Privacy Policy

1. Data Controller

The data controller for your personal data is Lemnoria OÜ, a private limited company registered in Estonia (EU). For privacy-related enquiries, contact us at •••@•••.

2. Information We Collect

We collect information you provide directly: name, email address, and product images you upload. We also collect usage data such as feature interactions and credit consumption to operate and improve the Service.

3. How We Use Your Information and Legal Basis

Your data is used to provide and improve the Service, process payments via Stripe, and send transactional emails (e.g. account confirmation, payment receipts). We do not sell your personal data to third parties.

Under the GDPR, we rely on the following legal bases for processing your personal data:

• Performance of a contract (Art. 6(1)(b)) — account creation, service delivery, AI feature execution, payment processing, and transactional emails.
• Legal obligation (Art. 6(1)(c)) — retention of billing records for 7 years under the Estonian Accounting Act.
• Legitimate interests (Art. 6(1)(f)) — error monitoring, security logging, fraud prevention, and email suppression list management.
• Consent (Art. 6(1)(a)) — product analytics (PostHog). Analytics are only activated after you explicitly opt in via our consent notice.

4. Image Data and AI Processing

When you use our AI enhancement or listing generation features, your uploaded images are transmitted to third-party AI providers — specifically fal.ai and OpenAI — for processing. This transfer is necessary to deliver the requested service. Images are sent solely for the purpose of fulfilling your request and are not used to train AI models by these providers under our agreements with them. Uploaded images are stored in private cloud storage accessible only to you and, via service access, to us.

5. Sub-processors and Third-Party Services

We share data only with the following sub-processors required to deliver the Service:

• Supabase Inc. — database, authentication, and file storage (USA)
• Stripe, Inc. — payment processing and billing (USA)
• fal.ai, Inc. — AI image enhancement (USA)
• OpenAI, L.L.C. — AI listing generation (USA)
• Resend, Inc. — transactional email delivery (USA)
• Functional Software, Inc. (Sentry) — error monitoring (USA)
• Trigger.dev — background task processing (Ireland / EU)
• Railway Corporation — application hosting and infrastructure (USA)
• Cloudflare, Inc. — DNS, CDN, and consent management (USA)
• PostHog, Inc. — product analytics, hosted on EU Cloud (Frankfurt, Germany)
• Xolo OÜ — accounting and bookkeeping; accesses billing data from Stripe for statutory reporting (Estonia / EU)

Each provider has their own privacy policy governing data they process. Transfers to sub-processors outside the EU/EEA are covered by Standard Contractual Clauses (SCCs) or the EU–US Data Privacy Framework where applicable.

6. Data Retention

Your account data is retained while your account is active. Billing records are retained for 7 years as required by Estonian accounting regulations. Operational logs (error events, job logs, rate-limit events) and security logs (signup IP address, risk flags) are retained for 90 days. Email delivery logs are retained for 30 days; bounce and complaint suppression records may be retained for longer for suppression and compliance purposes.

7. Account Deletion and Data Anonymisation

You may request account deletion at any time via Account Settings or by emailing •••@•••. Upon deletion:

• Product images and AI outputs — deleted from storage within 30 days.
• Identifying account data (name, email, auth credentials) — removed or replaced with anonymous tokens so that you can no longer be identified.
• Aggregated usage statistics (credit consumption counts, job counts, feature usage) — retained in anonymised form for product analytics and cannot be linked back to you.
• Billing records — retained for 7 years as required by law, stripped of unnecessary personal data where possible.
• Email suppression records — retained to prevent re-sending to addresses that have bounced or complained.

8. Cookies

We use essential session cookies for authentication. Analytics cookies (PostHog) are only set after you give explicit consent via our cookie notice. No advertising or third-party tracking cookies are used. For a full list of cookies and how to manage your preferences, see our Cookie Policy.

9. Your Rights (GDPR / CCPA / CPRA)

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing activities (including processing based on legitimate interests). California residents may exercise rights under the CCPA/CPRA including the right to know, delete, and opt-out of sale (we do not sell personal data). To exercise any right, contact us at •••@•••. We will respond within one month (extendable to three months for complex or high-volume requests).

Where we process your data on the basis of consent (analytics via PostHog), you may withdraw that consent at any time via the Cookie Preferences button in our site footer. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

10. Automated Decision-Making

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (GDPR Art. 22). Our AI features generate product outputs — enhanced images and listing text — for your review. Any decisions with significant consequences, such as account suspension, involve human review.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes via email or an in-app notice. Continued use of the Service after the effective date constitutes acceptance of the updated policy.