Laora Your city, on your time.
Download

Privacy Policy

Last updated: 13 November 2026

1. Who we are

Laora is the platform made of the Laora mobile application and the laora.app website, through which clients find and book local services offered by providers. The data controller is Nicu Atamaniuc, a private individual, Chișinău, Republic of Moldova (contact@laora.app); you can write to us at that address at any time, including with any question about your data.

This policy describes the processing of data in the App and on the website. Providers themselves remain responsible for data they receive from clients outside the Platform (for example, on site).

When we invite a business to join Laora, we write to the business e-mail address it has made public and use the business's name in the message. We do so on the basis of our legitimate interest in making the Platform known to the providers who could use it (Article 6(1)(f) GDPR). The invitations are sent through our e-mail provider, and each one carries a link to unsubscribe. We keep the address, the name and the dates we wrote for 12 months after our last e-mail (or after we added the address, if we never wrote to it), and then delete them. If you unsubscribe, we keep your address and the date you did so — only these two, and with no time limit — so that we never write to you again. You can ask us at any time, at contact@laora.app, to delete this data.

2. What data we collect

  • Account data: first and last name, company name (optional, providers only), e-mail address, phone (optional), the country, region and city given at registration, the password (stored only as a one-way hash, from which the password itself cannot be read back), the chosen role (client or provider), the language and time zone of your phone (so that notifications reach you in your language and at your hour), when you accepted these terms, and when you were last active in the App. If you sign in with Google or Apple, also the identifier of that account and the e-mail address it gave us, and for Apple a token kept encrypted (see section 6).
  • Profile: photograph (optional) and, for providers, a description, working hours with the time zone, and the locations with their name, description, photographs and address with coordinates — published on the map, that is, visible to everyone who uses the App.
  • Published services: names, descriptions, prices or price ranges, durations, photographs.
  • Activity: bookings with the history of hour and price offers, chat messages, reviews given and received together with their photographs, favourites, area alerts set on the map (the place, the width of the area and the category), the waiting list for an hour that is taken, the categories you proposed, conversations with the support team together with the photographs attached to them, the reports you sent, and the users you have blocked. For providers, also the stretches of time blocked in the calendar, together with the note written on them, which only you see.
  • Listings opened: which listing you opened and on which day, kept while the listing and your account exist. The provider is shown only how many times their listing was opened, never who opened it.
  • Device location: only with your permission and only while you use the App — to show the map around you, to put the nearest providers first in the lists and, for a provider, to place a location on the map. It is sent with the search it is used for and is not saved to your account; we do not track location in the background.
  • Messages sent through the contact form on the website: your name, e-mail address and message. They reach us through Telegram and are not stored in our database.
  • Technical data: the device identifier for push notifications, with the platform (iPhone or Android); the error reports the App sends when something goes wrong; technical server logs, which record the IP address and the requests made, for security and diagnostics; and, on the website, the session record described in section 11.

3. Purposes and legal bases

We process data on the following bases, set out in Article 6(1) of the GDPR and in Law No. 133/2011 of the Republic of Moldova on personal data protection:

  • Performance of the contract (these terms; Article 6(1)(b) GDPR): the account and signing in, publishing services, bookings and price negotiation, messaging, reviews, support, operational notifications.
  • Legitimate interest (Article 6(1)(f) GDPR): the security of the Platform and its backups, preventing fraud and abuse, content moderation, handling reports and blocks, our internal operational alerts and the record of the moderation decisions we take, internal statistics and improving features, defending our rights.
  • Consent (Article 6(1)(a) GDPR): access to the device location, non-essential cookies on the website, and any marketing communications; consent can be withdrawn at any time, without affecting prior processing.
  • Legal obligation (Article 6(1)(c) GDPR): keeping or disclosing data where the law requires it.

4. Moderation, including automated

Before they appear, published texts and photographs (the names and descriptions of services and of places, the profile description, proposals for a new category, reviews, the profile photograph and the photos of services, of places and those attached to reviews) are checked automatically, through an artificial-intelligence service, for forbidden content. When a provider asks for it, service texts and place descriptions are translated the same way into the other content languages of the App (Romanian, Russian and English). If the check is unavailable, the content is published without it.

A publication can be refused automatically on this basis, and an account refused five times is blocked automatically. If you consider a refusal or a block wrong, write to the contact address and a human will review it. The photographs you attach to support messages do not go through this check: they are seen only by you and by us.

5. What others see

  • A provider's public profile, their services and the reviews can be seen in the App by anyone, including people who have not created an account.
  • The public profile of a provider: the displayed name or company name, the photograph, the description, the city, the services, the locations with their address, the schedule, the reviews and the average rating.
  • The card of a client, seen by the providers the client has sent a request to: the name and photograph, since when the account exists, how many appointments were completed, the reviews providers wrote about the client with their average, and the phone number if it was made visible.
  • The phone number: only if you yourself made it visible, from the profile settings.
  • On a booking, the parties see each other: name, photograph and the content of the booking. Messages are visible only to the two participants in the conversation; we open a conversation only to handle a report that names both of them, and every such opening is recorded.
  • Whether you are online: in a conversation, the other person sees whether you are in the app right now, or how many minutes ago you were, for up to 30 minutes; after that, nothing is shown.
  • Reviews, together with the name and photograph of their author, are public on the reviewed service.
  • How many times a listing was opened: the provider sees the number for their own listings, not who opened them.
  • Blocking: someone you have blocked, or who has blocked you, no longer sees your listings, map pins or reviews, and you no longer see theirs.

6. The providers who help us

A few companies help us keep Laora running. Each receives only what is described here, for the purpose stated; where one of them also acts under its own privacy policy — Google and Apple when you sign in through them, Google for the map and for reCAPTCHA — that policy also applies to what it receives. We sell data to nobody, the App shows no advertising and does not track you across other companies' apps or websites, and we pass data to nobody outside this list, except where the law requires it.

  • Our hosting provider, in Chișinău, Republic of Moldova — the servers Laora runs on, the database, the nightly copies of it kept on the server, and the technical logs. Your account data is stored there.
  • Anthropic — checks the texts and photos you publish (the names and descriptions of services and of places, the profile description together with the provider's displayed name, the company name a provider gives, proposals for a new category, reviews, the profile photograph and the photos of services, of places and of reviews) for forbidden content and, when a provider asks for it, translates service texts and place descriptions into the other content languages of the app. It receives no e-mail addresses, phone numbers, chat messages or support messages.
  • Expo — delivers push notifications to your phone, handing them on to Google (Firebase Cloud Messaging) on Android and to Apple on iPhone; a notification carries its text, which can include the name of the person writing to you and the words of their message. Expo also delivers the app's own updates: when the app checks for a new version of itself, Expo receives the device's IP address, a random identifier of the installation, the platform and the app version.
  • Cloudflare — stores the photos uploaded in the app and serves them to those who view them, adding the Laora watermark to the photos of services, places and reviews; keeps the photos attached to support messages in a separate, private storage, shown only through links that expire after an hour; and keeps the off-site copies of our nightly database backups, in private storage.
  • Our e-mail provider — sends to your address the confirmation and password-reset codes, the copy of your data you ask for (as an attachment), and the e-mails about the state of your account: blocked, unblocked, closed or reopened.
  • Telegram — carries our internal operational alerts: a new or closed account, a published service, a proposed category, an opened support ticket or report, a message sent through the contact form, one user blocking another, an account blocked automatically, an e-mail that could not be sent, and error reports from the app and from our server. They can include a name, an e-mail address and the text you wrote; an alert about a block names both accounts and says how many people have blocked that one; an error report from the app carries the name and id of the account, the device platform and app version, the screen where the error happened and the error message.
  • Google reCAPTCHA — protects the contact form on this website against automated abuse. Google receives your IP address and interaction data when you open the contact page; it is not used in the app.
  • Google Tag Manager — statistics for the website and, if you also allow marketing cookies, the measurement of our advertising; loaded only if you accept in the cookie banner. It is not used in the app.
  • Photon (OpenStreetMap) — suggests addresses while a provider types, when putting a place on the map, and names the place when the pin is moved. It receives what is typed and, approximately, where the map is looking.
  • Google Maps — draws the map in the app, both when looking for services and when placing a location. Google receives the device's IP address and the area of the map being viewed, and, when your position is shown on the map, the device location as well.
  • Google Sign-In — only if you choose to sign in with your Google account. Google gives us your name and e-mail address, so the account can exist, and learns that you use Laora. It is not involved if you register with an e-mail address and password instead.
  • Sign in with Apple — the same, for an Apple account. Apple lets you hide your real address behind a relay address, in which case the relay address is all we ever see. Because Apple requires that deleting the account also ends Laora's access to your Apple ID, we keep, encrypted, a token Apple issues at sign-in; when you delete the account we send it back to Apple to revoke the sign-in, and we forget it once Apple confirms.

7. International transfers

Several of the providers above process data outside the Republic of Moldova and the European Economic Area — among them Anthropic, Expo, Google, Apple and Cloudflare, companies based in the United States. Where that happens, we make sure the transfer has a legal basis and adequate safeguards (such as the standard contractual clauses of the provider).

8. How long we keep the data

Data is kept while the account exists, within these limits:

  • Deleting the account starts a 30-day grace period, during which the account can be recovered simply by signing in again. After that the account is erased for good, with everything attached to it — including the reviews it wrote and the reviews written about it, and its appointments and conversations, which then disappear for the other person as well.
  • A conversation you delete leaves your list at once and is erased when the other participant deletes it too. An area alert is removed when you open the notification it sends, or when you remove it yourself.
  • Backups: the database is copied every night; the latest 5 copies are kept on our server and the latest 14 in private storage at Cloudflare. Something deleted can therefore survive in these copies for up to 14 days, until the last copy that holds it is replaced. The copies hold the database only; photos are removed from storage when they are deleted.
  • Technical logs are kept for up to 30 days.
  • The record of the moderation decisions we take — for example an account blocked or closed, a review hidden or removed — names the account concerned, with its name and e-mail address, and is kept after the account is erased, so that we can answer for those decisions. A report that someone else sent us about you belongs to their conversation with support, and is erased with their account rather than with yours.
  • Our internal alerts in Telegram, including the messages from the contact form, are not deleted automatically.
  • Where the law obliges us to keep certain data longer, we do so for that purpose only.

9. Your rights

Over your data you have the rights below. Where the App offers a way, use it; for anything else, write to contact@laora.app from the e-mail address of your account.

  • to access it and receive a copy — you ask for it yourself in the App, from Profile, and the copy arrives at the account e-mail address;
  • to rectify it — the profile is edited directly in the App;
  • to delete it (the "right to be forgotten") — including by deleting the account from the App;
  • to restrict, or object to, processing based on legitimate interest;
  • to portability of the data you provided;
  • to withdraw consent at any time, for processing based on it;
  • to have a human review an automated decision that affects you (see section 4);
  • to complain to the supervisory authority: in the Republic of Moldova, the National Center for Personal Data Protection (datepersonale.md); if you live in the EU/EEA, also to the authority of your country.

10. Deleting the account

The account is deleted directly from the App (Profile → "Delete account"; the same option is on the screen that asks for the e-mail confirmation code), with no separate requests; without the App, write to us from the account's e-mail address and we will delete it. If you signed in with Apple, we also ask Apple to revoke Laora's access to your Apple ID. The steps and the effects are described on the "Account deletion" page.

11. Cookies on the website

The website sets only two cookies of its own, both needed for it to work: the session cookie and a security token that protects its forms. The session is recorded on our server together with your IP address and browser, ends after two hours without activity, and expired sessions are then cleared. Your choice of theme and your answer to the cookie banner are kept in your own browser.

Statistics and marketing cookies, through Google Tag Manager, load only if you accept them in the cookie banner, and you can change your answer at any time from the cookie icon at the bottom of the page. The contact page also loads Google reCAPTCHA (see section 6).

12. Security

Communication with the servers is encrypted. The App's data is reachable only signed in, and an account is signed in on one device at a time: signing in on a new phone signs the previous one out. Passwords are stored only as one-way hashes, and the Apple token mentioned in section 6 is stored encrypted. Published photos are served from addresses that cannot be guessed; the photos attached to support messages sit in a separate, private storage, reachable only through links that expire after an hour; the database backups are kept in private storage. Internal access to data is limited to what is necessary. No system is infallible — tell us immediately if you suspect unauthorised access to your account.

13. Minors

The Platform is intended for persons at least 18 years old, and we do not knowingly collect data about minors. If you learn that a minor uses the Platform, write to us and we will close the account.

14. Changes

We can update this policy; the current version, with the date of the last update, is published on this page, and important changes will be announced in the App or by e-mail.

15. Contact

Questions about your data: contact@laora.app