Privacy Policy
1. Scope and contact
This Privacy Policy explains how Lacasai processes personal data when you use its websites, services and supported channels, communicate with it, or connect an account. The Service is operated by Lacasai Global. This Policy should be read with the Terms of Service.
For privacy questions or to exercise a privacy right, contact hello@lacasai.com. We may ask for proportionate information to verify your identity and protect your data before acting on a request.
2. Information we process
We process information and content the user provides in any supported format; account, contact and subscription information; settings, preferences and remembered information; connected-account data and related actions that the user authorises; and technical, security, support and transaction records.
We receive this information from you, from services you choose to connect or use to communicate with us, from service providers acting for the Service, and from your use of the Service. Information needed to create and administer the service relationship or perform a request is required for that purpose. Other information and connected accounts are optional, but the corresponding feature may be unavailable without them.
3. Purposes and legal bases
We process personal data to establish and administer the service relationship; provide and personalise requested functions; receive and deliver communications; carry out instructions and confirmed actions; operate connected-account functions; search for and present web and other external information at your request; operate proactive functions you choose to enable; manage subscriptions; provide support; maintain security and reliability; prevent misuse; resolve faults; keep necessary records; comply with legal duties; and handle rights requests, disputes and claims.
Depending on the context, processing is based on steps taken at your request before a contract, performance of a contract, your consent, our legitimate interests where those interests are not overridden by your rights, or compliance with a legal obligation. You may withdraw consent at any time without affecting processing already carried out lawfully. We will not use personal data for an incompatible new purpose without an appropriate legal basis and any notice or consent required by law.
4. Google data and Limited Use
Connecting a Google Account is voluntary. If you connect one, Lacasai accesses only the data covered by the permissions you grant and uses it solely to provide user-facing features that you request or separately consent to.
For Gmail, Lacasai may read and search messages and related data, including attachments, and it sends a message only after the required confirmation. It does not archive, label, mark as read, move or delete messages. For Google Calendar, it may view and manage events on calendars you own, including creating, updating and cancelling events and creating invitations when requested. For Google Tasks, it may read and manage tasks and task lists, including creating, updating, completing and moving tasks and deleting task lists when requested.
If you enable proactive help that includes periodic email review, Lacasai may review recent email to identify time-sensitive entry documents. For an identified trip or event, Lacasai may save a copy of an entry document, such as a boarding pass or ticket, deliver it near the relevant time, and make it available for retrieval during the retention period. You may disable new email reviews at any time. Disabling review does not by itself delete a copy already saved or cancel its scheduled delivery; you may request deletion as described below.
We process and store Google data only to the extent and for as long as necessary to provide the requested or consented feature, protect the Service, or meet legal obligations. We share Google data only with processors acting on our behalf when necessary to provide the requested feature, protect security, or comply with law. We do not sell user content or Google data, use either for advertising, or use either to train generalized AI models.
Human access to Google data is restricted. It may occur only with your affirmative agreement to access specific data, when necessary for security, or when required by law. Lacasai Executive Assistant’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You may disconnect Google at any time through Google Account permissions or by contacting us as described in section 1. Disconnection stops new access. To request deletion of Google data already held by Lacasai, use the contact in section 1.
5. Sharing and international processing
We disclose personal data only as needed to service providers that operate and support the Service; user-selected connected services and action destinations; the merchant of record and payment or transaction parties; professional advisers; parties involved in a corporate transaction; and parties to whom disclosure is necessary to protect rights or safety, investigate misuse, or comply with a valid legal requirement. Each recipient receives only the information necessary for its role. Google data remains subject to section 4.
These recipients may process personal data across borders. Where required, we assess the transfer and use appropriate contractual, organisational, technical or other lawful safeguards. Some recipients act independently under their own terms and privacy notices.
6. Retention and deletion
We retain each category of personal data only for as long as reasonably necessary for the purpose for which it was processed. Retention depends on the nature, volume and sensitivity of the data; the purposes and service relationship; security, support and dispute needs; legal obligations; and the time required for protected backup copies to leave normal rotation. When data is no longer required, we delete or anonymise it.
Saved entry-document copies are normally kept until three days after the relevant event time; if only an event date is available, until the end of that event date plus three days; or, if no event date is available, until three days after the scheduled delivery time. A scheduled sweep then removes them. They may be removed earlier if the related event is cancelled, the document is superseded, or the copy is deleted. Account deletion removes them from active storage, subject to the backup limits below.
Google authorisation credentials are kept while the account is connected and, after disconnection, only for the limited period needed to complete a failed revocation retry. Disconnection stops new access but does not by itself delete other records containing Google data processed before disconnection. A separate deletion request or account deletion causes us to revoke or delete credentials and delete user content, Google data and other personal data under our control, subject to retention needed for law, security or claims and unavoidable backup limits. Deleted data may remain in protected backups until normal rotation, and backups are used only for recovery, security or legal needs. Other recipients may retain their own copies under their applicable notices and duties.
When a subscription ends, whether because cancellation has been confirmed or because a trial expires, access to the Service ends. We immediately revoke Lacasai’s permissions to access connected accounts, including Google, and delete connected-account data cached by Lacasai. If a revocation attempt fails, connected-account access remains disabled while we retry it as described above. We retain the user’s profile and the assistant’s memory and context, encrypted and inactive, for up to 12 months so that the assistant’s existing memory and context remain intact if the user returns. The 12-month period applies separately to each continuous period in which the subscription is lapsed. If the user re-subscribes before that period expires, the account is reactivated and the period stops; a new 12-month period begins if the subscription later ends again. Reconnecting Google requires fresh consent because the previous permissions were revoked.
The user may request earlier deletion of all personal data under our control at any time, including after cancellation or trial expiry, through the contact in section 1. If no earlier deletion is requested and the user does not re-subscribe, we automatically delete the retained profile, memory and context when the applicable 12-month period expires, in accordance with the existing deletion and backup limitations in this section. A content-free audit record showing that the deletion occurred may remain. Transaction and billing records held by the merchant of record may remain with that merchant under its own legal obligations.
7. Controls and rights
You may choose whether to connect Google, withdraw a consent, disable periodic proactive email review, disconnect a connected account, and request access to, correction of or deletion of personal data. Use the contact in section 1 for requests. We may verify your identity, clarify the request and retain a limited record showing that it was handled.
Depending on applicable law, you may also have rights to receive information about processing, obtain a copy, restrict or object to processing, receive portable data, withdraw consent, or make a complaint. These rights may be subject to lawful conditions and exceptions. If we cannot fulfil a request in whole or in part, we will explain the applicable reason.
8. Security and children
We use technical and organisational measures proportionate to the risk to protect personal data against unauthorised access, loss, alteration or disclosure and to preserve its confidentiality, integrity and availability. No system is completely secure.
The Service is not directed to anyone under 18, and we do not knowingly process a child’s personal data. If you believe a child has provided personal data, contact us so that we can review and address it.
9. Changes and contact
We may update this Policy to reflect changes in the Service, our practices or legal requirements. We will post the revised date and, where appropriate, provide reasonable notice of a material change. If a change requires consent, we will seek it before the relevant processing begins.
Use the contact in section 1 for questions, rights requests and privacy complaints.