Privacy policy

1. Who we are

Lagnora is operated by Sagous B.V., a private company registered in the Netherlands (KVK: 99611759). Sagous B.V. is the data controller for all personal data described in this policy.

Privacy questions, requests and complaints: privacy@lagnora.com, monitored by our data protection contact.

2. What we collect today

This list describes the data used by the current invite-only beta. The marketing waitlist and the authenticated member app collect different fields for different purposes; the waitlist only asks you to confirm that you are an adult, which is not a date of birth and not a match preference.

• Optional Google Play account email — if you choose Android and use a different Google account in Google Play, you may provide its email address for beta access. If you leave it blank, we use your Lagnora signup address. We use the testing address to add, check and remove tester-group membership; it does not change your Lagnora sign-in email and is not used for matching or marketing.
• Email address — to hold your waitlist place, sign you in with a six-digit code, and send account or beta-service messages.
• Name and display/preferred name — the name you type on the waitlist (first name is enough) and the member-facing name you choose in the app.
• Profile text and preferences you choose to add — for example your About section, languages, interests and relationship or matching preferences made available in the current beta.
• Your confirmation that you are 18 or older — a yes you tick on the waitlist form. It is your own statement, not a verified age, and we do not ask for or derive a date of birth on the waitlist. Places created before this change may still carry the age band we asked for at the time; we keep those readable and collect no new ones.
• Date of birth — entered in the authenticated app for adult eligibility, age calculation and features that genuinely need it. We never manufacture an exact date from a waitlist answer.
• Location and birthplace information — the waitlist asks where you currently live; the member app may separately ask for current residence and, if you use Horoscope, place of birth. These are separate purposes and are not treated as the same fact.
• Profile photos you choose to upload — stored privately and made available only through the product's visibility and review rules. We do not claim that a profile photo proves identity or that automatic photo-safety checks are live before they are deployed.
• Optional Horoscope data you choose to provide — such as birth time/place and an optional horoscope or Kundali document. The uploaded document is private to your account unless a later sharing feature explicitly says otherwise.
• Family Circle invitations and sharing permissions — only if you choose to use Family Circle, so the service can remember whom you invited and what you allowed them to see.
• Referral attribution — the referral code in a share link and the resulting referral relationship, so we can understand how people discover Lagnora. You get your own share link only after you confirm your email address and choose your phone. A referral link is not a sign-in or admission, and nobody receives a reward for signing up or verifying.
• Marketing preference — whether you asked for occasional Lagnora news. Transactional waitlist, sign-in and account messages remain separate.
• Sign-ins and account security — for each sign-in we keep when it started, when it was last used and when it ends (at the latest 90 days after you signed in), so you can see your sign-ins and end them in Security & devices. We do not record device names, locations or IP addresses for that list. Sign-in codes and session secrets are stored only as one-way hashes, and request limits use a salted one-way hash of the network address rather than the address itself.
• Sign-in email changes — to change your sign-in email in the app, you first confirm it is you with a code sent to your current address, then prove the new address with a second code. We record that the change happened without putting either address in the audit record, end your other sign-ins, and tell both addresses.
• Account recovery requests — if you can no longer reach your sign-in email, "Can't sign in?" in the app lets you start a recovery with a new address. We keep that address, a one-way hash of the code that proves it, and the progress of the request. Automatic identity matching for recovery is not switched on, so the request goes to Lagnora support, who contact you at the new address. Nothing about your account changes automatically.
• Waitlist form protection — short-lived technical request information such as an IP address may be processed to rate-limit automated or excessive submissions; it is not used for matching or advertising.
• Crash diagnostics, only if you turn them on — crash reporting in the app is off unless you switch on Settings → Privacy → Crash diagnostics. When it is on and the app crashes or hits an error, Firebase Crashlytics receives the crash trace, the device model, the operating-system version, the app version and a random installation identifier that Crashlytics creates for that install. We do not attach your member id, email address or profile content to crash reports. You can turn it off at any time: that stops sending and deletes any report still waiting on your phone. Saying no changes nothing else in the app.
• Messages you send to a connection — the text of 1:1 messages with members you are connected to, stored on our servers so both of you can read the conversation. Messages are not end-to-end encrypted. Either participant can still read earlier messages after the connection ends, until they are deleted 90 days later. Sending limits protect members from message floods; they count messages, not what the messages say. We do not scan conversations automatically, with keywords or with AI. Our audit records keep the length of a message, never its text.
• Messages attached to a report — when you report someone from a conversation, you can choose up to 20 messages from that conversation to attach. We keep an exact copy of just those messages with the report, so the reviewer sees the words you reported even if the conversation later changes. Nothing else from the conversation is attached.
• Beta Credits — the free test-credit balance granted when your profile is activated and the entries that change it, such as extra introductions or a repeated identity check. Beta Credits cannot be bought.
• Identity-verification result data — for each verification attempt Lagnora stores the attempt's outcome, a short reason code when a check is refused or sent for review, the provider's own session reference, timestamps, whether the attempt ran in Veriff's test environment, and the legal name and date of birth Veriff confirmed. The document image, the selfie and any biometric template stay with the provider: Lagnora does not receive or store them.

3. What we have not built yet

Some capabilities are still being built or proven. We do not describe them as live merely because code, a test adapter or a store build exists.

• Purchasable credits, paid balances or in-app payments. Nothing is for sale in the current invite-only beta. Beta Credits are free test credits: they cannot be bought, transferred or exchanged for cash, and joining the First 100 does not create a paid entitlement.
• Message attachments and read receipts. Conversations between connected members are text-only today.
• Push notifications. In-app notification work and device push delivery are separate capabilities; we do not claim APNs/FCM delivery until a real device round trip is proven.
• Passkey sign-in. Our servers support passkeys, but the feature stays switched off until the app is linked to lagnora.com with Apple and Google. Until then you sign in with a code sent to your email.
• Automatic identity matching for account recovery. A recovery request goes to a person at Lagnora support instead; no account is moved to a new email automatically.

4. Why we are allowed to process it

Each of the legal bases below maps onto something in section 2. We do not claim a basis for data we do not hold.

• Contract — GDPR Article 6(1)(b): holding your waitlist place, creating and securing your account, signing you in, storing the profile/photos you choose to provide, and delivering the member features you ask to use.
• Consent — GDPR Article 6(1)(a): our optional news and product-update email, crash diagnostics in the app (off unless you turn them on), and optional product uses where the app specifically asks for consent. You can withdraw consent without losing unrelated account functions.
• Legitimate interest — GDPR Article 6(1)(f): sign-in and waitlist security, fraud/abuse prevention, proportionate moderation/support records needed to keep the service reliable and protect members.
• Identity and age verification — because a completed identity check is a condition of becoming a discoverable member, we rely on necessity for our agreement with you (Article 6(1)(b)) for running the check and storing its result, and on legitimate interest (Article 6(1)(f)) for the protection the check gives other members against impersonation and under-age access. We do not rely on a legal obligation: no general law requires a service like ours to verify identity, so we do not claim one. The document and selfie check itself runs on the provider's systems; Lagnora receives only the outcome, a reason code and the confirmed name and date of birth, and never a biometric template.
• Legal obligation — GDPR Article 6(1)(c): records Sagous B.V. must retain under applicable law, such as company administration, and records we must keep when a specific legal duty applies to a safety report. This basis is not used as a blanket justification for identity verification.

5. Where the data lives, and who else touches it

Member data is stored on DigitalOcean, with the primary region in Amsterdam (AMS3) and a secondary EU region in Frankfurt (FRA1). Database backups stay in those EU regions.

We use the following service providers for the purposes listed below. Some providers process data outside the EU; the arrangements described for each provider apply.

• DigitalOcean — hosting, database and object storage, EU regions only (AMS3 and FRA1), under a data processing agreement.
• Resend — sends your sign-in code and account email. Mail is dispatched from Resend's EU region, but Resend is a US company and stores the message metadata and delivery logs in the United States, under the EU Standard Contractual Clauses. The email address and the message are what travel; nothing else does.
• Firebase Crashlytics (Google) — crash diagnostics, processed on Google infrastructure in the United States under Google's data processing terms and the EU-US Data Privacy Framework.
• Plausible Analytics — website statistics for lagnora.com only, EU-hosted, cookie-free, and storing no personal data.
• Veriff — runs the identity document and selfie check that is a condition of becoming a discoverable member, on Veriff's own systems. Lagnora sends no member identifier and receives only the outcome, a reason code, and the legal name and date of birth Veriff confirmed. We never receive or store the document image, the selfie or a biometric template.
• Google Workspace and Google Play — for Android beta distribution, we share the Google account email used for testing with Google to manage membership of our restricted tester group and check that membership. This may be your Lagnora signup address or the separate Google Play address you optionally provide. This does not give Lagnora access to your Google password, Gmail messages or Drive files.

6. Who can see the data

• You — you can view your account data and can exercise the rights described below.
• Other members — only profile information and photos that the current product rules allow them to see. Visibility, readiness and connection state can limit what is shown.
• People you invite through Family Circle — only the items/permissions you deliberately grant, and only while that access remains active.
• Lagnora staff — support and moderation access is limited and purpose-bound. Kaveri, our internal tool, has no way to browse conversations and does not show message text in ordinary support views. Only Trust & Safety reviewers can open the messages a member attached to a report, and each time they do, it is recorded in an audit log. Engineers who run our servers and database can technically reach stored data, including messages, because messages are not end-to-end encrypted. That access exists to operate and secure the service, not to read conversations.
• The processors named in section 5, each only for the service described there.
• No data brokers and no advertisers. We do not sell or rent personal data.

7. Your rights

Under the GDPR and AVG you have the rights below, and we answer requests within one month.

You can delete your account from Profile in the Lagnora app. We erase your personal data when you confirm. If you cannot use the app, write to privacy@lagnora.com from your registered address and we complete the erasure within 30 days.

• Access — get a copy of the data we hold about you.
• Rectification — correct anything that is wrong.
• Erasure — delete your account and data (the right to be forgotten).
• Portability — receive your data in a machine-readable format.
• Restriction — ask us to pause processing while a dispute is resolved.
• Objection — object to processing based on legitimate interest.
• Withdrawal of consent — stop the news email at any time, without losing your account.
• Complaint — lodge a complaint with the Dutch supervisory authority, Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or with the authority in your own country.

8. How long we keep it

We keep your data while your account or waitlist place is in use, and delete it on the schedule below. These periods are our own choices, enforced by an automatic daily job. They are not periods a law prescribes.

Deleting your account in the app erases your personal data straight away. If you write to us instead, we complete the erasure within 30 days.

A waitlist registration whose email address is never confirmed is erased 30 days after signup.

A confirmed waitlist place that never becomes an app account, and an app account that never finishes its profile or identity check, are erased after 12 months without activity. We email you 14 days beforehand. Signing in during those 14 days keeps your account.

Sign-in codes, sign-ins, security confirmations and account-recovery requests are deleted 90 days after they stop working.

Messages attached to a report are deleted 90 days after a moderator decides the report, unless the report is under a legal hold. A person places a legal hold only for a specific legal matter, records why, and reviews it every 90 days; it has no fixed end. When a hold is lifted and those 90 days have passed, the messages are deleted at the next daily run, and always within 14 days.

Messages in a conversation are kept while the connection is active. When a connection ends, for whatever reason (either member ends it, blocks or reports the other, or deletes their account), its messages are deleted automatically 90 days later. Messages attached to a report are a separate copy that follows the report rule above.

Database backups are made every night and the 14 most recent are kept, so erased data disappears from backups within 14 days. If we ever restore a backup, we re-apply every erasure made after that backup was taken.

Server logs record technical request details, such as network addresses and the pages requested, for security and troubleshooting. They never contain sign-in codes, session tokens or message text.

9. Cookies and similar technologies

The public pages of lagnora.com set no cookies. They have no login for visitors, no advertising tags and no third-party embeds that store data on your device.

It does use one piece of browser storage: if you pick Light or Dark in the theme switcher, that choice is saved in localStorage under "lagnora-theme" so the site keeps the appearance you asked for. Choosing System deletes it. Nothing else is written to your device — campaign parameters and referral codes are read from the current page address and are not stored in your browser.

Kaveri, our internal staff tool, is not a public page. When a member of staff signs in to it, Kaveri sets its own first-party, HttpOnly session cookie to keep them signed in. Visitors and members never receive it, and it is not used for statistics or tracking.

The Lagnora app keeps your sign-in in your phone's secure storage (the iOS Keychain, or storage protected by the Android Keystore) and removes it when you sign out. Crash reports go to Firebase Crashlytics only if you turn on crash diagnostics in the app (Settings → Privacy → Crash diagnostics); until then the app sends nothing to Crashlytics. See section 2. The app contains no advertising SDK and no Firebase Analytics, and it does not use the advertising identifier (IDFA or Google advertising ID).

On the website we use Plausible Analytics, which is cookie-free, EU-hosted and stores nothing on your device. We do not use Google Analytics. The Cookies and similar technologies page lists the full inventory.

10. Changes to this policy

We update this page and the effective date above whenever something changes. When a release starts collecting something from section 3, this policy changes in that same release rather than afterwards.

11. Contact

Data protection contact, Sagous B.V.: privacy@lagnora.com. Postal address: Startbaan 6, 1185 XR Amstelveen, the Netherlands.

We answer privacy mail in English or Dutch.