Privacy policy

Accounts, photos, assessments, providers and your rights.

Version: 23 October 2026. Information about using LiraProtect, protecting your data and your rights.

1. Controller

Owner: Mary Alejandra Sánchez Gabarre, self-employed professional. NIF: 49208010Q. Address for communications: Calle Isla de Palma 39, 5, 28703 San Sebastián de los Reyes (Madrid), Spain. Public contact and data-rights email: maryalejandrasanchezg@gmail.com.

2. Data processed

We process your name, email, protected password and session data to manage your account. Guidance uses messages, photographs, descriptions, preferences and constraints you share, together with generated answers and reports. We also store homes you create, conversation and report assignments, enquiries and usage, security and consumption records. Subscription records contain Stripe customer and transaction references and status, not full card numbers or security codes. We retain a copy of accepted terms, payment confirmation and withdrawal requests and receipts to document the contract and handle legal obligations or claims. Abuse controls may use an IP-address hash; this does not guarantee anonymity. Hosting providers may keep technical logs.

3. Purposes and legal bases

Account management, requested guidance, saved conversations and reports and subscriptions relate to performing the service or requested precontractual steps (GDPR Article 6(1)(b)). Tax, accounting and rights-handling obligations rely on applicable legal obligations (Article 6(1)(c)). Session security, abuse prevention and consumption controls rely on legitimate interests in security and service sustainability, subject to appropriate safeguards and balancing (Article 6(1)(f)). You choose what to send: requesting an answer communicates relevant information to the AI provider. Attaching a photograph requests private storage and an answer using it; it may be reused with later messages in that conversation. Accepting cookies or terms does not authorise advertising or unrelated purposes. Do not supply unnecessary special-category or third-party personal data.

4. Photos

Selecting a file creates a local preview, not a publication. For an authorised operation the server validates the image, removes embedded metadata and generates reduced versions and thumbnails. This does not remove personal information visible in the picture. Files are kept in private Supabase storage, served with ownership and expiry checks and without public caching. If you request a report from the chat, it is saved as an independent report with private copies of its photos. Deleting the original conversation does not delete that report: delete it separately or close your account to remove both. Do not upload other people’s homes or images without permission, identity documents, health data or unnecessary sensitive information.

5. Providers

Render hosts the application; Supabase provides PostgreSQL and private storage. To answer your Lira queries, OpenAI receives selected reduced images, description, relevant context and necessary document fragments. When available in chat, Lira can use OpenAI web search to check public information and display source links. Search queries may be processed by the service’s search providers. Instructions exclude personal data and identifying details about the home from queries; do not include sensitive information in a search request. Web results can contain errors and do not by themselves substantiate a claim. Requests use store:false; that does not guarantee zero retention or override provider contracts. Password recovery, contract confirmations and withdrawal acknowledgements use the configured mail provider: Google Gmail API, authorised by the sending account, or Resend. It receives the recipient address and the relevant service message, which may include a contract or receipt. The integration does not need to read the mailbox or send photos, reports or conversations to that provider. When you subscribe, Stripe processes payment and receives your account email and references needed to manage the customer and subscription. The application retains customer, subscription and transaction identifiers and their status to verify access. It does not receive or store the full card number or security code. Photos and conversations are not sent to Stripe for purchasing. Stripe applies its own privacy policy at checkout and in its customer portal. Photos are not sold or shared with advertisers or a professional network. Registering an enquiry does not automatically send data to specialists.

6. Location and international transfers

The selected Supabase project region is Europe, which does not establish that all processing, support or subprocessors remain in the EEA. The providers may process outside your country. Before enabling these functions, verify processing agreements, locations, subprocessors and applicable transfer safeguards, including standard contractual clauses where required. Unchecked safeguards are not represented as verified.

7. Retention and deletion

Authorised report chat sends its text, your question and six recent exchanges without resending photos. The full conversation view, including continuation from an assessment, also sends that space’s attached photos with each message. With text-only input, no photos are sent and AI must not claim to have seen the home. No report is generated automatically. Messages are stored with the conversation. Reports are independent copies: deleting the conversation does not delete a saved report or its private image copies. Delete these separately or close the account. Generating or updating a report uses the saved conversation and requires an explicit request; reports do not update automatically. The interface may show only some saved messages. Usage records are retained for cost and safety controls and unlinked from the account when it is closed. Guest access to queries and photos expires in 24 hours. Physical cleanup runs at startup and while the application is active and may be delayed when free hosting sleeps. Valid guest data can be adopted into an account and cease to be temporary. Account photos, conversations, homes and reports remain until deleted or the account is closed. Access cookies last up to 30 days and guest cookies up to 24 hours; recovery links expire in 30 minutes. Technical, usage and certain transaction references may remain for security, incident handling or applicable obligations; Confirmed contracts are retained for six years after the end of the last verified paid period; withdrawal receipts for six years after receipt; unconfirmed checkout copies for 30 days. When an account is closed, necessary contractual evidence is separated from normal account access and retained with restricted access for obligations and claims during that period. Guest usage logs are removed after 30 days; records detached from closed accounts after 395 days from their creation. Active-account use counters remain while the account exists. Cleanup runs while the application is active and may be delayed during hosting suspension. Provider backup retention and rotation still require specific verification; instant backup erasure is not guaranteed. Application deletion does not guarantee instant removal from provider logs or backups.

8. Rights

Under the GDPR you may request access, rectification, erasure, restriction, portability or objection where applicable. Authorisation may be withdrawn for future consent-based processing without affecting prior lawfulness. Deleting an assessment cannot undo data already transmitted to a provider. Delete conversations and reports in My home, close your account in My profile or write to maryalejandrasanchezg@gmail.com; only necessary proportionate identity checks will be requested, not an ID copy by default. You may complain to your competent supervisory authority; in Spain, the AEPD at www.aepd.es. The general GDPR response period is one month, subject to legally permitted extensions.

9. Adults, automated decisions and security

This version is intended for adults, not for children’s or special-category data. AI suggestions do not make decisions with legal or similarly significant effects and do not replace professionals. Encryption, protected passwords, restricted session cookies and access controls reduce but do not eliminate risk. Never include passwords or keys in photos or requests.

10. Changes and further information

Read Cookie policy and AI notice. Material changes will be visibly communicated and fresh authorisation requested when required before enabling a new purpose. This policy does not authorise undisclosed trackers or providers. This English version reflects the Spanish information; applicable mandatory rights remain unaffected.