Privacy Policy

1. WHO IS RESPONSIBLE (DATA CONTROLLER) The controller of your personal data is Aljubarrota - Comércio & Serviços, Unipessoal Lda, NIPC 500309027, Avenida de Aljubarrota, Nº 12, Loja, 2700-040 Amadora, Portugal. For any privacy matter, contact info@larfam.com. 2. OUR APPROACH Larfam is built to hold what matters to a family. We collect the minimum we need to run the Service. We do not show ads, we do not sell your data, and we do not use third-party advertising or tracking. 3. WHAT WE COLLECT - Account data: your name, email address, a hashed (never plain-text) password, timezone and language. - Profile details you choose to add: phone numbers, city and country, date of birth, pronouns, workplace, a short bio, an emergency contact, and the contacts and places you save. - Health information you choose to add to your own profile: blood type, allergies, medical conditions and medications, and any medical documents you upload. This is optional and is stored only with your explicit consent. It is visible only to you unless you choose to share it with your family. - Family and content data: the events, tasks, lists, and notes you create, and the family structure you set up (members and children profiles). - Vault documents: the files you upload to the vault, stored as described in section 5. - Technical data: device push tokens (to deliver notifications), IP address and basic request logs (for security and abuse prevention), and app and version diagnostics. - Product usage events: a few key moments recorded by us on our own servers — for example that an account was created, an invitation sent or accepted, or a first event or document added. They are linked to your account and used only to understand and improve Larfam; they are never used for advertising or shared with advertisers. - Payment data: if you subscribe, billing is handled by Apple, by Google or by our processor Stripe. We receive confirmation of your subscription status; we do not store your card details. 4. WHY WE USE IT, AND OUR LEGAL BASES (GDPR ART. 6) - To provide the Service you asked for — performance of our contract with you. - To keep the Service secure and prevent abuse, and to understand how Larfam is used so we can improve it — our legitimate interests. - Health information — your explicit consent (GDPR art. 9(2)(a)), which you give in the app before you first add it. Sharing it with your family is a separate choice you can turn off at any time. You can withdraw your consent at any time in the app; withdrawing deletes this information and does not affect the rest of your account. - To send optional product updates — only with your consent, which you can withdraw at any time. - To meet legal and accounting obligations — compliance with a legal obligation. 5. THE DOCUMENT VAULT Documents you upload to the vault are transmitted over encrypted connections (TLS) and stored with our storage provider in the European Union (Hetzner Object Storage, Germany). They are not end-to-end encrypted. Access is limited to the members of your family: the app opens a document through a short-lived signed link that expires after a few minutes. We do not show ads, and we never sell your documents or any other data. 6. WHO WE SHARE DATA WITH (PROCESSORS) We share data only with providers who process it on our instructions to run Larfam: - Hosting, database and backups — Hetzner Online GmbH, Germany (European Union). - Document storage — Hetzner Object Storage, Germany (European Union). - Account and notification emails — Brevo (Sendinblue SAS), France (European Union). - Push notifications — Apple Inc. (APNs) and Google LLC (Firebase Cloud Messaging), USA. - Crash reports — Google LLC (Firebase Crashlytics: crash traces, device model, OS version, app version; no ads, no tracking), USA. - Payments — Apple, Google, and Stripe Payments Europe Ltd (Ireland). - Abuse prevention — Cloudflare, Inc. (Turnstile, a bot check on our sign-in forms), USA. We do not sell or rent your personal data to anyone. 7. WHERE YOUR DATA IS Your account and content are hosted in the European Union. Some providers above (Apple, Google and Cloudflare) may process limited technical data in the United States. For those transfers we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. 8. HOW LONG WE KEEP IT We keep your account and content while your account exists. When you delete your account we erase or anonymise your personal data as described in the Account Deletion notice; files in your vault are deleted, and copies in our backups disappear within 14 days as the backups rotate. We keep, for longer: security and audit logs for 2 years; records of the legal documents you accepted (version, date and IP address) to be able to prove your consent; and billing records for 10 years, as required by Portuguese tax law. 9. YOUR RIGHTS Under the GDPR you can: access your data; correct it; erase it; restrict or object to processing; receive a portable copy; and withdraw consent at any time. To exercise any right, contact info@larfam.com. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), or the authority where you live. 10. CHILDREN Larfam is for adults running a household. Children do not hold their own accounts; a parent or guardian creates and manages a child's profile and provides the required consent. We do not knowingly collect data directly from children. 11. COOKIES The web app uses a single essential session cookie to keep you signed in, plus small preferences (language, theme) stored in your browser. We do not use advertising or cross-site tracking cookies. See our Cookie Policy. 12. SECURITY We protect your data with encryption in transit (TLS), hashed passwords, EU hosting, short-lived signed links for document access, and strict access controls. No system is perfectly secure, but we treat your data as if it were our own. 13. CHANGES We may update this Policy. The current version and effective date are shown here; for material changes we will notify you. 14. CONTACT Privacy questions and requests: info@larfam.com — Aljubarrota - Comércio & Serviços, Unipessoal Lda, Avenida de Aljubarrota, Nº 12, Loja, 2700-040 Amadora, Portugal.