Privacy policy
Última atualização: 22 août 2026
Tradução de cortesia. Em caso de divergência, prevalece a versão francesa.
What Laburo records, why, for how long, and what you can demand at any time.
1. Who is responsible
HKBROTHERS LIMITED (Companies Registration Office (CRO), Irlande no. 795844), 51 Bracken Road, Dublin, Irlande, is the controller for the data of its tradesperson users.
For the data of the tradesperson's own customers — the name, address and email of the person they send a quote to — the tradesperson is the controller and Laburo acts as a processor, on their instructions alone.
Contact for any question or request: contact@laburo.eu.
2. What is collected, and why
| Data | Why | Legal basis |
|---|---|---|
| Email, password, phone number | Create and secure the account, attach documents to the right tradesperson | Performance of the contract |
| Company number, legal name, address, insurance, IBAN | Show the mandatory particulars on quotes and invoices | Legal obligation |
| Contact details of the tradesperson's customers | Draw up and send the documents | Performance of the contract (Laburo is a processor) |
| Voice messages and their transcription | Produce a quote from a dictation | Performance of the contract |
| Job site photos and their geolocation | Build the before/after evidence file the tradesperson asked for | Performance of the contract |
| Quotes, invoices, credit notes, payments | Provide the service and meet accounting obligations | Contract and legal obligation |
| Technical logs (errors, API calls) | Detect outages and abuse | Legitimate interest |
No data is sold, rented or transferred. No advertising, no advertising profiling, no resale to third parties. There is no automated decision producing legal effects: the pricing suggested by the assistant is a suggestion, the tradesperson approves it and remains the sole issuer of their documents.
3. For how long
| Data | Period | Reason |
|---|---|---|
| Dictations (audio files) | For the duration of processing, barring incident | The API deletes the audio after processing. A periodic clean-up picks up orphaned files older than two hours whenever the clean-up service is running. |
| Conversation transcriptions | 30 days | The raw transcription is purged; the information carried into the quote stays in that document. |
| Draft quotes | Until deleted or until the account is closed | Preparing and finding documents in progress |
| Invoices, credit notes and accounting records | 10 years | Accounting obligation — the necessary records are retained with restricted access after the account is closed. Some company and works information remains inside those records. |
| Job site photos | In the job site file until the account is closed | Building the file the tradesperson asked for; the files are deleted when the account is actually closed. Export the files you need before doing so. |
| Sign-in account | Until the account is actually closed | The sign-in identity and sessions are deleted; data tied to retained records is handled separately. |
4. Who the data is shared with
Only technical providers, each for a specific function, and never beyond it:
| Provider | Role | Location |
|---|---|---|
| Supabase | Database, authentication, photo storage and dictation transit | European Union |
| Railway | API hosting | European Union (Amsterdam) |
| Vercel | Website and customer area hosting | European Union |
| Resend | Sending emails (quotes, invoices, reminders) | European Union (eu-west-1) |
| Stripe | Payment of subscriptions and deposits | European Union / United States |
| OpenAI | Transcription of voice messages | United States |
| Anthropic | Drafting and pricing the quote from the transcription | United States |
Transfers to the United States are covered by the European Commission's standard contractual clauses and, where applicable, by the Data Privacy Framework.
Content sent to OpenAI and Anthropic is not used to train their models: these providers are used through their business interfaces, which exclude training by default.
5. Your rights
Optional notifications: with your phone permission, Laburo processes a notification identifier linked to your session and business. Expo, Google (FCM) and Apple (APNs) deliver these messages and may process data outside the European Union. Notifications contain no customer names, amounts or document contents. You can withdraw permission in your phone settings. Device identifiers are removed when the session is revoked or the account deleted, and after 30 days without renewal. Delivery records are retained for at most 30 days. A notification already delivered to the phone may remain visible after sign-out.
- Access and portability — a complete export of your data in JSON format is available directly in the app, with nothing to request (Settings → Privacy).
- Rectification — editable at any time from the company profile.
- Erasure — account deletion is available in the app. The accounting records required by law are retained with restricted access for the applicable period. Closing the account does not mean erasing every piece of information contained in those records.
- Objection and restriction — by simple email.
- Complaint — to the Data Protection Commission (Ireland), the CNIL (France), or the data protection authority of your country of residence.
You can also request deletion of your account and your data from the web, even without the app.
Any request sent to contact@laburo.eu receives a reply within thirty days.
6. Security
- HTTPS for all exchanges with Laburo services.
- Authentication and company-scope checks in the API.
- Signature and document-sharing links based on random, unguessable tokens.
- Mobile sessions stored in the operating system's secure keychain.
In the event of a data breach presenting a risk, the people concerned and the competent authority are informed within the periods set by the GDPR.
7. Cookies and audience measurement
The website only uses cookies strictly necessary for the service to work: keeping the session open, and security. They do not require consent.
No advertising cookie and no third-party tracker for targeting purposes is set. If audience measurement were switched on in future, it would be in an anonymised configuration or after consent has been obtained.
8. Minors
The service is aimed at professionals and is not intended for minors. No data is knowingly collected from anyone under 18.
9. Changes
Any substantial change to this policy is notified by email at least thirty days before it takes effect.