Privacy policy

The controller of personal data under Regulation (EU) 2016/679 (GDPR) is the operator of the Larevis service:

This policy covers data we decide about: user accounts, details of customers' companies, payments and operation of the website. Data that customers enter into their jobs (e.g. client names, addresses, notes, photos) we process only as a processor on their instructions; the customer is the controller. The rules for that data are set out in article 11 of the Terms of service. If you want to exercise your rights regarding such data, contact the company that entered it into Larevis.

• User account: email address, password (stored only as a hash), date of registration and last sign-in, company memberships and assigned roles.
• Customer company details: name, company ID, VAT number, registered office and country (for Czech companies from the ARES register), billing email, chosen plan and subscription status, version and date of acceptance of the terms of service.
• Invitations: the invited person's email, who invited them and when.
• Payments: customer and subscription identifiers at the payment gateway, payment and invoice history. We neither see nor store payment card details; Stripe processes them directly.
• Communication: emails you exchange with us and records of operational emails sent (registration confirmation, invitations, password reset, subscription notices).
• Technical data: IP address, browser type and request time in server logs; records of support access to company data.

• User account - for as long as the account exists. You can request deletion of your account at support@larevis.com.
• Company and its data - for the duration of the subscription and 90 days after it ends (read-only mode), then we delete it.
• Incomplete registration (without payment) - 7 days.
• Invoices and payment records - for the period required by accounting and tax law, usually 10 years.
• Record of trial use (user, company ID, VAT number) - for as long as the service runs, so the trial can be used only once.
• Server logs - short term, usually tens of days depending on the hosting providers' settings.

We do not sell data or use it for advertising. We share it only with providers who run parts of the service for us, to the extent necessary and under a data processing agreement:

Transfers outside the EU (USA) take place on the basis of standard contractual clauses approved by the European Commission or the provider's certification under the EU-US Data Privacy Framework. The United Kingdom has a European Commission adequacy decision.

Maps. We obtain map data and address search from Mapy.com (Seznam.cz) or the OpenStreetMap project, depending on which is set for a given map. When a map is displayed (internal or public), the browser downloads map tiles directly from that provider's servers, so the provider sees the visitor's IP address. Address searches go through our server, so the provider sees only the search text, not you.

We may also disclose data to public authorities where the law requires us to.

A company's public map (at larevis.com/company-name or embedded on the customer's website) shows only references the customer has published, with the location rounded to approximately 100 m. We set no cookies for visitors to customers' public maps and do not track them; their IP address reaches only the hosting logs and the map data provider (see above).

We use only strictly necessary cookies without which the application does not work: the sign-in session, the company you are currently working in and your language choice. We use no analytics or advertising cookies, so we do not ask for consent.

On the public pages of larevis.com (home page, comparison, sign-in and registration) we measure anonymous traffic with Vercel Web Analytics: how many people visited, where they came from and on what device. The measurement uses no cookies, does not store IP addresses and cannot identify a visitor. We measure our own demo maps that we send to prospects in the same way (for example which project was opened). We do not measure the internal application or customers' public maps.

Stripe's payment pages (Checkout, subscription management) run on Stripe's domain and follow Stripe's own policies, including anti-fraud cookies.

• encrypted communication (HTTPS/TLS) between the browser, the application and the database,
• passwords stored only as a hash, password reset via a one-time link,
• separation of each company's data by rules directly in the database (Row Level Security), so a user sees only their company's data,
• internal files in non-public storage, accessible only through temporary signed links,
• the public map reads only separate publication records, not internal job data,
• support access to company data only when necessary and logged in the application,
• regular database backups.

Under the GDPR you have the right:

• of access to your data and a copy of it (Art. 15),
• to rectification of inaccurate data (Art. 16),
• to erasure, if we no longer need the data or may not process it (Art. 17),
• to restriction of processing (Art. 18),
• to portability of data you have provided to us (Art. 20); customers can export their jobs at any time,
• to object to processing based on legitimate interest (Art. 21).

Send your request to support@larevis.com. We will reply without undue delay, within one month at the latest. To verify your identity we may ask you to send the request from your account's email.

There is no automated decision-making or profiling that would have legal effects on you.

Send questions about data protection to support@larevis.com. You also have the right to lodge a complaint with the supervisory authority:

We may update this policy, for example when providers change. We will inform you in advance of a material change by email or in the application. This policy is effective from 8 October 2026. This English version is a translation for convenience; in case of any discrepancy, the Czech version prevails.