App privacy

01 Who is responsible

The controller is Anna Ramos Morales, at Carrer de Taxdirt 37, 08025 Barcelona, Spain. For privacy and your rights, contact lazos@lazos.care.

02 The data we use

Information about other people comes from the content you provide. Share only what is needed and what you can lawfully share. Lazos does not publish profiles of your lazos or contact those people.

• Account: your identifier, email and sign-in information for the method you choose, such as email, Google or Apple.
• Profile: your name, birth date, declared gender, preferences and answers you share about yourself.
• Relationships: names or nicknames, context, selected photos, dates, memories and conversations you import.
• Content: messages with Lazos, pages, audio you choose to save, practices, readings and responses you choose to report.
• Purchases and operation: subscription identifiers and status, purchase information and technical data for authentication, app integrity, requests and errors.

03 Purposes and legal grounds

We use the data needed to create and recover your account, store and synchronise the content you request, and manage your subscription to perform the service contract. Optional AI and dictation features use your consent, which you can withdraw.

Protecting the service and preventing abuse serves our legitimate interest in providing secure access. We use usage counters and technical integrity data, associated with your account or a pseudonymous guest identifier, to apply quotas and prevent abuse; those counters do not include audio or conversations. We handle rights requests and applicable legal obligations. Relationship context is used for the personal service you request; your permission is not the consent of other people mentioned in your content.

04 Imported conversations

Importing is manual. You export a chat without media and, when you tap Upload file, the complete .txt or .zip file is temporarily sent to private Google/Firebase storage. The server inspects it before you choose the lazo and identify which participant is you. On confirmation, normalised messages and metadata are stored in your account. Groups and files containing media are rejected before saving the conversation.

The upload has a 30-minute window and, from receipt of the file, you have 24 hours to confirm participants and destination. Once uploading finishes, inspection and saving can continue on the server when you close the screen; closing it does not cancel the job. When the import completes, is cancelled, fails or expires, the server deletes the active temporary file and verifies its absence. Google Cloud Storage may retain a recoverable copy in its infrastructure for 7 days after deletion. If cleanup fails, it remains pending for retry. Closed job metadata is retained for 30 days with asynchronous deletion; saved messages remain until you delete them or the account.

There is no device linking or synchronisation with WhatsApp. Lazos does not send messages to other people. Imported text can provide context for the chat and readings you request. With your text AI permission and available quota, a summary of both participants can be prepared automatically after completion: a sample spread over time and counts from the current file, including messages already saved, are sent to OpenAI through Vercel AI Gateway, not counts of the whole relationship. We keep that basis of excerpts and counts with the import to support a later summary or another language; it is deleted with the conversation, lazo or account. The raw file is not sent for this summary. Importing does not grant AI permission or automatically confirm memories.

05 Text AI and dictation

Before generating responses and readings, the app asks permission to send your messages, attached images and relevant context to OpenAI through Vercel AI Gateway. Depending on the feature, context comes from your profile, lazos, imported conversations, pages or practices. For this route, we require the Gateway's zero-retention and no-training controls for request content; this is not a promise of zero retention across the whole app.

Dictation has a separate permission: audio is sent to Meta Model API through Firebase to return text you can review. This audio route does not have the same Gateway zero-retention configuration. Audio you choose to save in My pages follows another flow: it is retained with the page so you can play it back.

Text and audio permissions are stored on the device and in a minimal server record: permission type, notice version, decision to grant or withdraw, server date and revision, linked to your account identifier or, for dictation without an account, a pseudonymous guest identifier. This record does not contain your conversations or audio. You can withdraw permissions in Settings. If withdrawal cannot be synchronised, it remains pending on that device and blocks new sharing there until it can be recorded on the server. Withdrawal also discards late results; it does not undo processing already started. You can import, read and edit manual content without enabling AI. Readings are suggestions that can be wrong; they do not establish facts about another person.

06 Services involved

Google/Firebase provides authentication, storage, functions and integrity controls; Vercel and OpenAI are involved in text generation; Meta, in dictation; and Expo, in delivering updates. Apple and Google are involved according to your sign-in method and device services.

Apple processes iOS purchases. RevenueCat receives your Lazos account identifier and the purchase and access information needed to validate your subscription. The app does not add conversations, your name or email as billing attributes or receive your card number.

These providers may process information outside the European Economic Area. Protection and transfer terms depend on the service, including the provider's applicable contractual mechanisms. You can request information about recipients and transfer safeguards using the contact address in this policy.

07 Retention and deletion

We retain your account and saved content while you keep the account, until you delete that content or request account deletion. Technical data and requests are retained as needed to protect the service, handle the incident or request and meet applicable obligations; they are not used to create a public history of your relationships. Account permission records are deleted with the account; guest records are scheduled for deletion 30 days after each decision.

Reports store the response you selected, its identifiers, dates and status for review. They remain open without an automatic deletion date; when closed, they are scheduled for deletion after 90 days, or are deleted with your account if that happens first.

For dictation, we retain opaque Meta session references, provider, model and date, scheduled for deletion after 30 days; this record contains neither audio nor the transcript. Before deleting an account, current references are kept in a minimal rights queue with a pseudonymous identifier, dates and status while handling the request and applicable obligations. Requests to Meta are handled manually: creating the task or deleting your Lazos account does not confirm that Meta has erased data or provides zero retention. Automatic deletion runs asynchronously; the scheduled date does not mean immediate removal.

Some pages, audio, drafts and preferences remain on the device, without additional encryption provided by Lazos. Archiving a chat retains it. Deleting an import keeps memories you have already confirmed; deleting a lazo does not itself delete chats with Lazos. A lazo photo may use a token link: anyone who knows a valid link can open it.

Delete my account verifies your identity again, blocks new operations and removes the account and its associated operational data. It also requests deletion of the billing customer from RevenueCat; that provider processes deletion asynchronously. You can retry if cleanup fails. The process keeps technical state to complete deletion, without conversations or images.

Operational deletion does not mean immediate removal of every provider backup or log. An offline device may retain its copy until synchronised or cleared. Deleting your account does not cancel your Apple subscription or remove original conversations in other apps; manage the subscription in the store.

08 Your choices and rights

You can correct your context, review memories, delete content and request account deletion. Download my pages lets you share text, dates and ideas from active pages and pages saved only on your device; it excludes audio and is not a complete account export.

You can request access, rectification, erasure, restriction, portability or objection where applicable, and withdraw consent, by emailing lazos@lazos.care. You can also do so if your information appears in content supplied by someone else. We will verify identity using only the information needed; do not send passwords, codes or conversations. These requests do not require a subscription.

You can complain to the Spanish Data Protection Agency. The date on this page identifies the policy version; we will update the text when the app's data processing changes.