Privacy Policy

Who we are

Lapsewise ("we", "us") provides renewal and expiry management software. For the personal data described in this policy, we act as the data controller for your account data and as a data processor for the records and documents you store in the service. If you have any questions, contact us at hello@lapsewise.com.

Data we collect

• Account data: your name, email address, password (stored only as a secure hash), and timezone preference.
• Workspace content: the records, dates, notes, and documents you add (for example certificates, contracts, and grants), plus any contact or entity names you choose to store.
• Usage and technical data: basic logs needed to operate and secure the service, such as request timestamps and error logs.
• Communications: messages you send us, for example through the contact form or by email.
• Analytics data (consent-based): if you accept analytics, Google Analytics and Ahrefs Web Analytics collect usage data such as pages viewed, device type and approximate location. Google Analytics uses IP anonymisation.

We do not sell your data. Analytics, the Meta pixel and affiliate tracking are optional and remain off until you make a consent choice in the cookie banner. Separately from cookies, our server reports three events to Meta when they happen: a workspace created, a first record created, and a subscription purchased. Each report carries a hashed email address, the ad click id if you arrived from a Meta ad, and your IP address and browser type, and exists only so we can tell whether our advertising works. We rely on our legitimate interest for this; email us to object and we will exclude your account.

Why we use it (legal bases)

• To provide the service (performance of a contract): creating your account, storing your records, and sending the reminders you configure.
• To secure and improve the service (legitimate interests): fraud prevention, debugging, and reliability.
• To communicate with you (legitimate interests or consent): service emails and replies to your enquiries.
• To meet legal obligations where applicable, such as accounting and tax records for paid plans.
• To measure analytics and advertising results only when you have given consent for the relevant optional category.

Reminder and account emails

Reminder emails are sent through Resend. Account emails (sign-up confirmation, password reset, and invitations) are sent through our email provider. These providers process the recipient address and message content solely to deliver the email on our behalf.

Where your data is stored

Your data is hosted on Supabase infrastructure in the European Union (Ireland, eu-west-1). Uploaded documents are stored in private storage with workspace-level access controls. Some sub-processors (for example our email and hosting providers) may process limited data; we choose providers that support GDPR-compliant transfers.

How long we keep it

We keep your account and workspace data for as long as your account is active. If you delete a record or document, it is removed from the live service. If you close your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain records to meet legal obligations.

Your rights under the GDPR

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data ("right to be forgotten").
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local data protection authority (in Sweden, the Integritetsskyddsmyndigheten, IMY).

To exercise any of these rights, email us at hello@lapsewise.com.

Security

We protect your data with encryption in transit, access controls, and per-workspace isolation. For more detail on how your documents are kept safe, see our Security page.

Cookies and analytics

Essential cookies are always active: one to keep you signed in, and a stored preference for your light or dark theme. These are required for the service to work and do not need consent.

Analytics is optional and off by default. If you choose "Analytics only" or "Accept all", we load Google Analytics (GA4) and Ahrefs Web Analytics to understand which pages are used and where the service can be improved. We enable IP anonymisation in Google Analytics and do not use Google Analytics for advertising.

Advertising measurement is a separate optional choice. If you choose "Accept all", we load the Meta Pixel to measure whether an advertisement led to a completed registration, first record or purchase. Meta may receive the page URL, browser and device information, IP address, Meta click identifiers and the conversion event. We do not send record titles, uploaded documents or workspace content to Meta. Choosing "Analytics only" does not load the Meta Pixel.

Affiliate tracking is also enabled by "Accept all". We load PromoteKit to remember which affiliate referred you using a first-party referral cookie. When you start a new subscription checkout, we include that referral identifier with your Stripe checkout so PromoteKit can attribute the sale and calculate commissions. PromoteKit also processes billing data through our connected Stripe account. Choosing "Essential only" or "Analytics only" does not load PromoteKit or attach a browser referral to a new billing request.

You can Change your cookie choice at any time. For more information about how Google, Ahrefs, Meta and PromoteKit process data, see their respective privacy policies.

Changes to this policy

We may update this policy from time to time. We will revise the "last updated" date above and, for material changes, notify you through the service or by email.