← Back to home

Privacy Policy

Last updated: 6 August 2026

This Privacy Policy explains how personal data of users of Lavurà (the "Service"), available at lavura.co.uk, is collected and processed.

The Service is operated from Italy by an EU-established controller. Processing therefore complies with Regulation (EU) 2016/679 (the "GDPR") and Italian Legislative Decree 196/2003 as amended by D.Lgs. 101/2018, for all users regardless of their country of residence. Where additional rules apply to users in specific jurisdictions — in particular the California Consumer Privacy Act as amended by the CPRA and other US state privacy laws — those additional rights are described in Section 11.

Capitalised terms not defined here have the meaning given in our Terms and Conditions.

1. Data Controller

The data controller is Giacomo Cornacchia, an individual entrepreneur (ditta individuale) operating under an Italian VAT number (Partita IVA), VAT number IT04199790926, with registered office at Cagliari, Italy ("we", "us"). Privacy questions can be sent to privacy@lavura.co.uk.

2. Data We Collect

We process the following categories of personal data:

  • Account data: name, email address, password (stored as a salted hash) and, if you sign in with Google, the profile information Google shares with us (name, email, profile picture).
  • Professional profile data: the information you enter in your profile and the documents you upload (CV/resume, cover letters): work experience, education, skills, job preferences and the generated application documents.
  • Job-portal credentials (optional): if you enable assisted applications, login credentials for third-party job portals that you choose to store with us. These are encrypted at rest with AES-256-GCM and are used solely to submit applications on your behalf. You may delete them at any time.
  • Gmail data (optional):if you connect a Gmail account to track application emails, we access messages matching job-related senders/subjects to log outcomes and optionally auto-reply. Gmail data is processed under Google's API Services User Data Policy; we do not use it for advertising and do not allow humans to read it.
  • Billing data: subscriptions are processed by Stripe. We never see or store your full card number; we retain only the subscription status, plan, billing dates and the truncated card details Stripe exposes (e.g. brand and last four digits).
  • Technical and usage data: IP address, browser and device type, pages visited, timestamps and server logs, used for security, troubleshooting and abuse prevention.
  • Referral/affiliate data: if you arrive via an affiliate link, we set a 30-day first-party attribution cookie; if you are an affiliate, we process your referral statistics and payout details.
  • Communications: emails and support messages you send us.

Special categories of data. A CV may contain special-category data (e.g. health, religion, trade-union membership). Please do not include such information in your profile or documents unless strictly necessary. Where you voluntarily upload it, you explicitly consent to its processing for the sole purpose of generating your application documents (Art. 9(2)(a) GDPR), and you may withdraw that consent at any time by deleting the relevant content or your account.

3. Purposes and Legal Bases

  • Providing the Service (account management, CV/cover-letter generation, job aggregation, assisted applications, outcome tracking): performance of the contract with you — Art. 6(1)(b) GDPR.
  • Payments and invoicing: performance of the contract and compliance with tax/accounting obligations — Art. 6(1)(b) and (c) GDPR.
  • Security, fraud and abuse prevention, technical improvement: our legitimate interest — Art. 6(1)(f) GDPR.
  • Marketing communications (only if you opt in): your consent — Art. 6(1)(a) GDPR. You can withdraw consent at any time via the unsubscribe link or by contacting us.
  • Legal claims and compliance with applicable laws: legal obligation / legitimate interest — Art. 6(1)(c) and (f) GDPR.

We do not make decisions with legal or similarly significant effects about you based solely on automated processing. AI features (cover-letter drafting, job matching) produce suggestions that you always review and control before anything is sent.

4. Cookies

We use only first-party cookies that are strictly necessary or functional for the Service (session/authentication and referral attribution). We do not currently use third-party analytics or advertising cookies. See our Cookie Policy for the full list and how to manage cookies.

5. How We Share Data

We never sell personal data. Data is disclosed only to the following categories of recipients, acting as data processors under Art. 28 GDPR (or, for Stripe, as an independent controller) and only to the extent necessary:

  • hosting and infrastructure (Vercel Inc., including Vercel Blob storage);
  • managed database and queue providers (PostgreSQL, Redis);
  • payment processing (Stripe, Inc.);
  • AI text generation for cover letters (Google LLC — Gemini);
  • public job-posting data aggregation (Apify, Adzuna);
  • transactional email delivery (our SMTP provider);
  • Google (Gmail API), only when you connect your mailbox and within the scope you authorise.

The current list of sub-processors, with purpose and location, is available in our Data Processing Agreement. Data may also be disclosed to public authorities where legally required.

6. International Transfers

Some providers (notably Stripe, Vercel and Google) process data in the United States. Transfers outside the European Economic Area are made only with appropriate safeguards under Chapter V GDPR: certification under the EU–US Data Privacy Framework where the recipient is certified, otherwise the European Commission's Standard Contractual Clauses, supplemented where necessary by additional technical measures (encryption in transit and at rest). A copy of the applicable safeguards can be requested at privacy@lavura.co.uk.

7. Retention Periods

  • Account and profile data: for the lifetime of your account, deleted within 30 days of account deletion, except data we must keep under law.
  • Job-portal credentials: until you remove them or delete your account; deleted immediately upon either event.
  • Gmail-derived outcome records: stored as application outcomes for the lifetime of the account; raw email content is not retained beyond processing.
  • Billing and invoicing records: 10 years, per Italian accounting and tax obligations (Art. 2220 Italian Civil Code).
  • Server and security logs: up to 12 months.
  • Referral attribution cookie: 30 days.

8. Security Measures

We implement technical and organisational measures appropriate to the risk, including: encryption in transit (TLS 1.2+) and at rest; AES-256-GCM encryption of stored job-portal credentials with a server-side master key; password hashing; least-privilege access to production systems; access and change logging; and regular review of our security practices. No method of transmission over the Internet is 100% secure; we cannot guarantee absolute security, but we commit to the breach-notification procedure in Section 10.

9. Your Rights

Under Articles 15–22 GDPR, every user — regardless of location — has the right to:

  • access their personal data and obtain a copy;
  • rectify inaccurate or incomplete data;
  • erasure ("right to be forgotten"), subject to legal retention obligations;
  • restriction of processing;
  • data portability (receive your data in a structured, machine-readable format);
  • object to processing based on legitimate interests;
  • withdraw consent at any time, without retroactive effect.

Exercise these rights by emailing privacy@lavura.co.uk or by deleting your account in Settings; we respond within one month. You may also lodge a complaint with the Garante per la protezione dei dati personali (the Italian supervisory authority) or with the authority of your country of residence.

10. Personal Data Breaches

If a personal data breach likely to result in a risk to your rights and freedoms occurs, we will notify the competent supervisory authority within 72 hours of becoming aware of it, and we will notify affected users without undue delay where the breach is likely to result in a high risk. Our internal incident-response procedure covers detection, containment, assessment and remediation.

11. Notice for Users in the United States

If you reside in the United States, the following additional disclosures and rights apply under applicable state privacy laws (including the California CCPA/CPRA, Virginia VCDPA, Colorado CPA, Connecticut CTDPA and comparable statutes):

  • No sale or sharing:we do not sell or share personal information for cross-context behavioural advertising, and we have not done so in the preceding 12 months. There is therefore no "Do Not Sell/Share" opt-out to exercise.
  • Categories collected: identifiers (name, email, IP), professional/employment data, commercial data (subscription records), internet/network activity (logs), and — only if you opt in — email content metadata from Gmail.
  • Rights: confirm whether we process your personal information; access and obtain a copy; correct inaccuracies; delete; opt out of targeted advertising or profiling in furtherance of significant decisions (not applicable in practice, as described above); and appeal a decision we make about your request. To exercise any right, email privacy@lavura.co.uk. We respond within the statutory deadline (45 days under the CCPA/CPRA) and never discriminate against you for exercising your rights. We verify requests by matching the information you provide against our account records.
  • Sensitive personal information: we process sensitive data only as described in Section 2 and only with your explicit action (uploading a CV) and consent; we do not use or disclose it for any other purpose.
  • Retention: see Section 7.

12. Minors

The Service is strictly reserved to users aged 18 or over. We do not knowingly collect personal data from anyone under 18. If we learn that a minor has created an account, we will delete it promptly. If you believe a minor has provided us personal data, contact privacy@lavura.co.uk.

13. Changes to This Policy

We may update this Policy as the Service or the law evolves. The updated version will be published on this page with a new "Last updated" date. Material changes will be notified to registered users by email or in-app notice before they take effect.

14. Contact

Questions about this Policy or about data protection: privacy@lavura.co.uk. General support: support@lavura.co.uk.