Privacy notice

Who is responsible

The controller of your personal data is the company that operates Life n’ ROI. For anything about your data, write to me@elizabethsava.com.

What we collect

We collect only what each feature needs:

• Enquiries: your name, email address, phone number and message, and the page you wrote from.
• Accounts: your email address, your password (stored only as a secure hash by our authentication provider), the date you accepted these documents, and the items you save.
• Orders: the service, the amount, the order's status, your email address, your language and, for a visit, the estimated arrival date. Your card or bank details go to Stripe, never to us.
• AI assistant: what you ask the assistant and what it replies form a conversation that is kept only on your device, never on our servers. To understand each request, we send it with earlier messages of that conversation — the first one and up to the last eight — to the AI model providers listed below; they return a result and keep nothing, and we keep nothing either. Please do not include sensitive details, such as health or bank information, in a search.
• Search counts: to protect the search from abuse, we count searches per network, using a one-way hash of your network address that changes every day. It holds no search phrase and is deleted after 24 hours.
• Search selections: when the AI assistant shows a selection of its own — properties, services, investor visits or collections — the selection is kept behind a short link, so that it can be opened again or shared. It holds only what was shown, never who asked for it.
• Voice search: the recording is sent for transcription and then discarded; only the text is used, like a typed search.
• Nearby: your position is used once, in your browser, to frame the map. It is never stored or sent to us.
• Usage statistics: page views and anonymous interactions (such as a message sent to the AI assistant, a filter applied or a save, never what was written), counted without cookies, with addresses stripped of any token, search phrase or session reference.

Why we use it, and on what basis

• To answer your enquiry and to provide the services you buy: the performance of a contract, or the steps you asked for before one.
• To run your account and keep it secure: the performance of a contract and our legitimate interest in preventing abuse.
• To keep accounting records of your orders: a legal obligation.
• To answer your searches and keep your conversation on your device: providing the service you ask for, and our legitimate interest in a search that understands follow-up requests.
• To protect the search from abuse: our legitimate interest in keeping the website secure.
• To understand how the website is used, without identifying you: our legitimate interest.

Who receives it

We use these providers, each only for its own task and under a data processing agreement:

• Supabase: our database and accounts, hosted in the United States.
• Vercel: hosting, usage statistics, and the AI gateway through which search phrases and voice recordings reach the AI model providers.
• AI model providers, currently Anthropic, Google, OpenAI and xAI, reached through that gateway with zero data retention: the text of a search, with earlier messages of your conversation, to understand it, and a voice recording, to transcribe it. They return a result, keep nothing and do not use it to train their models. The replies of the search are written by AI and can be wrong.
• Stripe: payments. Stripe is also responsible for the payment records it keeps, under its own privacy policy.
• Resend: the emails we send you.
• Google Maps: the maps on the website, which receive your network address when they load.
• Vercel BotID: the check that protects sign-up from automated abuse.

Transfers outside your country

Some of these providers process data in the United States and in other countries that may not be yours. Where the law of your country requires it, each transfer relies on a safeguard that law recognises, such as an adequacy decision or framework, or standard contractual clauses.

How long we keep it

• Your conversation with the search: on your device only, for 7 days after your last search, or until you delete it. We keep no copy.
• Search counts: 24 hours, without any search phrase.
• Unpaid orders: 30 days.
• Paid orders: seven years, for accounting, after which the order is anonymised.
• Accounts never confirmed: 7 days.
• Search selections: 180 days. They contain no personal data.
• Enquiries: as long as needed to answer them and follow up with you.

Cookies and local storage

We use only what the website needs to work. We do not use advertising or cross-site tracking cookies.

• NEXT_LOCALE: remembers your language, for a year.
• sb-*: keep you signed in, while your session lasts.
• A save made before signing in is kept in your browser's local storage until you sign in.
• lnr-thread: your conversation with the search, in your browser's local storage on this device, for 7 days after your last search. It is used only to show you your conversation and to give context to your next search. “Delete conversation” erases it at once, as does clearing this site's data in your browser. Anyone using the same browser on this device can see it until then.

Your rights

You can ask us to access, correct, delete, restrict or export your personal data, and object to its use. You can delete your account and its data yourself from the account menu. Write to us to exercise any other right; we answer within one month.

Your conversation with the search is stored only on your device, so we hold no copy to give you, export or delete: you control it with “Delete conversation”.

Depending on where you live, laws such as the GDPR in the European Union, the UK GDPR, Switzerland's FADP, Canada's PIPEDA, Brazil's LGPD or Panama's Law 81 of 2019 give you these rights. We apply them to everyone, wherever you are.

You can also complain to the data protection authority where you live or work — for example, a supervisory authority in the European Union, the Information Commissioner's Office in the United Kingdom, the Office of the Privacy Commissioner of Canada, or the National Authority for Transparency and Access to Information (ANTAI) in Panama.

California residents

We collect the categories of personal information described above, from you and from your use of the website, and share them only with the providers listed above for the purposes described. We do not sell or share personal information for advertising. We do not track you across other websites, so Do Not Track and Global Privacy Control signals change nothing here: there is nothing for them to switch off. We keep each category for the periods listed under “How long we keep it”.

Children

This website is for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, write to us and we will delete it.

Changes to this notice

When we change this notice, the effective date at the top changes. If you have an account, we will tell you by email about a material change before it applies.