Privacy Policy

1. Who we are

This Privacy Policy explains how Lahairr (“we”, “our”, or “us”) collects, uses, and protects personal information when you visit www.lahairr.com. This site is a creator workspace hosted on Cardel. Cardel's platform privacy practices are described separately at cardel.io/privacy.

2. Information we collect

• Account information: email address, email-verification status, display name, profile image, account role, and account creation and update dates.
• Sign-in information: a securely hashed password for email and password accounts; Google profile and OAuth account information when you use Google; and session, verification, magic link, and password reset tokens and expiry data. Signed-in users are authenticated with session cookies.
• Comments: the text of comments, their date, the related post, and the account that submitted them. Your display name, or a neutral label such as “Reader” if none is set, may appear publicly beside a comment. A profile image may also be shown when one is associated with your account.
• Newsletter information: your email address and, when provided, your name. Subscription preferences are stored in our internal audience list and, when you have an account, on your user profile so your choices can be honored.
• Contact information: information you submit through the site's contact form, including your name, email address, and message, which may be delivered to us via Amazon SES (inbound Messages) and may also involve Resend when Cardel is configured to send outbound mail through that provider.
• Shop and order information: when you buy or request an item through Shop, we may collect your name, email address, message (for request forms), item and order details, and payment status. Card payments are processed by Stripe on the site owner's connected Stripe account. You enter card details only on Stripe. We never receive or store your payment card number, CVV, or other full card details on this site. Cardel may retain order records so we can fulfill your purchase or request.
• Scheduling and calendar information: when you book a time on this site, we may collect your name, email address, and the details of that request. If the site owner or an Admin connects Google Calendar or Outlook Calendar, Cardel accesses the calendars they select: it reads them for busy times, and it may write booking events when you book. Access tokens stay encrypted and stored with this workspace. We do not use this Google or Outlook calendar data for advertising, and we do not share calendar event details with other sites, advertisers, or the public. An Admin can disconnect Google Calendar or Outlook Calendar at any time. Guests see only open slots, not event titles or other calendar details. Calendar sign-in happens on Google or Microsoft.
• Analytics and technical information: We use analytics (via Vercel) to understand how visitors use the site and improve its performance. Analytics information is generally aggregated and is not intended to identify individual visitors. Hosting and security systems may also process IP addresses, request details, and diagnostic logs.
• Transactional email information: email recipients, message content, and delivery or error metadata for verification, sign-in, and password reset messages may be processed in site logs and by Amazon SES and/or Resend, depending on how Cardel is configured.

3. How and why we use information

We use personal information to:

• create, secure, and administer reader accounts;
• verify email addresses, authenticate sign-ins, and reset passwords;
• publish, attribute, moderate, and remove comments;
• send newsletters when you consent and maintain subscription preferences;
• respond to messages submitted through the contact form;
• process Shop purchases and order requests, including fulfillment and related transactional notices when configured;
• offer public scheduling and keep shown times accurate when the site owner has connected a calendar, including reading busy times and writing booking events (guests see only open slots);
• understand site use, maintain reliability, prevent abuse, and improve the site; and
• comply with legal obligations and protect legal rights.

Depending on where you live, these activities rely on your consent, performance of the service you request, legitimate interests in operating and securing the site, and compliance with law. You may withdraw consent for future newsletter emails at any time.

4. Cookies

The site uses essential cookies for authentication and functionality, including remembering certain temporary actions during sign-in. We also store your theme preference (light or dark mode) in your browser. Embedded services may apply their own cookies or similar technologies under their respective policies.

5. Passwords, tokens, and email verification

Passwords are securely hashed before storage. We do not store your plaintext password. Verification and password reset tokens are securely stored and expire automatically. Email and password accounts must verify their address before commenting. Google and magic link sign-ins are treated as verified through their authentication flow.

No internet service is completely secure. We use reasonable safeguards, but cannot guarantee absolute security.

6. How we protect information

We use technical and organizational measures to protect personal information and Google Calendar and Outlook Calendar data against unauthorized access, disclosure, alteration, or destruction.

Traffic between your browser and this site uses HTTPS. Google Calendar and Outlook Calendar access and refresh tokens are encrypted at rest and stored with this workspace. Those tokens are used only on Cardel's servers to talk to Google or Microsoft for Scheduling. They are not placed in the browser or used for advertising.

Access to a connected calendar is limited to Admins on this workspace and to Cardel systems that run Scheduling. Calendar data stays on this workspace. Guests see only open slots.

If an Admin disconnects a calendar, Cardel deletes the stored tokens and cached busy times for that connection, and requests that Google or Microsoft revoke those tokens. We keep this data only while the connection is needed to provide Scheduling, plus a limited time in backups.

We use Google Calendar and Outlook Calendar data only to provide Scheduling. We do not sell it, use it for ads, or use it to train AI models.

7. Service providers

We disclose information only as needed to operate the site, honor your requests, protect the service, or comply with law. We currently use the following service providers:

• Google, for OAuth sign-in and associated profile data, and for Google Calendar when the site owner connects it;
• Microsoft, for Outlook Calendar when the site owner connects it;
• Vercel, for website hosting, request handling, and analytics;
• Neon, for database hosting;
• Upstash, for caching, rate limiting, and background job delivery;
• Amazon SES and/or Resend, for verification, magic link, password reset, contact form delivery, and newsletter-related email (inbound Messages use Amazon SES);
• Stripe, for Shop card payments when the site owner has connected Stripe (payments are processed on the owner's connected account); and
• Cardel, for the multi-tenant platform that hosts this workspace.

We may change service providers as the site evolves. This Privacy Policy will be updated to reflect material changes where appropriate.

These providers may process information in other countries and under their own privacy terms. The site does not sell personal information or share it for cross-context behavioral advertising.

8. Retention and deletion

Account information and comments are generally retained while your account is active or as needed to provide the service. Expired verification, sign-in, and reset tokens may be retained briefly for security and operational cleanup. We may retain a record of your email address after you unsubscribe solely to ensure we honor your request and do not send additional newsletter emails. Contact messages, analytics, and technical logs are retained according to operational need and provider settings.

To request account or data deletion, email support@lahairr.com. Some records may be retained when required by law, needed for security or dispute resolution, or necessary to honor an unsubscribe request as described above.

9. Your choices and rights

Depending on your location and applicable law (including the GDPR, UK GDPR, CCPA/CPRA, and similar privacy laws), you may have rights to request access to, correction of, deletion of, or a portable copy of your personal information; to object to or restrict certain processing; and to withdraw consent. You may also complain to your local data-protection authority. These rights can be subject to legal exceptions and identity verification.

To stop newsletter messages, use the unsubscribe link in any newsletter, visit www.lahairr.com/unsubscribe, or email support@lahairr.com. Transactional account emails may still be sent when needed to complete an action you request.

10. Children's privacy

This site is not directed to children under the age required by applicable law (including under 13 in the United States), and we do not knowingly collect personal information from them. If you believe a child has provided personal information, contact us so it can be reviewed and deleted.

11. Third-party links

This website may contain links to third-party websites, including YouTube and other external services. We are not responsible for the privacy practices or content of those websites. We encourage you to review their privacy policies before providing personal information.

12. Changes to this policy

We may update this policy as the site or applicable requirements change. The revised version will be posted here with a new “Last updated” date. Material changes may also be communicated through the site or by email when appropriate.

13. Contact

Privacy questions and requests for Lahairr's site may be sent to support@lahairr.com.