Privacy Policy

This privacy notice tells you what to expect us to do with your personal information.

Contents

1. Contact details
2. What information we collect, use, and why
3. Lawful bases and data protection rights
4. Where we get personal information from
5. How long we keep information
6. Who we share information with
7. Sharing information outside the UK
8. Deleting your account
9. How we check content
10. How to complain

1. Contact details

1a. Post

Lyven Ltd, Silverstream House 4th Floor, 45 Fitzroy Street, Fitzrovia, London, W1T 6EB

1b. Email

privacy@lyven.app

2. What information we collect, use, and why

We collect or use the following information to provide services and goods, including delivery:

• Names and contact details
• Date of birth
• Account information
• Photographs or video recordings
• Messages and posted content
• Activity in the app
• Approximate location

We collect or use the following information for the operation of customer accounts and guarantees:

• Names and contact details
• Account information, including registration details
• Information used for security purposes
• Device information

We collect or use the following information to prevent, detect, investigate or prosecute crimes:

• Names and contact information
• Customer or client accounts and records
• Posted content and reports about it
• Device identifiers and verified phone numbers

We collect or use the following information for service updates or marketing purposes:

• Names and contact details

We collect or use the following information to comply with legal requirements:

• Name
• Contact information
• Any other personal information required to comply with legal obligations

We collect or use the following personal information for dealing with queries, complaints or claims:

• Names and contact details
• Account information
• Correspondence
• Device information

We collect or use the following information to understand how the app is used and to find and fix faults:

• Activity in the app
• Approximate location
• Device information
• Error and crash reports

2a. People under 18

Lyven is for people aged 18 and over. We do not knowingly collect information from anyone under 18, and we delete it if we find it.

2b. Sensitive information

We do not ask for sensitive information, such as information about health, religion or sexual orientation, and we do not use it to treat anyone differently. People may choose to share it in their profile, posts or messages.

3. Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

• Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
• Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
• Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.
• Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
• Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

3a. Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide services and goods are:

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information for the operation of customer accounts and guarantees are:

• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Keeping accounts secure. Sign-in information is used to check that the person signing in is the account holder, and every request is checked to make sure it comes from a genuine copy of the app. This protects account holders from someone else getting into their account. The impact on people is low, because the information is used only for this and is not shared with anyone beyond the services that run sign-in. If you choose to verify a phone number, Firebase, a Google service in the United States, sends you a code by text. We keep only a scrambled version of the number, so that one number verifies one account at a time, and delete it if you verify a different number or someone else verifies yours. Other people can see that your account verified a number, but the number itself is never shared.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information to prevent, detect, investigate or prosecute crimes are:

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Keeping the service safe. Posts, comments and profiles are checked against our community guidelines, reports are reviewed, and accounts that break the rules are banned and prevented from returning. When you sign in, a scrambled version of your device’s identifier is checked against our ban list and kept with your account, so that a ban can be enforced. This protects people from harmful or illegal content and behaviour. The impact on people is limited: private messages are not checked automatically and are read by a person only when a message or the person who sent it is reported, flagged posts and comments are reviewed by a person, and the ban list holds email addresses, device identifiers and phone numbers only in a scrambled form. A phone number you verify is checked against the ban list in the same way as your device. To stop verification texts being abused, we also keep a scrambled record of each number a code is sent to. The record is not linked to any account and is deleted within about a day.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information for service updates or marketing purposes are:

• Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Our lawful bases for collecting or using personal information for legal requirements are:

• Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Answering questions and fixing problems. The details sent with a request, along with device and app version information, are used to reply and to find and fix faults. This benefits the person asking and makes the app more reliable for everyone. When you report a bug from inside the app, you choose whether to give us an email address to reply to. The description you write is sent to OpenAI to help us triage reports. The impact on people is low, because the information is limited to what is needed to handle the request.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for collecting or using personal information to understand how the app is used and to find and fix faults are:

• Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • Understanding how the app is used. We collect statistics about which screens and features are used and where people give up, so that we can improve the app. The statistics are not linked to you. If you would rather they were not collected, contact us using the details at the top of this notice and we will turn them off for your account.
  • Finding and fixing faults. When the app crashes or something goes wrong, a report is sent to us with the app version and the type of device, so that we can fix it. The report does not include your name, email address or anything you have written.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

4. Where we get personal information from

• Directly from you
• Apple or Google when someone signs in with their account.
• Other people who use the service, when they report an account or content.

5. How long we keep information

We keep your information for as long as your account is open.

5a. When you delete your account

We delete your information straight away, apart from:

• A safety copy. For 30 days, we keep a copy of what other people could see: your profile, photos, username, email, posts, comments and connections, and the scrambled records of your devices and any verified phone number, so that a ban can still stop your account returning. We use it only to investigate harmful behaviour and to answer lawful requests, such as from the police, and then delete it. We keep the copy for one year instead if we banned your account, or if, when you deleted it, a report had been made about you in the last 12 months or content of yours was being held for review. We need the copy to answer appeals and police requests. If we report your account to the police or the National Crime Agency, we keep the copy for a year from the date of the report, even if that is more than a year after you deleted your account. For some reports, the law requires this. We may also keep a copy for a year if we find out about harmful behaviour during the 30 days.
• Private messages. These stay readable to the other person in the chat until they delete their account too. If we banned your account, or you deleted it while under report or review, we also keep your chats for one year: everything you and the other person sent to each other, including photos and messages that were later unsent. Your messages to someone else are kept in the same way if we banned them, or they deleted their account while under report or review, so that we can answer lawful requests about them.
• Backups. Deleted information can stay in our backups for up to 7 days, until they expire.

5b. Information we keep for set periods

Some information is kept for a fixed time, whether or not you delete your account:

• Reports, and copies of content we removed: at least 12 months, and longer only if the case is still unresolved.
• Messages to us: if you contacted us through our website, one of our contact forms or a bug report from inside the app, we keep your message for at least 12 months, and longer only if it is still unresolved.
• Banned accounts: a scrambled record of the account's email and devices, for as long as we need it to stop the account returning. A verified phone number is kept the same way, but for two years only, since numbers can be passed on to new owners.
• Verification texts: a scrambled record of each number a code is sent to, with a count of codes sent, for a day from the first text, then deleted within about a day. It is not linked to your account.
• Links you shared: until they have gone unused for 6 months.
• Usage information and crash reports: up to 14 months for usage information, and up to 90 days for crash reports.
• Server logs: 30 days.
• Feedback given when deleting an account: 3 months, kept with nothing linking it to you.
• Waitlist: if you joined our waitlist, we keep your email until the app has launched.

If you have questions about how long we keep something, contact us using the details above.

6. Who we share information with

6a. Data processors

Google

This data processor does the following activities for us: They host accounts, content and messages, send push notifications, send phone verification texts, measure how the app is used, and protect our forms from abuse.

Supabase

This data processor does the following activities for us: They host our events database and user search.

OpenAI

This data processor does the following activities for us: They check posts, comments and profiles against our community guidelines, and help us triage bug reports.

Resend

This data processor does the following activities for us: They send our account emails.

Sentry

This data processor does the following activities for us: They collect error and crash reports from the app.

Shorebird

This data processor does the following activities for us: They deliver updates to the app.

Tally

This data processor does the following activities for us: They run our support and feedback forms.

Atlassian

This data processor does the following activities for us: They store support requests, reports and flagged content for our team to review.

6b. Others we share personal information with

• Organisations we’re legally obliged to share personal information with
• Other relevant third parties:
  • Other people who use the service, who can see profiles and posts.
  • Anyone with a public link to a profile, who can see its preview.

7. Sharing information outside the UK

Where necessary, we will transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.

Organisation name: Google

Category of recipient: Cloud hosting and analytics provider

Country the personal information is sent to: United States and Belgium

How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)

Organisation name: OpenAI

Category of recipient: Content moderation and triage provider

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)

Organisation name: Resend

Category of recipient: Email delivery provider

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)

Organisation name: Sentry

Category of recipient: Error monitoring provider

Country the personal information is sent to: Germany

How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)

Organisation name: Tally

Category of recipient: Online forms provider

Country the personal information is sent to: Belgium

How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)

Organisation name: Supabase

Category of recipient: Database hosting provider

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)

Organisation name: Shorebird

Category of recipient: App update provider

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)

Organisation name: Atlassian

Category of recipient: Support and review tool provider

Country the personal information is sent to: United States and other countries where Atlassian stores data

How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects (also known as Adequacy Regulations or UK data bridge)

Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

Organisation name: Amazon Web Services

Category of recipient: Cloud hosting provider

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)

Organisation name: Apple

Category of recipient: Push notification delivery provider

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: Standard Contractual Clauses

Organisation name: Microsoft

Category of recipient: Cloud hosting provider

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: Addendum to the EU Standard Contractual Clauses (SCCs)

Our data processors also use other suppliers, which they list on their websites: Google Cloud, Firebase, Google Analytics, Supabase, OpenAI, Resend, Sentry, Tally, Atlassian, and Shorebird in its privacy policy.

8. Deleting your account

You can delete your account in the app at any time. If you can't use the app, lyven.app/delete-account explains how to ask us by email instead. Deleting removes your profile, photos, posts, comments and connections. What we keep afterwards is listed under "How long we keep information".

9. How we check content

Posts, comments and profiles are checked automatically against our community guidelines. Private messages are not checked automatically. A message that someone reports is read by a member of our team.

• A post or comment that is flagged is hidden, then reviewed by a person, who restores or removes it.
• A profile photo that is flagged is removed automatically.
• A name, username or bio that is flagged is refused automatically.

A member of our team can ban an account that breaks the rules. A ban deletes the account.

To challenge a removal or a ban, email support@lyven.app.

10. How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us:

Email: privacy@lyven.app

Post: Lyven Ltd Silverstream House 4th Floor 45 Fitzroy Street, Fitzrovia London W1T 6EB England

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO. 

The ICO’s address:

ICO Head Office
4th Floor, No.3 Circle Square
5 Hawkshaw Street
Manchester
M1 7BL

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint