Privacy Policy

Last updated: September 7, 2026

1. Who we are

Luvora is a digital platform operated by Luvora OÜ, a company registered in Estonia.

Identification details:

Legal name: Luvora OÜ
Registered office: Harju maakond, Tallinn, Kesklinna linnaosa, Tuukri tn 19-202, 10120, Estonia
Contact email: hello@luvoraapp.com
Data protection email: legal@luvoraapp.com

For the purposes of Regulation (EU) 2016/679 ("GDPR"), Luvora OÜ acts as a data controller.

2. What personal data we collect

a) User identification data

first and last name
email address
authentication data (encrypted passwords)
date of birth (used solely to verify minimum age of 16)

b) Event-related data

event type
date and location (if entered)
estimated number of guests
visual style selected
vendor categories requested
organisational information voluntarily provided by the user

c) Event budget data

financial figures entered by the user
expense categories and estimates

All budget-related information is entered, modified, and controlled exclusively by the user, used solely for informational and organisational purposes, and not verified by Luvora. Luvora does not provide financial advice and does not guarantee costs or outcomes.

d) Communication data

messages sent to vendors
requests sent to the Luvora team
interactions within the Platform

e) Technical and usage data

IP address
device and browser type
Platform usage information
security and log data

f) Cookies

As set out in the Cookie Policy.

g) Company identification data (business users / vendors)

company name
unique company identification number (CUI / CIF or equivalent)
trade register number
registered office address
other publicly available company information

This data may be provided directly by the user or automatically retrieved from public sources or official databases, based on the company identification number, for the purpose of completing or verifying company information.

h) Third-party data provided by users (guests)

The Platform may allow Users to input or import personal data relating to third parties, such as:

guest names
phone numbers
other information necessary for event organisation

This data is provided exclusively by Users, used solely for event organisation purposes, and managed and controlled by the User who provides it. Luvora does not collect this data directly from the data subjects, does not use it for marketing purposes, and does not contact guests, except where explicitly initiated by the User through the Platform's functionalities.

Users represent and warrant that they have the legal right to provide such data and that they have informed the relevant data subjects, where required.

3. Purposes of processing

We process personal data for the following purposes:

providing and administering the Platform
creating and managing user accounts
event organisation and planning
facilitating contact with vendors
automatic completion of company data
guest list management
generating personalised vendor recommendations through an automated system (matching engine) — see section 3.1
user support and communication
improving Platform features
security, fraud prevention, and abuse prevention
measuring Platform performance (analytics — with consent)
compliance with legal obligations

3.1 Automated profiling and personalised recommendations

The Platform uses an automated recommendation system ("matching engine") that processes data entered in the event planning form — including event type, estimated budget, visual style selected, location, and requested vendor categories — to generate personalised vendor recommendations.

This processing constitutes automated profiling within the meaning of GDPR Art. 22.

Users have the right to:

contest the generated recommendations
request human intervention in the evaluation of recommendations
opt out of the automated recommendation functionality

To exercise these rights, users may contact Luvora at legal@luvoraapp.com.

4. Legal basis for processing (GDPR Art. 6)

We process personal data based on the following legal grounds:

performance of a contract (use of the Platform)
user consent, where required
Luvora's legitimate interest (security, functionality, data accuracy)
the user's legitimate interest in organising an event
applicable legal obligations

Processing of guest data and company identification data is based on legitimate interest and on the fact that such data originates from public sources or is provided by users. Automated profiling (matching engine) is based on performance of the contract and explicit consent granted upon acceptance of the Terms & Conditions.

5. Who we disclose data to

We may disclose data to:

hosting and IT infrastructure providers (EU)
technical service providers
payment processing providers (for transactions on the Platform)
email delivery services (stored in the EU)
analytics providers (only with consent) — Google Analytics 4 (Google LLC, USA — transfer under SCCs)
providers listed on the Platform, only at the user's initiative
AI-based conversational assistants and agents (e.g. ChatGPT), through dedicated integrations that allow users of those assistants to discover vendors publicly listed on the Platform — see section 5.1
affiliate partners (e.g. accommodation, experiences, gifts, transport services), through affiliate links — exclusively at the user's initiative, by clicking a link

5.1 Access to data through AI assistants

Luvora provides technical integrations ("connectors") that allow AI-based conversational assistants to access, at the request of that assistant's users, information about vendors publicly listed on the Platform — display name, category, location, starting price, description, portfolio photos, and aggregate rating.

These integrations:

provide access only to data that is already public, visible to anyone visiting the Platform
are read-only — they do not allow modifying, creating, or deleting any information
do not have access to client-user data (events, budget, guests, messages, account information)
do not have access to incomplete profile data or test accounts

Vendors who wish to be excluded from these integrations may contact Luvora at legal@luvoraapp.com.

We do not sell personal data. We do not transfer data for unauthorised commercial purposes.

Affiliate partners do not receive personal data of Luvora users. They may collect their own data through their own platforms, in accordance with their own privacy policies, if the user chooses to access an affiliate link and interact with the partner's platform.

6. International data transfers

Data is stored and processed within the European Union or in countries that ensure an adequate level of protection in accordance with GDPR. The main technical infrastructure is hosted in data centres within the European Union.

Where Google Analytics 4 is used (with the user's consent), aggregated usage data may be transferred to and processed by Google LLC, headquartered in the United States of America. This transfer is carried out on the basis of Standard Contractual Clauses (SCC) adopted by the European Commission, which ensure an adequate level of protection in accordance with GDPR.

Additional safeguards applied for Google Analytics:

IP address anonymisation before data is transmitted to Google's servers (IP anonymization enabled)
Usage data is aggregated and does not allow direct identification of individual users
No directly identifiable personal data (name, email, user ID) is transmitted to Google Analytics
Users may opt out of Google Analytics tracking at any time via the consent banner or cookie settings

Full details on how Google processes data are available in Google's Privacy Policy: https://policies.google.com/privacy

7. Data retention period

Personal data is retained:

for the duration of the user account
for as long as necessary for the stated purposes
in accordance with applicable legal obligations

Guest data is deleted when the event is deleted or when it is no longer necessary. Upon account deletion, personal data is removed or anonymised within 30 days.

8. Data subject rights

You have the following rights:

right of access
right to rectification
right to erasure
right to restriction of processing
right to data portability
right to object
right to withdraw consent
right not to be subject to a decision based solely on automated processing (GDPR Art. 22)

To exercise your rights, you may contact Luvora at legal@luvoraapp.com. You may log a complaint with the data protection authority in Estonia (Andmekaitse Inspektsioon) or in your country of residence.

9. Data security

Luvora implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or misuse. User passwords are stored exclusively in encrypted form (hashed).

10. Children's data

The Platform is not intended for individuals under the age of 16. We do not knowingly collect personal data from minors under this age. Upon registration, users confirm that they are at least 16 years old.

11. Cookies

We use cookies in accordance with the Cookie Policy. Preferences can be managed via the consent banner displayed on first access to the Platform.

12. Policy updates

We may update this Privacy Policy periodically. The updated version will be published on the Platform. Users will be notified of significant changes.

13. Contact

For any questions regarding data protection, users may contact Luvora via:

The "Contact" form available on the Platform
Direct email for data protection: legal@luvoraapp.com