Draft — pending legal review
This page has not been reviewed by counsel and is not yet in force. Text in [[double brackets]] is a placeholder for a decision the business still has to make.
Privacy Policy
Last updated: [[LAST UPDATED DATE]]
This policy explains what personal data Livqeno collects, why, how long we keep it, and the rights you have. It covers developers who use our website, dashboard and APIs. If you are a user of an app built with Livqeno, read section 2 first.
1.Who we are
Livqeno provides hosted APIs and SDKs for real-time video, voice, chat and live streaming to developers and businesses (our “customers”). The company responsible is [[LEGAL ENTITY NAME]], [[REGISTERED ADDRESS]].
- Privacy contact: [[PRIVACY CONTACT EMAIL, e.g. privacy@livqeno.com — confirm the mailbox exists]]
- Data protection officer: [[DPO NAME, or “not required under Art. 37 GDPR” with reasoning]]
- EU representative (Art. 27 GDPR): [[NAME AND ADDRESS, if the entity has no EU establishment]]
- UK representative: [[NAME AND ADDRESS, if required]]
2.Our two roles
We handle personal data in two different capacities, and this policy treats them separately.
| Data | Livqeno’s role | Who decides how it is used |
|---|---|---|
| Developer account data: dashboard users, team members, billing contacts, support and security emails | Controller | Livqeno, under this policy |
| Platform security and abuse data: rate-limit counters, audit logs, sign-in activity | Controller | Livqeno, for security (legitimate interests) |
| End-user data our customers process through the APIs: audio and video, chat messages and attachments, identities, telemetry, push tokens | Processor | Our customer, the controller, under our DPA |
3.Information we collect as controller
Account and sign-in
- Your email address and name, and whether your email is verified.
- Your password, stored only as a bcrypt hash. We cannot read it.
- If you sign in with GitHub or Google: your account ID with that provider, your email and your name. We do not receive your password for those services.
- If you turn on two-factor authentication: your authenticator seed, encrypted with AES-256-GCM, and hashes of your recovery codes.
Onboarding answers
The use cases, experience level and technology stack you choose during onboarding, if you answer.
Projects and teams
- Project names and settings, team memberships and roles, and in-app notifications.
- API key metadata: the public ID and when the key was last used. The secret part is stored only as a hash and is shown to you once.
Billing
Your plan, currency, billing email, billing name and country. No payment provider is connected yet, so we do not collect card or bank details. [[UPDATE when a payment provider is integrated]]
Usage
Metering records per project, room and participant identity, such as RTC minutes. We use them to enforce plan limits and, later, to bill.
Security and activity logs
- Project audit logs: who changed what (keys, members, webhooks, project settings), with the actor’s email, IP address and browser user agent.
- Account activity, such as sign-ins, with IP address and user agent.
- Server request logs: method, path, status code and a request ID. We do not log request headers or bodies. Media servers log client IP addresses.
When you contact us
The content of emails you send to support or security, and of WhatsApp messages if you contact us there. WhatsApp is operated by Meta, and its own privacy policy applies to that channel.
This website
livqeno.com sets no cookies and runs no analytics, advertising or tracking scripts. Our hosting provider (Vercel) processes standard request data, including your IP address, to deliver the pages.
4.Data we process for our customers
When our customers’ apps use the Services, we process the following on their behalf and only on their instructions:
- identifiers the customer chooses, such as participant identities, user IDs, and room and conversation names, plus any metadata the customer attaches;
- chat messages, edit history, reactions, read state and attachments;
- push device tokens and notification payloads, if the customer enables push;
- connection telemetry: SDK, platform, browser, network type and call-quality metrics, with timestamps;
- IP addresses in transient server logs;
- audio and video streams, in transit;
- live-stream output (HLS segments and recordings), if the customer uses live streaming.
We do not record calls. Our media servers forward audio and video packets in memory and do not store them. Live-stream output is the exception: it is written to object storage and is public to anyone with the playback URL.
Our Data Processing Addendum sets out the terms of this processing.
5.How we use account data and our legal bases
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Creating and running your account, projects and API keys; providing the Services | Contract, Art. 6(1)(b) |
| Transactional emails: email verification, password reset and service notifications | Contract, Art. 6(1)(b) |
| Security: authentication, two-factor, rate limiting, audit logs, preventing abuse and fraud, investigating incidents | Legitimate interests in keeping the Services and our customers secure, Art. 6(1)(f) |
| Metering usage and enforcing plan limits; billing | Contract, Art. 6(1)(b) |
| Understanding what developers build, from onboarding answers, to improve the product | Legitimate interests, Art. 6(1)(f) [[CONFIRM]] |
| Answering support and security requests | Contract, or legitimate interests |
| Meeting legal and tax obligations, and responding to lawful requests | Legal obligation, Art. 6(1)(c) |
We do not sell personal data, and we do not use it for advertising. We do not send marketing email today. [[If marketing email is introduced, add it here with a consent basis and an opt-out]]
7.International transfers
Our providers operate in several countries, so your data may be processed outside the country where you live. Current locations:
- Database (Supabase, on AWS): [[SUPABASE PROJECT REGION]]
- API and media servers: [[INFRASTRUCTURE PROVIDER AND DATA CENTRE LOCATION]]
- Transactional email (Resend): appears to send from Tokyo, Japan (ap-northeast-1). [[VERIFY]]
- Object storage for attachments and live-stream output: [[PROVIDER AND REGION]]
- Dashboard, docs and this website (Vercel): global edge network.
Where we transfer personal data from the EEA, UK or Switzerland to a country without an adequacy decision, we rely on [[TRANSFER MECHANISM per provider, e.g. EU Standard Contractual Clauses, UK IDTA, EU-US Data Privacy Framework]].
8.How long we keep account data
“No set period” below means we have not yet built automatic deletion for that data. We are deciding retention periods for each and will update this table.
| Data | Kept |
|---|---|
| Account profile, password hash, two-factor data | Until you delete your account |
| GitHub and Google sign-in links | No set period [[DECIDE]] |
| Email-verification and password-reset tokens | Until used or replaced |
| Onboarding answers, notifications | Until you delete your account |
| Projects, memberships, API key metadata | Until the project is permanently deleted (30 days after you schedule it). Revoked API key metadata is kept with the project |
| Project audit logs | Deleted with the project. Entries in other people’s projects keep your email after you delete your account, as a security record |
| Account activity log | No set period [[DECIDE]]. When you delete your account, your email, IP address and user agent are removed from it |
| Usage and metering records | No set period, needed for billing [[DECIDE]] |
| Server request logs | No set period [[DECIDE, e.g. 30 days]] |
| Database backups | Until they expire on our provider’s schedule: [[BACKUP RETENTION]] |
For data we process for customers, the customer sets retention. Defaults: chat messages are kept until the customer deletes them or sets a retention period; the chat event log is kept 7 days; connection telemetry and client errors are kept 30 days.
9.Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to how we use it, and to withdraw consent where we rely on it.
Do it yourself in the dashboard
- Edit your name and other profile details.
- Export your data as JSON under Settings → Security: your profile, sign-in methods, memberships, the projects you own with their API key metadata, notifications and your activity.
- Delete your account under Settings → Security. Schedule each project you own for permanent deletion first.
Ask us
For anything else, email [[PRIVACY CONTACT EMAIL]]. We will answer within one month, and may need to confirm your identity first.
You also have the right to complain to a data protection authority, such as the one where you live or work. [[LEAD SUPERVISORY AUTHORITY, if any]]
[[ADD jurisdiction-specific rights that apply, e.g. US state privacy laws (CCPA/CPRA) or India’s DPDP Act]]
End users of customer apps
Contact the app’s operator. Our customers have API tools to export a user’s chat data (GET /v1/chat/users/{userId}/export) and erase it (DELETE /v1/chat/users/{userId}/data). Call participant and usage records cannot be erased through the API yet; we are building that.
11.Children
The Livqeno dashboard and website are for developers and businesses, not children. You must be at least [[MINIMUM AGE]] to create an account, and we do not knowingly collect account data from children. If a customer’s app is directed at children, that customer is the controller of its end users’ data and is responsible for meeting child-privacy laws such as COPPA and for obtaining any parental consent.
12.Security
We encrypt data in transit, hash passwords and API key secrets, encrypt stored signing secrets and third-party credentials, scope every credential to one project, and log security-relevant changes. Livqeno does not hold SOC 2, ISO 27001 or HIPAA attestations. Our Security page describes what is in place and what is still in progress. Report a vulnerability to security@livqeno.com.
13.Changes to this policy
We will update the date at the top of this page when we change this policy. For a material change, we will tell account holders by email or in the dashboard at least [[NOTICE PERIOD]] before it takes effect.
14.Contact
- Privacy requests: [[PRIVACY CONTACT EMAIL]]
- Security: security@livqeno.com
- Post: [[LEGAL ENTITY NAME]], [[REGISTERED ADDRESS]]