you are not satisfied with our response, you can complain to the Finnish Data Protection Ombudsman.

Children

bylovaco is not directed at children under sixteen. If you believe a child has provided us with personal data, please write to us and we will delete it.

International transfers

Some of our processors (Stripe, OpenAI, Leonardo, RunwayML) may process data outside the EU/EEA. Where this happens, we rely on the European Commission’s Standard Contractual Clauses or equivalent safeguards required by Article 46 of GDPR.

About AI-generated content

When you upload a photograph or write a prompt, we send that input to a third-party AI provider (Leonardo, RunwayML, Tripo3D, or OpenAI) so the generation can run. We do not knowingly send personal data identifying other people to these providers; please do not upload photos that identify other individuals. Generated outputs are stored on your account and are subject to the same retention rules as the rest of your project content.

Changes to this policy

If we update this policy in a way that materially affects you, we will email registered users and post a notice on the marketing site at least fourteen days before the change takes effect.

Lova co Interiors Oy — Helsinki, Finland