Privacy Policy

Lacspace is the data controller for personal data processed through Lacnova. Where you use the platform to process data about your own customers, you are the controller and we are your processor.

Only what the service needs to work:

• Account data — your name, email address and hashed password.
• Usage data — which tool ran, which action, when, and by whom, so your usage records and invoices agree.
• Content you create — the configurations, routes and files you save in a tool.
• Technical data — IP address and browser user agent on sign-in, kept so you can review your active sessions and so we can investigate abuse.
• Messages you send us — what you write in the contact form or by email, kept so we can reply.

We do not collect special category data, and we ask you not to put it into the tools.

Under GDPR terms: to perform our contract with you (running your account and the tools), for our legitimate interests (keeping the service secure and working out what to build next), to comply with law (tax and accounting records), and with your consent where we ask for it — for example, optional analytics cookies.

• Account data — for as long as your account exists, then deleted within 30 days of closure.
• Usage records — up to 24 months, then aggregated so no individual is identifiable.
• Session records — until the session expires or you revoke it.
• Billing records — as long as tax law requires, typically 7 years.

We do not sell personal data, ever, to anyone.

We share it only with the service providers who help us run the platform — hosting, database, email delivery and payment processing. Each is bound by contract to process it only on our instructions. Our Sub-processors page lists who they are.

We will disclose data if a valid legal order requires it, and will tell you unless we are legally forbidden from doing so.

Our infrastructure is hosted with providers who may process data outside your country. Where personal data leaves the EEA or UK, we rely on Standard Contractual Clauses or an adequacy decision.

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to a particular use. Most of this you can do yourself in the dashboard; for the rest, ask us.

We will respond within 30 days. You also have the right to complain to your local data protection authority.

Passwords are hashed with bcrypt and never stored in readable form. Session refresh tokens are stored only as hashes and are rotated on every use, so a stolen one stops working quickly.

Access to production data is limited to the people who need it to do their job.

If a breach affects you, we will tell you and the relevant authority within 72 hours of becoming aware of it.

The platform is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, tell us and we will delete it.

Write to hello@lacnova.com and a person will reply.