Privacy Policy

Who we are

Assura for D365 FO (“Assura”) is operated by Luvo Pty Ltd (ABN 67 603 011 392), Level 11, 9 Castlereagh Street, Sydney NSW 2000, Australia (“Luvo”, “we”, “us”).

You can contact us about privacy at any time via info@luvo.com.au.

Information we collect

Account details: your name, email address and password (stored only as a secure hash) when you register, plus organisation membership and role information.

Project and delivery data: the content you and your organisation upload or create in the service, including programmes, requirements, configuration registers, test records, risks, decisions, evidence documents and related files stored in the evidence document store.

Usage and server logs: technical logs generated when you use the service (such as request times, IP addresses and error details) used for security, debugging and performance.

Website analytics: if you accept analytics cookies, we use Google Analytics to collect information about how the site is used. Analytics runs only after you consent via the cookie banner; declining means no analytics data is collected.

How we use it

We use personal information to provide and secure the service, to provide support, and to improve the product. We do not sell personal information.

When you use Assura’s AI features (for example AI-assisted requirement generation, programme advice and document text extraction), the content you submit to those features is processed by a large language model provided by Google (Gemini) and routed through the Lovable AI Gateway. Customer content is sent to these AI services only when you choose to use an AI feature; the output is advisory and reviewed by your users before it is applied.

We send transactional email only where needed to operate the service, such as sign-in links, password recovery and workspace invitations.

Who can see it

Your workspace users: project and delivery data is visible to members of your own organisation, according to their role.

Authorised Luvo personnel: a small number of Luvo staff may access data where necessary to provide support or operate the service, under strict access controls.

Service providers: the providers listed below process data on our behalf.

Service providers and overseas disclosure

We use the following service providers. Some of them process data outside Australia; where we disclose personal information overseas, we take reasonable steps to ensure it is handled consistently with the Australian Privacy Principles (APP 8).

Lovable — application hosting and the Lovable Cloud backend (database, authentication, file storage and transactional email). Processing locations include the United States and other regions where their infrastructure operates.

Lovable AI Gateway and Google (Gemini) — AI processing for the AI features described above. Processing locations include the United States.

Google Analytics (Google) — website analytics, only where you have consented to analytics cookies. Processing locations include the United States.

Cloudflare — content delivery and edge compute for the hosted application, across a global network.

Retention

We keep personal information while your account is active. On request or when your account is closed, we delete or de-identify personal information, subject to legal record-keeping obligations. Backups roll over and are deleted in the ordinary course.

Access, correction and deletion

Under APP 12 and APP 13 you may request access to, or correction of, the personal information we hold about you, and you may ask us to delete it. Contact info@luvo.com.au. We aim to respond within 30 days and there is no charge.

GDPR and UK GDPR

Where the EU or UK GDPR applies, we process personal information on the following legal bases: contract (to provide the service you signed up for), legitimate interests (to secure, maintain and improve the service), consent (for analytics cookies), and legal obligation.

For project and delivery data that you upload, your organisation is the data controller and Luvo acts as a data processor, processing that data only on your instructions.

Cookies and tracking

We use strictly necessary browser storage to keep you signed in and to remember your cookie choice. We use Google Analytics cookies only if you accept them.

You can change your choice at any time via the Cookie settings link in the footer of our website.

Security

We protect data using encryption in transit and at rest, role-based access controls, and row-level isolation between organisations. Connector credentials you store for third-party systems are encrypted at rest. No system is completely secure, but we take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access.

Data breaches

If a data breach is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme. Where the GDPR applies, we will notify the relevant supervisory authority within 72 hours where required.

Complaints

Please contact us first at info@luvo.com.au so we can try to resolve your concern. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

We may update this policy from time to time and will post the current version on this page. Last updated: 16 September 2026.