Privacy Policy
Version 1, published October 28, 2026
This Privacy Policy explains how Lessora sp. z o.o., ul. Stanisławowska 47, 54-611 Wrocław, Poland ("we", "us"), handles personal data when you visit https://lessoraauto.com, contact us, or use Lessora Auto (on the web or in our mobile app) as a workshop owner, manager or member of staff.
1. Two roles: controller and processor
- We are the controller for data about visitors to our website, people who contact us, and the owners and staff of Workshops as our customers (accounts, billing, support).
- Workshops are the controllers for the data they keep in Lessora Auto about their customers and vehicles, bookings, jobs, estimates and approvals, intake photos and signatures, invoices, payments, stored tyres and reminders, including data you enter on a workshop's booking page and files a Workshop sends us to import its data. We process that data on their behalf under our Data Processing Agreement. If you are a workshop's customer, for example you received a text message or an estimate link from a workshop, please contact that workshop about your data. We will pass on requests we receive to the Workshop.
2. Contact for data protection
Email [email protected], or write to Lessora sp. z o.o., ul. Stanisławowska 47, 54-611 Wrocław, Poland.
3. What we collect and why
| Data | Why | Legal basis (GDPR) | How long |
|---|---|---|---|
| Server and security logs: IP address, browser, pages requested, time | Run the website securely, find errors, stop abuse | Legitimate interest, Art. 6(1)(f) | A few weeks, longer only if needed for a security incident |
| Analytics through Google Analytics, only after you accept in the cookie banner | Understand how the website and the app are used | Consent, Art. 6(1)(a) | See the Cookie Policy |
| Bot protection on the sign-up form (Cloudflare Turnstile): technical data about your browser and the request | Stop automated sign-ups and spam | Legitimate interest, Art. 6(1)(f) | Not stored by us; processed by Cloudflare for the check |
| Error and crash reports from the website, the app and the mobile app (Sentry, EU): technical data about the error; no names or email addresses, only internal user and Workshop IDs | Find and fix errors | Legitimate interest, Art. 6(1)(f) | Deleted automatically after the period set at Sentry |
| Contact form: name, workshop name, email, phone (optional), message, language | Answer your message | Steps before a contract / legitimate interest, Art. 6(1)(b), (f) | 24 months, then deleted |
| Sign-up and account: name, email, password (stored only as a hash), workshop name, tax ID (NIP) and number of bays, address and other details added in the settings, language, accepted legal documents with time and IP | Create and run the Workshop's account | Contract, Art. 6(1)(b) | While the account exists, then as in section 7 |
| Security of your account: two-factor and passkey settings, sign-in times | Protect the account | Contract and legitimate interest, Art. 6(1)(b), (f) | While the account exists |
| Billing: billing name and address, VAT ID, plan, text message usage, invoices; card details are handled by Stripe, not by us | Charge for the subscription and keep accounting records | Contract and legal obligation, Art. 6(1)(b), (c) | As long as tax and accounting law requires |
| Emails about the service: welcome and tips mails, trial and payment reminders, text message allowance warnings, notices about changes | Run the service and tell you what you need to know | Contract and legitimate interest, Art. 6(1)(b), (f) | While the account exists |
| Support requests and our replies | Help you | Contract, Art. 6(1)(b) | While the account exists, or as long as needed to resolve the request |
| Audit log of actions in the Workshop, including support access | Security and traceability for the Workshop | Legitimate interest, Art. 6(1)(f) | 730 days |
We don't sell personal data, we don't use it for advertising profiles, and we don't make decisions about you based solely on automated processing.
4. Mobile app
Our app for iOS and Android is for the Workshop's staff. It contains no advertising and no tracking. Besides what the app shows from your Workshop, it processes:
- a sign-in token for each device, stored in the phone's secure storage; you can sign out a device in the app at any time;
- a push token, the app version and the platform, so we can send you notifications, for example about a job assigned to you. Pushes go through Google (Firebase Cloud Messaging) and Apple (Push Notification service);
- photos you take in the app for a job, which go straight to the Workshop's account;
- crash reports, as described in section 3.
For the data your Workshop keeps about you as a member of staff (for example your shifts and labour on jobs), the Workshop is the controller, as described in section 1.
5. Who receives the data
We use service providers who process data for us under contracts that meet the GDPR. The current sub-processors, what they do and where:
| Company | What for | Where |
|---|---|---|
| Webdock | Servers, database and backups | European Union |
| Hetzner Online GmbH | Encrypted off-site copy of the backups | European Union |
| Cloudflare | DNS, encryption in transit and protection from attacks | Worldwide network |
| Stripe | Subscriptions and online payments | European Union and United States |
| ImprovMX | Sending email | European Union and United States |
| LINK Mobility Poland (SMSAPI) | Sending text messages to workshops' customers | European Union |
| Google (Firebase Cloud Messaging) | Push notifications to the mobile app | European Union and United States |
| Apple (Push Notification service) | Push notifications to the mobile app | European Union and United States |
| Sentry | Error and crash reports from the web and mobile app | European Union |
Google receives analytics data about the website and the app only if you consent; from the app it gets no names, workshop addresses, registration numbers or record numbers. Stripe processes payment data as described in its own privacy policy for payments it handles as a controller. We disclose data to authorities only where the law requires it. Invoices a Workshop sends to KSeF go to the Polish tax administration on the Workshop's behalf.
6. Transfers outside the EU
We host Lessora Auto in the European Union. Some providers (for example Stripe, Google, Apple and Cloudflare) may process data outside the EEA. Where they do, the transfer is covered by an adequacy decision (such as the EU-US Data Privacy Framework) or by the European Commission's Standard Contractual Clauses.
7. How long we keep data
Besides the periods in section 3: when a Workshop is deleted, it can be restored for 30 days and is then permanently deleted. Copies may stay in encrypted backups for up to 30 days. We keep billing records for as long as tax law requires.
8. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to processing, and to data portability. Where processing is based on consent, you can withdraw it at any time (for analytics: "Cookie settings" at the bottom of every page of the website, or in the user menu of the app). Owners and managers can export and correct much of their data themselves in the app.
To use your rights, email [email protected]. We answer within one month.
You also have the right to complain to a data protection authority, in particular in the EU country where you live or work. Our lead authority is Prezes Urzędu Ochrony Danych Osobowych (UODO) (https://uodo.gov.pl).
9. Security
We protect data with encryption in transit (HTTPS with HSTS), encrypted backups, strict separation between Workshops, two-factor authentication for workshop staff, access only for our staff who need it (with every support access recorded), and regular updates. See GDPR and data protection for more.
10. Changes
We update this policy when our processing changes. The date and version are shown at the top. For material changes, we tell owners by email or in the app.