Effective September 23, 2026
1. Purpose and Scope
Email is one of the easiest ways for sensitive information to end up somewhere it shouldn't — sent to the wrong address, forwarded without thinking, or left sitting in an inbox indefinitely. This policy sets the baseline rules for anyone communicating on LYVR's behalf: employees, founders, contractors, and advisors alike, whether or not they hold LYVR equity.
2. What Counts as Sensitive Information
Treat the following as sensitive, and handle it under this policy whenever it appears in an email or attachment:
- User data: names, email addresses, flight or travel details, location data, or any other personal information belonging to LYVR users.
- Credentials and secrets: passwords, API keys, access tokens, database connection strings, cloud account credentials, and signing keys.
- Source code and system details: non-public code, infrastructure configuration, architecture diagrams, or security-relevant implementation detail.
- Company financials and cap table: revenue, funding, valuation, equity ownership, and compensation details.
- Legal and investor materials: contracts, term sheets, board materials, and anything marked confidential by the other party.
- Unreleased product or business plans.
3. Rules for Handling Sensitive Information by Email
- Never send credentials by email. Passwords, API keys, and tokens go through a password manager or secrets manager (e.g., a shared vault), never in an email body or attachment — including "for now" or "just this once."
- Use your LYVR email for LYVR business. Don't conduct company business, or forward company information, through a personal email account.
- Double-check the recipient before sending. Autocomplete is the most common cause of a confidentiality mistake — verify the "To" and "Cc" fields, especially when a name could autocomplete to the wrong contact, before sending anything sensitive.
- Share sensitive files through access-controlled links where possible (e.g., a shared drive with expiring or permissioned access) rather than as raw email attachments, so access can be revoked later if needed.
- Don't forward confidential information externally without confirming you're authorized to share it with that recipient.
- Apply need-to-know. Only include recipients who actually need the information to do their job — don't cc broadly on threads containing user data, financials, or credentials.
- Label clearly when it matters. For especially sensitive threads (legal, financial, security), note "Confidential" in the subject line so recipients treat it accordingly.
- Report anything that looks wrong immediately. A suspected phishing email, an email sent to the wrong person, or any sign your account may be compromised should be reported to the Founder right away — the earlier it's reported, the easier it is to contain.
4. Retention
Don't let sensitive information accumulate indefinitely in your inbox. Once information has served its purpose (e.g., a credential has been rotated, a deal has closed), delete or archive the email rather than leaving it searchable forever.
5. Consequences
Failure to follow this policy may result in corrective action, up to and including termination of employment, engagement, or advisory relationship, depending on the severity of the violation. Intentional or grossly negligent disclosure of sensitive information may also expose LYVR and the individual to legal liability.
6. Questions
If you're unsure whether something counts as sensitive, or how to share it safely, ask before sending — contact christian@lyvrapp.com.
