A short, honest privacy notice.
Most privacy policies are written by lawyers for lawyers. This one is written so you can read it in five minutes and know exactly what we do — and what we don't.
Lova builds and runs websites and apps for the people who hire us. To do that, we collect the smallest amount of personal information we can get away with — usually just your email, name, and the contents of the project we are building together. We never sell your data. We use Google Analytics 4 and Google Ads for analytics and advertising measurement, and HubSpot for visit tracking and customer communication. We share information with the service providers listed in §04 below to operate our services, communicate with you, diagnose errors and measure website and marketing performance.
What we collect
- Email address Collected: Always
- Account, billing receipts, project notifications
- Full name Collected: Always
- Address you on invoices, in messages
- Company name Collected: Optional
- Invoice header, scope-of-work documents
- Phone number Collected: Optional
- Project communication if you opt in
- Billing address Collected: If invoiced
- Tax determination, invoice compliance
- Card / bank info Collected: Never by us
- Stripe processes payments. We see only the last 4 digits.
- Project content Collected: Always
- The thing we are building for you
- Project intake receipt Collected: When submitted
- Your contact details, validated project brief and receipt/recovery metadata are stored privately in Supabase so we can receive your request, recover interrupted follow-up and avoid repeating processing for the same request key. This does not subscribe you to marketing.
- Crash and error data Collected: Always
- So we can fix bugs before you report them
- IP address Collected: Edge logs
- Abuse prevention, retained <30 days at Cloudflare
- Site analytics (first-party) Collected: Always
- We record anonymous visit data on lova.dev with our own cookieless analytics (stored in our database, not shared): the page path, the referring site, device type, browser, operating system, screen width, country, any UTM campaign tags in the link, and a per-visit session id that clears when you close the tab. No cookies and no personal data; your IP address is never stored — only an anonymous visitor hash that resets every day.
- Marketing analytics Collected: Limited
- Google Analytics 4 (G-510T6SXGG0), the Google Ads tag (gtag.js) and Google Tag Manager (GTM-ND48S4ZT) measure pageviews, events and ad-click attribution, and the HubSpot tracking code records visited pages against a first-party cookie. No Meta Pixel or marketing session replay. Sentry error-diagnostic replay is separate; see §04 service providers.
- PostHog aggregate intake analytics Collected: Limited
- When configured, PostHog receives anonymous page, device/performance, and deliberate interaction events. The server lead_submitted event includes only bounded project type, budget, timeline, route, optional productized tier, static source, and a fresh random event ID unrelated to contact data. It contains no email, name, phone, company/domain, state, URLs, attribution identifiers, attachments, or free text and is not a contact-enrichment feed for Clay. No browser storage, autocapture, session replay, or identification/profile creation.
To run your project
Project files, chat history, deliverables, and milestones live inside your portal at lova.dev/portal. We refer to them when we are building, when we are answering your questions, and when we send you receipts.
To bill you
We use Stripe to process payments. Stripe sees the card; we see the last four digits, the country code, and a transaction ID. That's it. Texas sales tax is calculated by Stripe Tax on Texas-resident customers for templated work and maintenance plans.
To fix problems
When something breaks, Sentry captures the error, browser, and the URL you were on. We do not capture form contents, passwords, or anything you typed into a private field. Errors are kept 90 days and then deleted.
To talk to you
We use HubSpot to remember the conversation between us. Resend delivers transactional email — receipts, password resets, project updates. No newsletters unless you specifically opt in.
Who else touches your data
A short list. Each one signs a data-processing agreement with Lova and is independently audited.
-
Email, name, hashed password, your projects, deliverables, payment records, and private project-intake contact details, briefs and receipt/recovery metadata used to receive and follow up on your request.
Region AWS US-East
-
Card info processed by Stripe directly. Lova never sees raw card numbers.
Region US
-
Stack traces and browser/device metadata. When Sentry is enabled, it is configured for session replays on error, not routine session recording; these replays support error diagnosis, not marketing measurement.
Region US
-
IP address, request logs (retained <30 days)
Region Global edge
-
Email address, message metadata
Region US-East
-
Name, email, phone, company, conversation history. Its tracking code also runs on our marketing and legal pages (not on contract-signing pages), setting the first-party cookies hubspotutk, __hstc, __hssc and __hssrc to record which pages a visit touched and link that visit to your record if you later contact us.
Region US
-
The Soro blog embed loads only when you visit /blog. Its request may receive the standard technical data your browser sends to a third-party content provider, such as IP address and browser/device details.
Region Estonia (EU); Soro states some subprocessors operate in the US and UK
-
Anonymous page, device/performance, and deliberate interaction events. When configured, the server lead_submitted event contains only bounded project type, budget, timeline, route, optional productized tier, static source, and a fresh random event ID unrelated to contact data. No email, name, phone, company/domain, state, URL, attribution identifier, attachment, or free-text intake fields are included in that event. No cookies or browser storage, autocapture, session replay, or identification/profile creation.
Region US
-
The website analytics event provides no contact details for enrichment. If routed to Clay, lead_submitted contains only the aggregate project type, budget, timeline, route, optional productized tier, static source, and random event ID described for PostHog. This event is not a contact-enrichment feed.
Region US
- 10
Google (Google Ads + Google Analytics 4 + Tag Manager)
Website analytics and conversion measurement for paid advertising; marketing tag management
Privacy policy ↗Pageviews and events via Google Analytics 4 (G-510T6SXGG0), device/browser metadata, analytics and ad-click attribution cookies (such as _ga and _gcl_au). Google Tag Manager (GTM-ND48S4ZT) loads + manages these marketing tags. No name, email, or payment data.
Region US (Google global infrastructure)
Lova for Android and Lova for iOS are thin wrappers around this website. When you open the app it lands on the marketing homepage at lova.dev — no account is required to browse, read about pricing, or use the "Start a project" intake form. Existing clients can sign in at lova.dev/login from inside the app to reach the client portal. The apps do not collect anything that the website does not collect. Push notifications are off by default — if you ever turn them on we will use Apple's APNs and Google's FCM to deliver them. We never read the contents of messages routed through these services; they exist only to wake the app.
Wherever you live, you have rights over the personal information we hold about you. We do not sell your data. We use the service providers described in §04, including for analytics and advertising measurement, and we do not collect sensitive personal information (no race, health, biometrics, precise location, or financial-account details beyond what Stripe handles). To exercise any of the rights below, email privacy@lova.dev. We respond within forty-five (45) days and will not discriminate against you for asserting these rights.
Access
Ask for a copy of everything we have about you.
Correct
Fix anything that is wrong. The portal lets you edit most fields directly.
Delete
Ask us to erase your account and project history. We honor the request within 30 days unless tax law requires us to keep an invoice on file. See how to delete your account & data.
Port
Get a structured export of your data so you can take it elsewhere.
Object
Tell us to stop processing your data. We will, unless we have a legal duty to keep it.
Opt out
You have the right to opt out of any sale or sharing of personal information. For privacy questions or to make an opt-out request, email privacy@lova.dev. We honor Global Privacy Control (GPC) signals where applicable.
Appeal
If we deny a rights request, reply within sixty (60) days and we will reconsider. We respond to appeals within sixty (60) days of receipt.
Complain
In the US, the Texas Attorney General handles consumer privacy complaints. If you live outside the US, your country's data-protection authority may also accept complaints.
Email support@lova.dev
Phone (972) 275-6576
Mail Lova Studio LLC · 6675 S Custer Rd Ste 500 · McKinney, TX 75070
Response Within two business days. Always.
We will update this notice when our practices change. The version number and effective date at the top of the page change with it. If we ever do something materially different — selling data, anything you would notice — we will email every active client at least 30 days before it takes effect.
lova Built right. Kept running.