Privacy Policy

This Privacy Policy explains how Losava, operated by Arjay McCandless LLC, a Delaware limited liability company doing business as “Losava” (“Losava,” “we,” “us,” or “our”), collects, uses, and shares information when you use our AI-assisted wedding-planning service (the “Service”). By using the Service you agree to this Policy and to our Terms of Service.

1. Information We Collect

Account information. When you sign up, our authentication provider Clerk collects your name, email address, and login credentials, and we store a profile (name, email, avatar) in our database.

Wedding-planning information you provide.This includes onboarding answers (partner names, wedding date, location, venue type, estimated guest count, budget, style preferences, and priorities), and the planning data you create or import — budgets, vendors, timelines, seating charts, tasks, and wedding website content.

Information about other people. To help you plan, we store information you provide about third parties, such as guest and collaborator names, email addresses, phone numbers, mailing addresses, RSVP status, meal and dietary preferences, and vendor contact details. You are responsible for having the right to share this information with us.

Conversations and uploads.We store your chat messages with the AI assistant, the assistant’s responses, and files you upload (for example CSV, Excel, PDF, Word, image, or text files such as guest lists or vendor sheets), along with data parsed from them.

Connected Google account (Gmail).If you choose to connect your Google account, we store an encrypted Google refresh token and your connected Gmail address so we can send the vendor outreach you approve from your own inbox and track the replies to those messages. We access only the email threads Losava created on your behalf; we do not read, index, or store the rest of your mailbox. See the “Google Account Data and Limited Use” section below for details.

Payment information. Subscription payments are handled by Stripe. We do not store your full card number; we receive and store limited billing data such as your Stripe customer and subscription identifiers, subscription status, trial and renewal dates.

Usage, device, and diagnostic data. We collect analytics events (via Amplitude), error and performance data (via Sentry), AI usage metrics (such as token counts and cost used for budgeting and rate limiting), and standard log data such as IP address, browser type, and timestamps.

2. How We Use Information

• To provide, operate, personalize, and improve the Service;
• To generate AI-assisted suggestions, drafts, plans, and other output you request;
• To process payments, manage subscriptions and trials, and enforce usage limits;
• To send transactional emails (such as welcome messages, collaborator invitations, and account notices) via Resend;
• To provide collaboration features and, where you choose, publish a public wedding website;
• To secure the Service, prevent abuse, debug issues, and analyze usage; and
• To comply with legal obligations.

3. AI Processing

The Service uses third-party AI models provided by OpenAI to generate responses. When you interact with the assistant, the relevant content of your messages and certain planning context is sent to the AI provider to produce a response. Large datasets you import (for example, hundreds of guest records) are processed on our servers and are not necessarily sent to the AI provider. If you connect your Gmail account, the content of vendor email threads Losava created for you may also be processed by OpenAI as described in the “Google Account Data and Limited Use” section below. We do not use the AI provider’s API to train models on your data, and we rely on the provider’s commitments regarding data handling. AI output may be inaccurate; please review it before relying on it.

4. Google Account Data and Limited Use

What we access. When you connect your Google account, you authorize Losava to send email on your behalf (the Gmail gmail.send scope) and to read messages (thegmail.readonlyscope). We use this access for a single feature: sending the vendor outreach emails you approve from your own Gmail account, and detecting and showing the vendor’s replies to those messages in your vendor conversation view. In practice we only fetch the specific threads Losava started by sending outreach for you. We do not read, scan, or store the rest of your mailbox.

AI processing of Gmail data.To power the vendor reply features you use, such as summarizing a vendor’s reply, detecting a quoted price, and suggesting a response for you to review, the content of these Losava-created email threads is processed by our AI provider, OpenAI, acting as a service provider on our behalf. This happens only for user-facing features you initiate. OpenAI does not use this data to train its models, and we do not use Gmail data to develop, improve, or train generalized AI or machine learning models. No AI output is sent to a vendor without your review and explicit approval.

How we protect it.Your Google refresh token is encrypted with AES-256-GCM before it is written to our database, and the encryption key is held separately from the database. You can disconnect at any time in Settings, which revokes Losava’s access at Google and deletes the stored token from our systems.

Limited Use.Losava’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We do not use Gmail data for advertising. We do not sell it. We do not transfer it except as necessary to provide or improve this feature, to comply with applicable law, or as part of a merger or acquisition with notice to you. We do not allow humans to read it except with your consent for specific messages, as needed for security or abuse investigations, to comply with the law, or where the data has been aggregated and anonymized. We do not use Gmail data to develop, improve, or train generalized AI or machine learning models.

5. How We Share Information

We do not sell your personal information. We share information only:

• With service providers who process data on our behalf to run the Service, including Clerk (authentication), Supabase (database and file storage), Stripe (payments), OpenAI (AI), Google (Places/vendor data), Resend (email), Amplitude (analytics), Sentry (error monitoring), and Upstash (rate limiting);
• With collaborators you authorize and, for content you choose to publish on a wedding website, with anyone who has the link;
• For legal reasons, when required by law or to protect our rights, users, or the public; and
• In a business transfer, such as a merger, acquisition, or sale of assets, subject to this Policy.

6. Data Retention

We retain your information for as long as your account is active and as needed to provide the Service. When you delete your account or specific data, we will delete or anonymize the associated personal information within a reasonable period, except where we must retain it to comply with legal obligations, resolve disputes, prevent abuse, or enforce our agreements (for example, billing records). Some data may persist in backups for a limited time before being overwritten.

7. Security

We use technical and organizational measures to protect your information, including encryption in transit, access controls, and database row-level security. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Rights & Choices

Depending on where you live, you may have rights to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can update much of your information in your account settings, manage billing through the Stripe portal, and unsubscribe from non-essential emails using the link in those messages. To exercise any right, contact us at arjay@losava.com. We will respond as required by applicable law.

California (CCPA/CPRA) and EEA/UK (GDPR)residents have additional rights, including the right not to be discriminated against for exercising them and the right to lodge a complaint with a supervisory authority. We do not sell or “share” personal information for cross-context behavioral advertising.

9. Children

The Service is not directed to, and we do not knowingly collect personal information from, children under 18. If you believe a child has provided us information, contact us and we will delete it.

10. International Users

We operate in the United States, and our service providers may process your information in the United States and other countries. By using the Service, you understand your information may be transferred to and processed in jurisdictions with different data protection laws than your own.

11. Changes to This Policy

We may update this Policy from time to time. We will update the “Last updated” date above and, for material changes, provide additional notice where appropriate. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

12. Contact

Questions or requests regarding this Policy or your data? Contact us at arjay@losava.com.

Back to sign up