Privacy Policy

Version 1.0, effective 19 October 2026.

LuvoScore is provided by Luvo Pty Ltd (ABN 67 603 011 392), Sydney NSW (“we”, “us”). We're bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and this policy explains how we handle personal information in connection with LuvoScore.

1. What we collect

• Account details. When you sign up: your first and last name, work email address and business name, and whether you'd like optional tips by email. If you set a password, our authentication provider stores it in a protected (hashed) form. We also record when your account was created, when you last signed in and which version of our Terms you accepted.
• Billing details. When you subscribe, Stripe collects your payment card and billing details, and may collect your business name, address and ABN for invoices. We receive and keep your Stripe customer reference, your subscription status and billing dates. We never see or store your full card number.
• Websites and scans. The website addresses you add, when you confirmed you may test each one, how and when each site was confirmed as yours (including the email address used to confirm it), and each scan's date, settings and the IP address it was requested from (to prevent misuse).
• What we find on websites. Scans load pages from the website being tested. Reports can include screenshots of the home page, extracts of page text and code, page addresses, and contact email addresses published on the site. If those pages show information about people (for example staff names or contact details), it can end up in the report. We collect it only to produce the report.
• Emails and support. Emails you send us, and records of the emails we send (such as sign-in links, site confirmation emails, weekly reports and billing notices).
• Technical information. Our hosting and database providers keep server and security logs, which can include IP addresses, browser details, the pages requested and error messages. We use a sign-in cookie to keep you signed in. We don't use advertising or analytics cookies on luvoscore.com.

We don't ask for, store or use the passwords to your own website. When a site has been confirmed, our tests fill in forms using made-up test details (such as a test name and an email address on luvoscore.com), not your personal information.

2. How we use it

We use personal information to create and run your account, sign you in, run scans and show your reports, confirm who controls a website, send service emails (sign-in links, reports, confirmations, weekly summaries and billing notices), take payments, provide support, keep LuvoScore secure and prevent misuse, and meet our legal obligations. If you opt in, we'll also send occasional tips. We don't sell personal information.

3. AI analysis

Scans use Anthropic's Claude AI to explain results in plain English and, on deep scans, to try common customer tasks on the site. To do this we send Anthropic the website address, the scan results, screenshots and visible text from the pages being tested, and (on confirmed sites) the made-up test details used to fill in forms. We don't send your account details. Anthropic's published terms say it doesn't use this data to train its models, and deletes it from its systems within 30 days except in limited cases (for example content flagged for misuse, or where the law requires it). Anthropic may process it in any country where it runs its service, and stores it in the United States. AI-written content in reports is labelled, and observations made only by AI don't change your score.

4. Who we share it with, and where

We share personal information only with service providers that help us run LuvoScore, with our professional advisers, and where the law requires it. Your account details and reports are stored in our database in Sydney, Australia, including its backups, and the LuvoScore application runs in Sydney. Some information is processed or accessed overseas:

• Supabase (database and sign-in). Data and backups are stored in Sydney. Its logs are stored in the European Union, and its support staff (in various countries, including the United States) may access data when we ask for help or during a security incident.
• Fly.io (application hosting, Sydney). Its records about our use of the service, and our application's server logs, may be processed in the United States.
• Stripe (payments). Stripe may process payment and billing information in countries including the United States and India.
• Resend (email delivery). Records of the emails we send, including recipients' email addresses, are stored in the United States.
• Anthropic (AI analysis). See section 3. Anthropic is based in the United States.

LuvoScore staff (employees of Luvo Pty Ltd) can see account details, scans and reports so they can support customers. Access is limited to staff who need it, and views of customer details in our admin portal are logged.

5. Report links

Each report has its own long, hard-to-guess link. Anyone who has a report's link can see its summary, including the score, issue titles and the contact email shown on the site. Full details (fixes, exact locations and AI tester steps) are only shown to the signed-in account that owns the site, if it's subscribed, and to LuvoScore staff.

6. Security

We use access controls so customers can only see their own sites and reports, keep administrator access limited, connect to our providers over encrypted connections, and keep secret keys out of our code. No system is completely secure. If a data breach is likely to cause serious harm, we'll notify affected people and the Office of the Australian Information Commissioner as the law requires.

7. How long we keep it

We currently keep account details, sites, scans and reports for as long as your account is open, so you can see your history. Removing a website from your account stops future scans, but its past reports remain. When we close your account at your request, we delete your account details, websites and reports. Copies in database backups are deleted when those backups expire on our provider's schedule. Site confirmations last 12 months. Stripe and our other providers keep records under their own policies and legal obligations, for example tax and payment records.

8. Emails and unsubscribing

Service emails (sign-in links, reports, site confirmations, weekly summaries and billing notices) are part of using LuvoScore. You can switch off weekly re-scans and their summaries for each site in My sites. Tips are only sent if you opt in, and you can turn them off at any time in your Account page. Any tips email will include an unsubscribe link, and we'll act on requests within 5 working days.

9. Access, correction and deletion

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to close your account and delete it, by emailing hello@luvoscore.com. We may need to confirm your identity first. We'll respond within 30 days. If we can't do what you ask, we'll explain why.

10. Complaints

If you think we've mishandled your personal information, email hello@luvoscore.com with the details. We'll acknowledge your complaint, look into it, and give you our response within 30 days. If you're not satisfied, or don't hear back within 30 days, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

11. Changes

We'll update this policy when our practices change and show the version date below. If a change materially affects how we handle your information, we'll email account holders.

Version 1.0, effective 19 October 2026. See also our Terms of Service.