Privacy Policy
Last updated 25 October 2026
Lisvo is a product of Kodeo Labs Ab (“we”, “us”). This policy explains what personal data we handle when you visit this website, ask for early access or use the Lisvo app, why we do it, who else is involved, how long we keep it and what you can do about it. If you use Lisvo for your own app’s reviews, read the section on reviews and feedback too: there we act on your behalf.
Who is responsible
For the data in this policy, except where it says we act on a customer’s behalf, the controller is:
- Kodeo Labs Ab, business ID 3122668-6, entered in the Finnish Trade Register, registered in Jomala, Åland, Finland
- Email: support@lisvo.io. If you need a postal address, ask us and we will give it to you.
This website (lisvo.io)
Visiting. The site is served by Netlify. Like any web server it receives your IP address and details of your request (the page, your browser, the page you came from, the time) so that it can deliver the page and keep the site secure. Netlify keeps these logs for up to 90 days, and in an archive for up to a year more. We run no analytics or advertising. The site sets no cookies and loads no third-party scripts, fonts or images; the links to LinkedIn, YouTube and kodeo.io only take you there when you click them. Our legal basis is our legitimate interest in running and securing the site.
Your language. If you choose a language in the footer, your browser remembers it (an entry called lisvo.lang in local storage) so the site does not switch language on your next visit. It stays on your device and we never receive it.
Early-access requests. When you fill in the request form we receive what you type: your name, your email address and, if you choose, your company or apps and a message, plus the language of the page. The form is handled by Netlify (Netlify Forms; Netlify is a US company). Netlify may also record technical details with each submission, such as your IP address, your browser and the page you came from, and it checks the submission for spam with a service called Akismet (Automattic, USA). The request stays with Netlify, and we read it there. We use all this only to answer your request and set up your access. We do not use it for marketing and we do not sell it. Our legal basis is our legitimate interest in answering business enquiries. If you become a customer, the details become part of your account.
The Lisvo app (app.lisvo.io)
Your account. An account holds your email address, your name if you have given it and, if you sign in with Google or Microsoft, the picture link from that account. Accounts are set up by us for the people who use Lisvo. We also keep the name and logo of your workspace.
Signing in. There are no passwords. You sign in with a one-time code sent to your email, or with Google or Microsoft. We send the code through Resend (USA), which keeps a copy of each email, including your address and the code, for 30 days. We also keep a log of each code email (the address it went to, the IP address of the request and the time) to stop abuse and to enforce sending limits. We delete that log, and codes that expired unused, after 30 days. Our legal basis is providing the service you or your organisation asked for, and our legitimate interest in keeping it secure.
Cookies and local storage. After you sign in, one cookie keeps you signed in: lisvo_refresh, which lasts up to 60 days, cannot be read by scripts on the page and is removed when you sign out. The app also remembers your language, in your browser’s local storage (from your first visit, taken from your browser’s settings), your light or dark theme if you change it, and, until you close the tab, that you dismissed a notice. All of this is strictly necessary for the app to work as you expect, and none of it goes to anyone but us (the cookie) or stays on your device (the rest), so the app does not ask for cookie consent.
App icons. To show your apps’ icons, your browser loads them from the app stores’ own image servers (Apple’s and Google’s), which can see your IP address when it does.
Messages to us. If you write to us, we keep the message and your email address so that we can answer you and learn from what you tell us. A message sent from the app is kept for 12 months after we received it. An email conversation is kept for 12 months after our last contact. We keep something longer only if the law requires it.
Payments. We do not take payments today. The app has no payment features, and we hold no card or other payment details. What we plan here is described separately, under planned changes.
Reviews and feedback we handle for our customers
Customers connect their Apple App Store and Google Play accounts so that Lisvo can read their apps’ reviews, translate and analyse them, draft replies and, if the customer switches on Autopilot, send replies in the stores under the customer’s own developer account. Customers can also collect feedback from their own users. This involves personal data of the people who wrote the reviews or feedback: for a review its public nickname, rating, text, language, country and app version; for feedback its text, whatever data the customer’s own app sends with it and, if given, an email address.
For this data the customer decides why and how it is used, and we handle it only on their instructions, under a data processing agreement (Data Processing Agreement) built on the European Commission’s standard contractual clauses. Lisvo’s systems process this data automatically. Our own people open a customer’s review data only when that is necessary for a legitimate purpose: support, troubleshooting, security, running the service or a legal obligation. They do not read it otherwise. For data we receive from Google the rule is stricter, as the section on Google user data says. If you wrote a review or sent feedback and want to see, correct or delete it, ask the developer of the app first. If you write to us about data we handle for a customer, we refer or forward your request to the right customer without undue delay, sharing only what is needed. We delete a customer’s review data on the customer’s instructions or where the law requires it. For personal data we are responsible for ourselves, we handle your request directly. A review that is public in a store stays public there until its author or the developer removes it, and a review removed from a store stays in Lisvo until the customer deletes it.
How AI is used
To analyse, translate and draft replies to reviews, Lisvo sends OpenAI the review’s title and text, its rating, language and store; any reply already posted to it; the sentiment and type of issue from our own analysis of it; the app’s topic labels, name and description; the customer’s own reply instructions; and the text to be translated when someone asks for a translation (a review, a reply or a draft reply). We do not send reviewer nicknames, email addresses or any account data, and feedback collected through a customer’s own app is not sent to an AI provider. Review text can itself contain personal data, so we treat it as personal data.
We send each request with OpenAI’s storage option switched off, so OpenAI does not keep it for its dashboard or its evaluation tools. OpenAI does not use text sent through its API to train its models unless an organisation chooses to share its data, which we have not done. OpenAI may still keep the text for up to 30 days to monitor for abuse, because we have not enabled its zero data retention option. We have not asked OpenAI to process data in a particular region, so it can be processed in the United States and wherever else OpenAI operates.
Autopilot is off until a customer switches it on for an app. It only answers reviews posted after that, only when it is confident, and never when it flags a sensitive subject such as billing, privacy, legal or security. The customer remains responsible for the replies sent in their name.
Who we share data with
We do not sell personal data. These providers handle it for us:
- Netlify (USA) hosts this website and the app, and handles early-access requests: visitors’ IP addresses and request details, and the form submissions.
- Render (USA) runs the Lisvo API and its database, which hold the app’s data, in its Frankfurt (Germany) region.
- Cloudflare (USA) provides the network edge in front of the API (through Render) and our DNS, so it sees requests to the API in transit.
- Resend (USA) sends the sign-in emails and keeps each for 30 days, with the recipient’s address and the code.
- OpenAI (USA; OpenAI Ireland Ltd contracts with customers in the EEA) analyses, translates and drafts replies to reviews, as described above.
- Spaceship (USA), through its Spacemail service, hosts our email, including what you write to us and what we write back.
Services you choose to connect have their own roles and policies: Google (Google Play Developer API, and sign-in), Apple (App Store Connect API) and Microsoft (sign-in). Our providers use sub-processors of their own, which they list on their websites. We pass personal data to authorities only where the law requires it.
Google user data
If you connect your Google Play account, we ask Google for your permission to see your Google account’s email address and to use two Google APIs on your behalf. We use the Play Developer Reporting API to list the apps in your Play Console account, and the Google Play Developer API to read your apps’ reviews and your replies, to post replies when you or your Autopilot send them, and to read the status of your production releases (version and rollout). We use this data only to provide those features to you in Lisvo.
What our systems do with it. Lisvo’s systems handle your Google data automatically: they fetch it, store it, send review text to OpenAI to analyse, translate and draft replies (see the section on AI), and post replies when you or your Autopilot send them. We do not use it for advertising, we do not sell it and we share it with no one else.
When our people can read it. Our people do not read your Google data as a matter of routine. They open it only when that is necessary for a legitimate purpose and, for Google data, only if you ask us for help with it and agree that we look at it, if it is needed for security (for example to investigate abuse), or if the law requires it.
We store your connection (the Google account’s email address and an encrypted token) until you disconnect. When you do, we ask Google to revoke the token and we delete ours. You can also remove Lisvo’s access at any time in your Google account’s security settings. If you ask us to delete your data, we delete what we received from Google as well, within 30 days.
Lisvo’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
International transfers
Several providers are US companies, so personal data is also processed in the United States. Netlify, Render, Cloudflare and Resend take part in the EU-US Data Privacy Framework, and Resend also relies on the European Commission’s standard contractual clauses; OpenAI and Spaceship rely on the standard contractual clauses in their data processing terms. We do not claim that data stays in the EU.
How long we keep data
| Data | How long |
|---|---|
| Early-access request | 12 months after you send it in our form tool, and 12 months after our last contact in our email, then deleted |
| Sign-in log and unused codes | 30 days. Resend keeps its copy of a sign-in email for 30 days |
| Account data | While the account exists |
| Reviews, feedback, replies, AI decisions and settings of a workspace | While the account exists. Deleting an app, unlinking a store or disconnecting an account removes the matching data straight away |
| Store connections | Until you disconnect (Google is asked to revoke the token) or the account is deleted |
| A read-only account after a pilot | Kept for 30 days from when we set it to read-only, unless a paid plan or an extension is agreed. Then the account is closed (next row) |
| After an account is closed | Everything above that we hold ourselves is deleted within 30 days. Usage records that hold no text or personal data (token counts and costs) are kept |
| Database backups | Render keeps backups for a limited time, currently at most 7 days. A backup cannot be edited, so deleted data leaves it when the backup expires |
| Text sent to OpenAI | Up to 30 days at OpenAI |
| Messages to us | From the app: 12 months after we received the message. By email: 12 months after our last contact. Then deleted, unless the law requires us to keep them longer |
| Website logs at Netlify | Up to 90 days, and in an archive for up to a year more |
| Server logs at Render | Up to 30 days, depending on Render’s plan |
Your rights
You can ask us for a copy of the personal data we hold about you, to correct it, to delete it, to restrict how we use it or to object to it, and to receive the data you gave us in a usable format. Write to support@lisvo.io. We answer within one month and may need to confirm who you are first. For data we handle for a customer, see the section on reviews and feedback.
You can also complain to the supervisory authority: in Finland the Office of the Data Protection Ombudsman (tietosuoja.fi).
Security
Traffic between your browser and Lisvo uses HTTPS. There are no passwords to leak: you sign in with an emailed code or with Google or Microsoft. We never ask for your store account passwords, and the credentials you give us for the stores are stored encrypted.
Planned changes
This section is about a plan, not about what happens today. The sections above describe what we do now.
Payments. We do not take payments yet. When we start charging, we plan to use Stripe Managed Payments, in which Stripe is the merchant of record and handles the payment, sales tax and VAT, and payment disputes. Payment details would then go to Stripe and not to us.
We will update this policy, and tell our customers, before any of this starts.
Changes
We update this policy when what we do changes, and show the date at the top. If a change matters to customers, we tell them by email.