Privacy notice

Leavilo is operated by vanRaan Industries in the Netherlands. This notice covers our website, hosted leave management service, and related communications under the General Data Protection Regulation (GDPR, or AVG in Dutch).

For customer employee records: your employer or the organization providing your workspace normally determines why and how your data is used and is the data controller. We process that information on its documented instructions as a processor. Your organization’s privacy notice explains its employment-related purposes, legal bases, retention rules, and contacts.

For our own business activities: vanRaan Industries is the controller for customer relationship management, billing administration, enquiries, and protecting our website and service. Identity and access data can also be processed on an organization’s behalf when we manage its workspace access.

This notice is separate from the Terms of service and does not replace the data processing agreement with a customer.

• Account and work profile: name, email address, account and organization identifiers, membership, role, department, assigned manager, active status, and work schedule.
• Leave administration: leave types and policies, allowances and adjustments, requested dates and partial days, comments, decisions and explanations, holidays, company closures, and calendar records.
• Activity and access: audit events identifying actions and their actors, connection permissions, API key identifiers and limited key metadata, and pending assistant confirmations.
• Billing: customer and subscription references, subscription status, trial and paid-through dates, and transaction or invoice information needed to administer the customer relationship. Stripe handles payment credentials; Leavilo’s application database does not store full card numbers or card security codes.
• Communications: enquiries and support correspondence, notification recipients, message content, and delivery status. Service emails use generic event messages and authenticated links rather than including leave reasons or request comments.
• Technical information: service providers may process IP addresses, browser and device information, request times, session information, and diagnostic or security logs when delivering and protecting the service.

We receive information from you, your organization’s administrators and authorized colleagues, your use of Leavilo, and the authentication, payment, and integration providers involved in that use. Providing account and workspace information is necessary to deliver the relevant features; without it, we may be unable to provide access or process a request. Optional free-text comments are not required to use the service.

When we act as controller, we use personal data for these purposes:

• Providing an agreed service: to create and administer a customer relationship and respond to requests before entering a contract. Article 6(1)(b) GDPR applies where the individual is personally party to the contract. For employees and representatives of a business customer, our basis is our legitimate interest in managing that business relationship (Article 6(1)(f)).
• Billing and compliance: to administer payments and maintain accounting records. The basis is performance of a contract where applicable, our legitimate interest in administering a business customer’s subscription, and compliance with legal obligations such as Dutch tax law (Article 6(1)(c)).
• Security and support: to troubleshoot issues, prevent misuse, protect accounts, and establish or defend legal claims. Our basis is our legitimate interest in operating a safe, reliable service and protecting legal rights. We weigh these interests against the impact on individuals and limit processing to what is necessary.
• Consent-based activities: if we introduce an optional activity requiring consent, we will request it separately and explain the purpose. You may withdraw consent at any time without affecting earlier lawful processing.

For employee records processed on a customer’s behalf, the customer must identify the appropriate legal basis and, where necessary, an additional condition for special-category data. We do not rely on an employee’s acceptance of these terms as blanket consent for their employer’s processing.

A leave category or absence record can reveal health information or other sensitive circumstances even without a written explanation. Your organization must ensure it is legally permitted to record that information and restrict access appropriately.

Leavilo is not a medical record system. Do not include diagnoses, symptoms, treatment details, medical certificates, national identification numbers, or unnecessary information about family members in comments or assistant messages. Employers must observe the restrictions that apply to collecting health information; an employee volunteering it does not remove those restrictions.

Contact your organization if sensitive information has been entered unnecessarily so it can arrange an appropriate correction or removal.

Workspace access depends on organization membership, roles, manager assignments, and calendar settings. Administrators and authorized reviewers can access information needed to administer leave. Colleagues may see shared calendar information where the organization allows it.

Leave types marked private are shown as general absences to colleagues. Request comments are restricted to the requesting employee and authorized reviewers. A private label is not anonymity: an absence can still be visible with the person’s name and dates where calendar sharing permits it.

Authorized exports and connected applications can produce copies outside Leavilo. The organization and recipients are responsible for protecting those copies. Revoking a connection does not retrieve information already exported.

Access by our personnel or providers must be limited to what is necessary to operate the service, address support or security issues, or meet legal obligations, subject to appropriate confidentiality duties.

The service uses the following providers or categories of providers, depending on the features enabled:

• Vercel: website and application hosting, request handling, and related infrastructure.
• A managed PostgreSQL provider: storage of workspace records. The production provider and storage region must be confirmed in the customer’s processing documentation before live employee data is stored.
• Clerk: sign-in, identity, sessions, organization membership, invitations, and connected access credentials.
• Stripe: checkout, payment processing, billing management, and subscription administration. Stripe also processes certain information for its own legal, fraud-prevention, and payment obligations.
• Resend, when email delivery is enabled: recipient email addresses, service messages, and delivery information.
• OpenAI, when the optional assistant is enabled: the message and context described in the next section.

Customer-appointed integrations are additional recipients chosen by the customer. We may also disclose information to professional advisers, authorities where legally required, or parties to a business transfer where necessary and subject to appropriate safeguards and notice.

We do not sell personal data or use employee leave records for advertising. Providers acting on our behalf must be covered by appropriate processing agreements. The customer’s data processing agreement must identify authorized subprocessors and the procedure for changes.

Built-in assistant: the default assistant interprets supported commands within Leavilo without sending messages to an external language-model provider.

Optional OpenAI assistant: when this option is enabled for the service, the text you submit, the current date, and your organization’s time zone are sent to OpenAI to interpret your request. We do not attach employee directories, leave balances, or leave history to that interpretation request. However, any personal information you put in your message is included. The application requests that responses are not stored, but that setting is not a promise of zero provider retention or a substitute for the provider’s agreed data controls.

External assistants and API clients: when you connect a client, it may receive authorized tool results, including personal data, within the connected user’s permissions and access scopes. Its operator’s privacy terms apply to the copies it receives. Review the provider and permissions before connecting.

Leavilo calculates allowances and interprets requests automatically, but does not use a language model to independently decide whether an employee’s leave should be approved. Review actions and approvals remain subject to the service’s authorization and confirmation requirements. Your employer remains responsible for employment decisions and explaining its own use of automation.

Leavilo and its authentication provider use cookies and similar browser storage needed to maintain sign-in sessions, remember authentication state, and protect access. Payment pages may use technologies needed to process transactions and prevent fraud.

The application does not currently include advertising trackers or optional audience-analytics tools. If we introduce non-essential cookies or tracking that requires consent, we will explain it and obtain consent before activation. You can control cookies through your browser; blocking essential cookies may prevent sign-in or other requested features from working.

vanRaan Industries is based in the Netherlands. This does not mean all data stays in the Netherlands or the European Economic Area (EEA). Hosting, authentication, payments, email, and optional assistant providers may process information in other countries, including the United States.

Before transferring personal data outside the EEA, we must establish an applicable GDPR transfer mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses, with additional safeguards where needed. The actual mechanism depends on the provider, receiving entity, and processing arrangement; a provider’s location alone does not establish that a transfer is permitted.

The production locations, relevant receiving entities, and applicable safeguards remain to be confirmed in the processing documentation before live use. Customers must be able to obtain information about those safeguards and a copy where applicable. This draft does not promise EU-only storage or certify any provider’s transfer status.

Personal data must not be kept longer than necessary for its purpose. The relevant criteria are:

• Employee and workspace records: the customer’s documented instructions, applicable employment obligations, and the return and deletion arrangements in the data processing agreement. Deactivating an employee or cancelling a subscription does not itself delete historical records.
• Account and business correspondence: the duration of the customer relationship and the time reasonably needed to resolve the enquiry, administer closure, or address an identified dispute.
• Accounting records: the statutory Dutch retention period, generally seven years for basic business records, and longer where a specific tax rule requires it. This does not create a seven-year retention requirement for every employee leave record.
• Security logs, audit records, notification records, and backups: the period needed for their particular security, accountability, delivery, or recovery purpose, subject to documented limits and any specific preservation requirement.

Closing a sign-in account or deleting an organization through the authentication provider disables access but does not erase the employee profiles and leave history stored in Leavilo. Those records currently have no automatic deletion deadline and remain stored until separately erased. Cancelling a subscription also does not erase them. Contact your workspace administrator about employee records; authorized administrators can use our privacy contact to request organization data return or deletion.

The production deletion schedule, backup expiry, and post-termination return period still need to be agreed and implemented before live employee data is accepted. Backup retention depends on the production provider and its settings; a backup deletion timeframe has not yet been confirmed.

Where a specific legal obligation or dispute requires longer retention, only the relevant information should be retained for that purpose, with restricted access, and removed when the reason ends.

Leavilo uses organization-based access controls, server-side authorization, role and manager permissions, scoped integrations, and audit records to limit and account for access. Private absence labels and restricted comments help reduce unnecessary disclosure within a team.

Technical and organizational measures must be appropriate to the information and risks involved. No online service can guarantee absolute security. We will handle personal data breaches under applicable law and the customer’s data processing agreement, including notifying the controller without undue delay when required.

Help protect your information by keeping your account secure, checking access before connecting an application, and reporting suspected unauthorized access promptly.

Subject to the conditions in data protection law, you may ask to access or correct your personal data, have it erased, restrict its use, or receive a portable copy. You may object to processing based on legitimate interests and withdraw consent for processing based on consent. These rights are not absolute; for example, a legal retention obligation can prevent immediate erasure.

For employee leave records, contact your employer or workspace administrator first. They are responsible for deciding the request. We assist them as processor and route requests concerning their records to the appropriate controller.

For processing controlled by vanRaan Industries, contact us directly. Include enough information to identify your account and explain the request. We may ask for proportionate verification, but do not send identity documents or sensitive information unless specifically requested through a suitable channel.

We respond to requests for which we are controller without undue delay and normally within one month. If the law permits an extension for complexity or the number of requests, we will explain the reason within that first month; an extension can be up to two further months. Requests are normally free of charge.

You may complain to the Dutch Autoriteit Persoonsgegevens or the data protection authority where you live, work, or believe an infringement occurred. You do not have to contact us first to exercise that right.

We will update this notice when the service or our processing practices change and revise the date above. Material changes will be brought to affected users’ or customers’ attention as appropriate. If a new purpose requires consent or a different legal basis, publishing an updated notice alone does not authorize it.

Leavilo is intended for workplace use and is not directed at children. Organizations employing young workers remain responsible for the additional protections that apply to their information.