Privacy Policy

1. Controller

The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Mike Quade
Rua do Sobreirinho, Graça
3270-022, Portugal
Email: info@lavaflow.eu

We have not appointed a data protection officer, as the legal conditions requiring one are not met. Please direct privacy enquiries to the address above.

2. Overview

LavaFlow is a productivity app offering team chat, notes, tasks, reminders and AI agents. Using it requires a user account. The primary storage and processing of your data takes place on servers operated by Hetzner Online GmbH in Germany. Individual features pass data to external services as described below (in particular the optional AI feature to DeepSeek in China, see section 5).

We do not sell personal data, we do not use advertising networks, and we do not use tracking cookies for advertising purposes.

3. Account data

To register and sign in, we process:

• Username (handle) and display name
• Email address — for account verification and contacting you
• Password — stored only as a bcrypt hash; we never have access to your plaintext password
• Language preference and, optionally, a profile picture and profile description
• Role (e.g. administrator, customer) and the time of your last activity

When you register, we send a verification email to the address you provide. An account only becomes usable once that address has been confirmed.

4. Content: chats, notes, tasks, reminders

All content you create in LavaFlow is stored on our server so that it is available across your devices:

• Chat messages in rooms, direct messages and agent conversations, including reactions, attachments, images and voice messages
• Notes with text and uploaded images
• Tasks with projects, comments, dependencies and file attachments
• Reminders with due dates, recurrence and note text
• Organisations and your memberships in them

Encryption at rest

The contents of chats, notes, tasks and reminders are stored encrypted on the server using AES-256-GCM. Each area uses its own separate key, so that exposure of one key does not affect all areas at once.

This is encryption at rest, not end-to-end encryption: the keys are held on the server so that the application can work with your content — for search or for AI agents, for example. Technically, the operator is therefore able to decrypt content. Transport between the app and the server always uses HTTPS/TLS.

5. AI agents and web search

DeepSeek (language model)

LavaFlow agents may use DeepSeek's language model. This AI feature is optional and currently part of the closed test. Only if you actively use the feature and have previously given explicit consent are the contents required to produce a reply transmitted to the DeepSeek API (api.deepseek.com). This includes:

• your message and the conversation history with that agent (or an automatically generated summary of older parts)
• the agent's configuration (instructions, personality, stored notes about its working context)
• results of tools the agent runs on your behalf — depending on the enabled toolset, this may include the contents of your tasks, reminders, notes or emails

Account data such as your email address or password is not transmitted. The full message history additionally remains stored encrypted in our database.

Transfer to mainland China. DeepSeek is a provider based in, and processing data in, the People's Republic of China. Using the feature therefore causes the content described above to be transferred to a third country outside the European Union. For this transfer there is currently no adequacy decision by the European Commission and no confirmed appropriate safeguards (such as Standard Contractual Clauses) documented.

Tavily (web search)

Agents with the web search tool send your search query to the Tavily search service to retrieve up-to-date information. Only the search term formulated by the agent is transmitted — not the full conversation and no account data. If an agent fetches a web address, that address is requested from our server; the website in question sees our server's IP address, not yours.

6. Email accounts (IMAP/SMTP)

LavaFlow can connect to an existing mailbox. This feature is optional and currently limited to administrators. If you use it, we process:

• Credentials for your mailbox (server, port, username, password, email address, TLS settings) — the password is stored encrypted with a dedicated AES-256-GCM key and is never returned to the app
• Email content shown when you open a message — messages are fetched directly from your provider's mailbox on each request and are not stored in our database
• Actions you take: sending, drafts and moving messages happen directly in your mailbox at your provider
• Notification state: the highest message number already notified and the time of the last check, so that new email triggers a push notification only once
• Settings for image display and a list of senders you have marked as trusted

To check for new messages, our server connects to the mailbox at regular intervals. In doing so, the sender and subject of new messages are processed in order to build the push notification. When you delete your account or remove the mailbox entry, the stored credentials are deleted with it; the emails themselves remain with your email provider.

7. Push notifications

For push notifications (due reminders, new messages, new email) we use Google's Firebase Cloud Messaging (FCM). To do so, we store your device's FCM registration token and the platform (Android, iOS, web).

The content of a notification — for example the title and note of a reminder, or the sender and subject of an email — is transmitted to Google for delivery. You can turn push notifications off in your device settings; the token is removed when you sign out or uninstall the app.

8. Analytics and crash reports (Android only)

The Android app can use Firebase Analytics and Firebase Crashlytics to detect crashes and understand the use of basic features.

This collection is disabled by default and only becomes active if you explicitly consent to it in the app. Without consent, neither analytics events nor crash reports are transmitted. You can change your decision at any time in the app settings.

If you consent, the following is transmitted: screen names viewed, individual feature events, technical crash data (device model, OS version, error log) and your numeric user ID. Plaintext data such as your username or email address is deliberately not passed to Analytics or Crashlytics. The web app does not use any analytics or crash reporting services.

9. Server logs and local storage

When our servers are accessed, technical connection data is generated (IP address, timestamp, endpoint requested, status code), which we process to deliver the service, troubleshoot errors and protect against abuse. We apply rate limiting to guard against automated attacks.

The web app stores a session token in your browser (localStorage) to keep you signed in. The short-lived access token is held in memory only. We do not use cookies for analytics or advertising. Signing out removes the stored token. This privacy page itself loads no external fonts, scripts or tracking pixels.

10. Recipients and third parties

Some of these providers process data outside the European Union. For push delivery and (with consent) analytics, LavaFlow uses Google, whose servers are predominantly in the United States. For DeepSeek, processing takes place in the People's Republic of China. For transfers to the United States we rely on the European Commission's Standard Contractual Clauses. For the transfer to China, the statement in section 5 applies: there is currently no adequacy decision and no confirmed appropriate safeguards are documented; the DeepSeek feature may therefore only be used after explicit consent.

11. Legal bases

• Art. 6(1)(b) GDPR (performance of a contract) — providing your account and all core features: chats, notes, tasks, reminders, AI agents, email integration and the push notifications required for them.
• Art. 6(1)(a) GDPR (consent) — analytics and crash reports in the Android app. Consent can be withdrawn at any time with effect for the future.
• Art. 6(1)(a) GDPR (consent) — transmission of contents and context to DeepSeek (China) when using the optional AI feature. Consent is obtained separately and explicitly before the first transmission and can be withdrawn at any time for future transmissions (see section 5).
• Art. 6(1)(f) GDPR (legitimate interests) — server logs, rate limiting and abuse prevention, to ensure stable and secure operation.

12. Retention periods

• Account and content data is stored for as long as your account exists.
• Voice messages are deleted automatically 30 days after upload.
• Session tokens expire automatically: access tokens after 15 minutes, sign-in tokens after 30 days at the latest.
• Push device tokens are removed as soon as Google reports them as invalid, for example after the app is uninstalled.
• Email content is not permanently stored by us; your email provider's retention settings apply.
• Server logs are kept for up to 30 days as a rule; longer only in the event of a specific security incident or where a legal obligation requires it.

13. Your rights

Under the GDPR you have the following rights:

• Access to the data we hold about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure of your data (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on legitimate interests (Art. 21)
• Withdrawal of consent with effect for the future (Art. 7(3))

To exercise these rights, simply send a message to the address given in section 1. Independently of this, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your residence or of the alleged infringement.

14. Deleting your account

You can delete your account yourself at any time. This permanently removes your notes, tasks, reminders, agents, connected email accounts including their encrypted credentials, device tokens and sessions.

Messages you left in shared chat rooms remain visible to the other participants but are detached from your account (anonymised). Your username stays permanently reserved so that nobody else can take it over. If you still own an organisation, you must transfer or delete it first.

Deletion is available in the app, or informally by messaging the address given in section 1.

15. Children

LavaFlow is not directed at children. You should only create an account if you are at least 16 years old or have the consent of a parent or guardian. If we become aware that an account was created contrary to this, we will delete it.

16. Changes to this policy

We update this privacy policy when LavaFlow's features or the legal requirements change. The version published on this page is the applicable one; the date at the top shows its current status.

17. Contact

For questions about privacy or to exercise your rights, contact us at info@lavaflow.eu.