Privacy Policy
Last updated: 12 October 2026
This policy explains how Enzo Yerna (Argentina), trading as Lukron ("we", "us"), handles personal information when you visit our websites or use our products (CertExpiry, QuoteFollow, VendorRenew, CheckRegister), together the "Services". For questions or requests, email support@lukron.app.
1. Two roles: our data and your data
- Our role as controller. We decide how to handle information about our own visitors and customers: your account, billing, support emails and security logs. This policy covers that information.
- Our role as processor. The records you enter in a workspace can include information about other people, such as subcontractors, vendors, customers or staff. For that "Customer Data", you (our customer) are the controller and we process it only on your behalf, as set out in section 9 of our Terms of Service. If your details are in someone else's workspace, please contact that business first. We will help them answer your request.
2. What we collect
- Account information: email address, password (stored only as a salted hash), name if you add it, business name, time zone and alert preferences.
- Customer Data: whatever you choose to enter. For example: names, emails and phone numbers of contacts; document, licence or check numbers and their expiry dates; quote, contract and vendor details; amounts and notes.
- Billing information: Paddle.com processes payments as our Merchant of Record. We never see or store full card details. Paddle shares with us your subscription status, plan, a customer identifier, your billing country and the amounts paid and refunded.
- Security and audit logs: sign-ins, failed sign-in attempts, important account actions (such as exports, deletions and invitations), the IP address and time.
- Product usage events: simple counts such as "signed up", "added a first record" or "started checkout", linked to a workspace number. They never contain the content of your records.
- Server logs: standard web server logs (IP address, time, page requested, browser type), used for security and troubleshooting.
- Communications: emails you send us, and your waitlist sign-up (email, business name, optional note and marketing choice) if you join one.
We do not ask for sensitive information (such as health information or criminal records), and our Terms ask customers not to enter it.
3. How and why we use it
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Create and run your account; send the reminders, digests, weekly summaries, invitations and account emails that the Service consists of | Performance of our contract with you |
| Take payments, manage subscriptions and refunds, keep accounting records | Contract; legal obligation |
| Keep the Services secure, prevent abuse and fraud, fix problems | Legitimate interests |
| Understand, in aggregate, which pages and features are used, and improve the Services | Legitimate interests |
| Answer your questions and requests | Contract; legitimate interests |
| Send product news or offers, only if you opted in | Consent, which you can withdraw at any time |
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not make decisions about you based solely on automated processing.
4. Who we share it with
We share personal information only with the service providers (sub-processors) we need to run the Services. Each one is bound by contract to protect it and use it only to provide its service to us:
| Provider | Purpose | Location |
|---|---|---|
| Our server hosting provider | Hosts the application, database and backups | Los Angeles, United States |
| Resend | Delivers our emails (alerts, account emails) | United States |
| Cloudflare, Inc. | DNS, and forwarding of emails sent to our support address | United States (global network) |
| Paddle.com Market Limited | Merchant of Record: checkout, payments, invoices, taxes, refunds | United Kingdom |
If we use an off-site storage provider for backups, backups are encrypted before upload, so that provider cannot read them. We may also disclose information if required by law, to protect our rights or the safety of others, or to a buyer or successor of the Services, who would be bound by this policy.
5. International transfers
We are based in Argentina, a country the European Commission and the United Kingdom recognise as providing an adequate level of data protection. Our servers are in the United States and some providers are in the United Kingdom, so your information is transferred to and stored in those countries. Where the law requires it, these transfers rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the provider's certification under the EU-U.S. Data Privacy Framework.
Australia: by using the Services, you acknowledge that your information will be disclosed to and held by recipients in the United States, the United Kingdom and Argentina. We take reasonable steps to ensure those recipients handle it in a way consistent with the Australian Privacy Principles.
6. How long we keep it
- Account and Customer Data: kept until you delete it or your workspace. Deleting the workspace removes its data from our live systems immediately. If a trial ends without a subscription, we keep the workspace for at least 12 months so you can come back. After that we may delete it, with at least 30 days' email notice.
- Backups: database backups are rolled over automatically, and deleted data disappears from them within 60 days.
- Security and audit logs: 13 months. When a workspace is deleted, personal details in its log entries are removed.
- Reminder delivery records (which reminder was sent, and when): 13 months.
- Product usage events: 25 months.
- Server logs: rotated automatically and kept only for a short period.
- Payment records: as long as tax and accounting law requires.
- Live demo workspaces (no sign-up): deleted automatically after 24 hours.
- Waitlist entries: until you ask us to remove them.
7. Security
All connections use HTTPS. Passwords are stored only as salted hashes, and each customer's workspace is kept separate from all others. Sign-in attempts are rate-limited, staff access requires two-factor authentication, and production access is limited to authorised personnel using key-based authentication. Database backups are made daily and tested automatically by restoring them, and any off-site copy is encrypted. No system is perfectly secure. If a breach is likely to put you at risk, we will notify you and the relevant authorities as the law requires.
8. Cookies
We use only strictly necessary cookies: a session cookie that keeps you signed in, and a security cookie that protects forms against cross-site request forgery. Each product uses its own cookies, which are not shared between products. We do not use advertising or tracking cookies, so there is no cookie banner.
9. Emails we send
Alert digests and weekly summaries are part of the Service. Each person can turn them off with the one-click unsubscribe link in every email, or in Settings. Account and security emails, such as email confirmation and password reset, are sent when needed. If an address bounces permanently or reports our email as spam, we stop sending alerts to it.
10. Your rights
You can see, export, correct and delete most of your information yourself, in Settings. You can also email support@lukron.app to:
- access the personal information we hold about you, or get a copy in a portable format;
- correct it, or have it deleted;
- object to, or ask us to restrict, how we use it;
- withdraw consent to marketing at any time.
We will answer within 30 days, and may need to confirm your identity first. You will not be treated differently for using your rights. If you are not satisfied with our answer, you can complain to your data protection authority:
- Australia: Office of the Australian Information Commissioner (oaic.gov.au)
- United Kingdom: Information Commissioner's Office (ico.org.uk)
- European Union: the supervisory authority of your country
- Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca)
- United States: residents of California and other states with privacy laws can exercise the rights above. We do not sell or share personal information, and do not use or disclose sensitive personal information.
- Argentina: see the next section.
11. Argentina (Law 25,326)
The owner of personal data has the right to access it free of charge at intervals of no less than six months, unless a legitimate interest is shown, under article 14, paragraph 3 of Law No. 25,326. The Agency for Access to Public Information (Agencia de Acceso a la Información Pública), as the supervisory authority under Law No. 25,326, has the power to handle complaints and claims from anyone whose rights are affected by a breach of the data protection rules in force.
12. Children
The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect information from children. The Services are designed to record details of adults (for example staff, contractors and vendors), and customers should not enter information about children.
13. Changes to this policy
We will post any update here and change the date above. If a change materially affects how we use your information, we will email account owners before it takes effect.
Contact
Enzo Yerna (Argentina) · Lukron · support@lukron.app