Larzo is a quote and invoice generation service for UK tradespeople, operated by LARZO LTD, a company registered in England & Wales (company number 17344060). If you have any questions about this policy, contact us at support@larzo.co.uk.
2. What data we collect
Account information: your name, email address, phone number, company name, and trade type — provided during sign-up.
Business details: VAT number, bank details, logo, Trustpilot/Google Reviews URLs, payment terms, and terms & conditions — provided optionally in Settings.
Quote and invoice data: customer names, addresses, contact details, job descriptions, and line items — entered when creating quotes.
Usage data: a log of quote creation timestamps used to enforce free tier limits.
Payment data: subscription status and Stripe customer ID. We do not store card numbers — payments are handled entirely by Stripe.
Device data: push notification subscription tokens (if you enable notifications).
3. How we use your data
To provide the Larzo service — generating PDFs, sending emails, processing payments.
To enforce subscription limits and prevent abuse.
To send transactional emails to Larzo account holders (quote delivery, invoice delivery, magic links, password resets) — we do not send marketing emails to our users without their explicit consent.
To send push notifications about quote activity (accepted, declined, expired) — only if you have opted in.
AI-generated job descriptions: the raw job description you enter is sent to Anthropic's API to generate professional wording. No customer personal data is included in these prompts.
This section covers our own users. If you are a professional contact — for example an accountant — who has received an outreach email from us without being a Larzo user, see section 5 below.
4. Legal basis (UK GDPR)
Contract performance — processing your account data and quote data is necessary to deliver the service you signed up for.
Legitimate interests — usage logging for quota enforcement and fraud prevention, and the professional outreach described in section 5.
Consent — push notifications (you can withdraw this at any time in Settings → Notifications).
5. Business outreach to professional contacts
Separately from our own users, we sometimes contact accountancy and bookkeeping firms whose business contact details are publicly available — for example an email address published on the firm's own website, on Companies House, or in a professional directory — to introduce Larzo as a tool their clients may already be using or may find useful.
This outreach:
Is sent directly by a member of the Larzo team from our own business email account (Microsoft Outlook), never through Resend, the automated service we use for account and quote emails, and never using tracking pixels or automated follow-ups.
Is only sent to firms operating as a limited company or limited liability partnership. Under the Privacy and Electronic Communications Regulations (PECR), these are “corporate subscribers”, and email marketing to them does not require prior consent. We do not cold-email sole traders or non-LLP partnerships, who are treated the same as individuals under PECR and whose consent we do not have.
Relies on legitimate interests as its lawful basis under UK GDPR where the outreach involves an individual's personal data — for example a named contact at the firm. Before contacting a firm, we check that this is appropriate for that specific contact: publicly listing a business contact detail is not the same as agreeing to be marketed to, so we weigh our interest in reaching relevant professionals against the contact's own rights and reasonable expectations.
Always identifies Larzo as the sender and gives a clear way to stop it: reply to the email, or email sal@larzo.co.uk, and we will not contact that firm again.
We keep a short record of firms we've contacted — the published contact detail used, the date, and whether they've asked not to be contacted — for up to 12 months, except that a "do not contact" request is kept indefinitely so we don't accidentally contact the same firm again. If you've received an email from us this way and have questions, or want us to delete our record of you outside of the above, email sal@larzo.co.uk or support@larzo.co.uk.
6. Third-party processors
We use the following sub-processors to deliver the service. Each has its own privacy policy and data processing agreement:
Anthropic — AI-generated job description text. Job descriptions are processed but not used to train models. anthropic.com/privacy
Railway / Vercel — backend and frontend hosting (US-based, standard contractual clauses apply).
7. Data retention
Your data is kept for as long as your account is active. When you delete your account, we permanently delete your profile, quotes, invoices, stored PDFs, and all related records within 30 days. A small audit log may be retained for fraud prevention purposes for up to 12 months. For the retention of business outreach records described in section 5, see that section.
8. Your rights
Under UK GDPR you have the right to:
Access — request a copy of the personal data we hold about you.
Rectification — correct inaccurate data (most can be updated directly in Settings).
Erasure — delete your account and all associated data via Settings → Account → Delete account.
Portability — request your data in a machine-readable format.
Objection — object to processing based on legitimate interests, including the business outreach in section 5.
Withdraw consent — turn off push notifications at any time in Settings → Notifications.
We use browser localStorage and sessionStorage for draft persistence, session management, and your cookie consent preference — these are stored only on your device.
We use the following third-party services that may set cookies or collect usage data:
Vercel Analytics — anonymous page-view analytics to help us understand how Larzo is used. No personal data is collected. Only loaded with your consent.
Rewardful — affiliate referral tracking. If you arrived via a referral link (e.g. from a partner), this records the referral so the referring partner receives their commission. Attribution is captured from the URL parameter on landing and does not require cookies to function.
Google Analytics and Google Ads — measures how people find Larzo and whether an advert led to a sign-up. Sets cookies and can be used by Google for advertising audiences. Only loaded with your consent.
Meta Pixel (Facebook and Instagram) — measures whether an advert led to a sign-up, and allows us to show adverts to people who have visited the site. This is a retargeting pixel. Only loaded with your consent.
TikTok Pixel — measures whether an advert led to a sign-up, and allows us to show adverts to people who have visited the site. This is a retargeting pixel. Only loaded with your consent.
OneSignal — sends the push notifications you turn on in the app (a quote accepted, an invoice paid). It loads once you are signed in and registers this device so we can reach it. This is part of the service rather than advertising, so it is not covered by the cookie choice below; turning off notifications in your browser or device settings stops it.
Microsoft Clarity — records how pages are used (clicks, scrolling and mouse movement) so we can find and fix usability problems. Only loaded with your consent, and never on pages we send to your customers.
We do use advertising and retargeting pixels, listed above. None of them load until you accept. If you decline, or make no choice, no advertising or analytics tag is created at all — the scripts are never fetched, rather than being loaded and told not to track.
If you decline, or withdraw consent, we remove what was already stored. That includes the campaign or referral tag you arrived with, so a signup after declining is not credited to the advert or partner that sent you, and the advertising cookies set on this site's own domain. Cookies these vendors hold on their domains are outside our reach and expire under their own retention rules, which their policies describe — so declining stops us sending anything further, but does not reach data they already hold.
We never load any of these on the pages we send to your customers — a quote or invoice link, a payment page, or an email confirmation link — nor on the links we email you to confirm an address or reset a password. Those pages carry a single-use token in the address, and we do not pass it to anyone, whatever you have chosen.
You can accept or decline non-essential cookies on any page of the site, and change or withdraw that choice here at any time — withdrawing is exactly as easy as accepting.
You have not made a choice yet, so nothing non-essential is loaded.
The page reloads when you change this. Tags already loaded in this page cannot be stopped without a fresh page, so we reload rather than pretend otherwise.
10. Changes to this policy
We may update this policy from time to time. Material changes will be notified by email to account holders. The current version is always available at larzo.co.uk/privacy.
We use cookies for analytics, advertising measurement and to credit referrals. Decline and we store nothing — including the referral you arrived with. Privacy policy