Loovay Privacy Policy
Last Updated: August 31, 2026 · Effective Date: August 31, 2026
Your recipes, active payload percentages, custom raw-material parameters, and batch history remain your exclusive property. Proprietary formulation metrics, ingredient ratios, and custom parameters submitted to Aura AI or our calculation engines are never sold, publicly exposed, shared with third parties, or used to train, fine-tune, or improve public or commercial third-party Large Language Models. See Section 2 for full details.
At Loovay ("Loovay", "we", "us", or "our"), we respect your privacy and are committed to protecting the proprietary nature of your cosmetic formulations, trade secrets, and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you visit our website, use our web application, or subscribe to our formulation workspace services (collectively, the "Services" or "Platform").
Please read this Privacy Policy carefully. By creating an account, accessing, or using the Platform, you acknowledge that you have read, understood, and agree to the practices described herein. If you do not agree with this policy, please do not use the Platform.
Information We Collect
We collect information to provide, maintain, and secure our software utility, process your payments, and deliver computational features.
- Account & Identity Data: Full name, business/brand name, email address, password hash, mailing address, telephone number, and communication preferences provided during registration.
- Formulation & Proprietary Workspace Data: Recipes, batch logs, custom ingredient entries, dual-lye splits, curing duration logs, fatty acid profiles, and INCI configurations created or uploaded to your private account.
- Support & Communications: Records of support tickets, bug reports, and correspondence submitted to our help desk.
- Device & Connection Data: IP address, browser type and version, operating system, device identifiers, time-zone settings, and language preferences.
- Usage Telemetry: Feature interactions, pages visited, button clicks, platform navigation paths, session duration, and crash logs collected via secure analytical tools (e.g., PostHog/Mixpanel).
- Cookies & Essential Tracking: We use essential authentication cookies, local storage, and functional tokens required to keep you logged in securely and maintain active workspace states.
We do not directly collect, store, or process your credit card numbers or banking credentials on Loovay servers. All payment transactions are handled entirely by our third-party, PCI-DSS Level 1 certified payment processor, Stripe. Stripe collects payment card details, billing addresses, and transaction metadata governed strictly by Stripe's Privacy Policy.
Strict Proprietary Formula & AI Data Isolation
We recognize that your recipes, trade secrets, and cosmetic formulas represent your core business value.
- 100% Ownership & Data Privacy: Your recipes, active payload percentages, custom raw material parameters, and batch history remain your exclusive property.
- Zero AI Model Training: Proprietary formulation metrics, ingredient ratios, and custom parameters submitted to Aura AI or our calculation engines are NEVER sold, publicly exposed, shared with third parties, or used to train, fine-tune, or improve public or commercial third-party Large Language Models (LLMs).
- AI Processing Protocols: Data passed to AI engines is processed transiently over encrypted API endpoints solely to return immediate, workspace-isolated feedback (e.g., stability warnings, sensory predictions, step-by-step methods) for your active session.
How We Use Your Information
We process personal and operational data for legitimate business purposes, including:
- Service Delivery: Providing saponification calculations, fatty acid profiling, IFRA allergen aggregation, INCI generation, and workspace features.
- Account Administration: Managing subscriptions, processing billing via Stripe, sending transaction receipts, and enforcing account quotas.
- Customer Support: Resolving technical issues, responding to inquiries, and sending system update notifications.
- Security & Fraud Prevention: Detecting unauthorized platform access, preventing reverse-engineering attempts, and protecting platform infrastructure.
- Platform Analytics: Evaluating user engagement metrics in aggregate to optimize performance, repair bugs, and refine UI workflows.
Data Sharing & Third-Party Service Providers
Loovay does not sell, rent, trade, or lease your personal data or proprietary formulas to third-party advertisers or data brokers. We share data only with trusted infrastructure providers essential to operating our SaaS platform:
- Cloud Hosting & Infrastructure: AWS / Vercel (encrypted database storage and serverless function execution).
- Payment Processing: Stripe (PCI-compliant billing and subscription management).
- Transactional Email: Resend / SendGrid (delivering password resets, receipts, and system alerts).
- Product Analytics: PostHog / Mixpanel (privacy-centric feature usage analytics).
- Legal Compliance: We may disclose information if required by law, subpoena, or government authority under Canadian law, or to protect the safety, rights, and security of Loovay, its users, or the public.
Data Security & Storage
We implement robust, industry-standard technical and organizational safeguards to protect your personal information and trade secrets:
- Encryption Standards: All data transmitted between your browser and Loovay is secured using Transport Layer Security (TLS 1.3). Data stored in our databases is encrypted at rest using AES-256 encryption.
- Access Control: Multi-tenant workspace isolation ensures that your private recipes are accessible only via authenticated credentials tied to your account.
- Data Hosting Location: Our primary servers and cloud infrastructure are hosted in secure, ISO/IEC 27001-certified data centers located in Canada and North America.
Data Retention & Account Deletion
- Retention Period: We retain your account data, subscription history, and workspace formulations for as long as your account remains active or as needed to comply with our legal obligations and resolve disputes.
- Account Cancellation: If you cancel your subscription, your data remains accessible during your grace period. Following account termination, you may request full data purging.
- Data Deletion Rights: You may request the permanent deletion of your account, personal data, and stored formulas at any time by contacting privacy@loovay.com. Upon confirmation, all associated workspace data will be permanently wiped from our active databases within thirty (30) days.
Your Privacy Rights & Global Compliance
Depending on your jurisdiction, you hold specific rights regarding your personal information:
Under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canadian residents have the right to access, correct, or challenge the accuracy of their personal information held by Loovay.
If you reside in the EEA or UK, you hold rights under the General Data Protection Regulation, including:
- Right to Access & Rectification: Request copies of your personal data or correct inaccuracies.
- Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data.
- Right to Data Portability: Export your recipes and workspace logs in a structured, machine-readable format (JSON/CSV).
- Right to Withdraw Consent: Withdraw consent for non-essential telemetry tracking at any time.
California residents hold specific rights under the California Consumer Privacy Act:
- Right to Know: Request disclosures regarding categories of personal information collected and processed.
- Do Not Sell or Share My Personal Information: Loovay does NOT sell or share your personal information.
To exercise any of these privacy rights, please submit a written request to privacy@loovay.com.
Cookies & Tracking Control
Most web browsers accept cookies automatically. You can modify your browser settings to decline non-essential cookies or notify you when a cookie is placed. However, disabling essential authentication cookies will prevent you from logging into your Loovay account and accessing your private workspace.
International Data Transfers
Loovay operates from Canada. By accessing the Platform from outside Canada — including from the United States, the European Union, the United Kingdom, or other worldwide regions — you acknowledge and consent to the transfer, storage, and processing of your account data and workspace records in Canada and North America, where data protection laws may differ from those in your home jurisdiction.
Changes to This Privacy Policy
We reserve the right to update or modify this Privacy Policy at any time to reflect software updates, legal requirements, or operational changes. Material changes will be communicated via an in-app banner alert or direct email notification to your registered address prior to becoming effective. Your continued use of the Platform following updates constitutes acceptance of the revised policy.
Contact Us
If you have questions, concerns, or formal privacy inquiries regarding this Privacy Policy or our data protection practices, please contact us at: