Privacy Policy

We are the controller of the data of website visitors, of people who write to us, and of our clients' contact and billing data.

When we operate an AI agent for a business client, we process the data of that business's end customers on its behalf and following its instructions; the business is the controller of that data. If you are an end customer of one of our clients, please direct your requests to that business first; we will help it respond.

We only collect the information needed for each purpose.

• Website visitors: IP address, browser, device, requested pages, and technical error data, processed by our hosting, security, and monitoring providers. We do not use analytics or advertising cookies.
• Contact form: name, email address, company and subject (optional), message, and page language. To prevent abuse, your IP address and an anti-bot check are also processed.
• Clients: contact details, business name, Meta Business Manager identifiers, WhatsApp numbers, linked pages and profiles, technical integration credentials, and billing and payment data.
• Our clients' end customers: WhatsApp number, profile name, conversation content (text, audio, and images), message metadata, and the record of their consent or opt-out.

Where the EU General Data Protection Regulation (GDPR) applies, we state the legal basis for each purpose.

• Answering your inquiries and preparing proposals: steps taken at your request before entering into a contract, and our legitimate interest in handling business inquiries.
• Providing, configuring, and supporting the contracted services: performance of the contract with the client.
• Operating the AI agents that serve end customers: on behalf of the business client, which must have its own legal basis (for example, the end customer's consent or request).
• Protecting the website and services against spam, fraud, and abuse, and detecting technical errors: our legitimate interest in security and proper operation.
• Invoicing, collecting payments, and meeting accounting, tax, and legal obligations: legal obligation and performance of the contract.
• We do not send marketing communications without your prior consent, and you can withdraw it at any time.
• The required form fields are necessary to reply to you; if you do not provide them, we cannot handle your enquiry. We do not make decisions based solely on automated processing that produce legal effects on you.

The agents we operate use third-party AI models (currently OpenAI and Google Gemini) to transcribe audio, interpret images, and draft replies based on the information the business client provides. The agent identifies itself as an AI assistant at the start of the conversation and can hand it off to a person on the business's team.

We do not use end customers' conversations to train our own models. AI providers process the data as processors, under their data-use terms for API services.

We do not sell personal information or share it for cross-context behavioral advertising. We only share it with providers that perform services for us (processors) under confidentiality and security obligations, and when required by law or a competent authority.

• Vercel Inc. (USA): website hosting and technical logs.
• Cloudflare, Inc. (USA): DNS, Turnstile anti-bot verification, image storage, and encrypted backups.
• Resend (USA): email delivery of contact form messages.
• Google LLC (USA): Google Workspace, the email service where we receive contact form messages and communicate with clients.
• Upstash, Inc. (USA): temporary contact form rate limiting to prevent abuse.
• Functional Software, Inc. / Sentry (USA): monitoring of errors and technical events, including aggregate clicks on the links page.
• Meta Platforms, Inc. (USA): WhatsApp Business Platform and other Meta APIs.
• OpenAI (USA) and Google LLC (USA): AI models.
• Hostinger International Ltd. (Cyprus; cloud servers) and automation and inbox tools we self-host: running workflows and conversation inboxes.
• Supabase, Inc., Clerk, Inc., and Better Stack, Inc. (USA): database, authentication, and monitoring for the client portal.
• Stripe, Inc. (USA): payment processing. We do not store card data.

LEMIT LABS is a United States company and most of our providers process data in the USA or other countries. When we transfer personal data from the European Economic Area, we rely on the EU-U.S. Data Privacy Framework where the provider is certified, or on the Standard Contractual Clauses approved by the European Commission.

We keep information only for as long as needed for the purpose it was collected for:

• Contact form messages: for the duration of the business conversation and at most 24 months after the last contact, unless you become a client.
• Contact form rate-limit records: deleted automatically after one hour.
• End-customer conversations: 90 days.
• Client data after the service ends: deleted within 30 days, except data we must keep by law.
• Website technical and error logs: up to 90 days, depending on the provider.
• Audit and security logs: 12 months.
• Billing data: for the period required by applicable tax and accounting rules.

We apply reasonable technical and organizational measures to protect information against unauthorized access, loss, or misuse.

• Encrypted connections (HTTPS) and encrypted backups.
• Restricted access to tokens and credentials, with data separated per client.
• Error monitoring configured not to send identifying personal data.

You can request access to your data, its correction or deletion, and withdraw your consent where processing is based on it. Email [email protected] with your request; we may ask for additional information to verify your identity. We respond within 30 days at the latest.

• European Economic Area and United Kingdom: you also have the right to data portability, to object to processing based on legitimate interest, to request restriction, and to lodge a complaint with your local data protection authority.
• California and other U.S. states: you have the right to know what data we process, to request its correction or deletion, and not to be discriminated against for exercising your rights. You may act through an authorized agent.
• Venezuela: you may exercise the right to access, update, rectify, or destroy your data (habeas data) recognized in Article 28 of the Constitution.

We do not sell or share personal information for money or for targeted advertising, and have not done so in the past 12 months. Because we do not track visitors across websites, your browser's Do Not Track or Global Privacy Control signals do not require changes to our processing; we honor them by default.

The website does not use analytics or advertising cookies. We only use technologies strictly necessary for the security of the contact form. See our Cookie Policy (lemitlabs.com/en/cookies) for details.

Our services are intended for businesses and not for children under 16. We do not knowingly collect children's data; if you believe we have, contact us and we will delete it.

Certain LEMIT LABS solutions may request authorization to access Google services, such as Gmail, Google Drive, Google Calendar, or Google Sheets. Access always depends on the permissions that the account owner explicitly grants through OAuth.

When an integration is authorized, we may access the data required to perform the requested functionality, such as emails, files, events, spreadsheets, or related metadata. This data is used only to operate authorized workflows and within the scope of the granted OAuth permissions.

We do not use Google user data for purposes that are incompatible with the authorization provided.

Our use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

The account owner can revoke an integration's access through their Google Account security settings. Revocation may affect workflows that depend on that access.

We may update this policy for legal, operational, or technical reasons. The date of the last update appears at the top. If a change is material, we will notify our clients by email before it takes effect.

For any privacy question, email [email protected] or write to LEMIT LABS LLC, 1704 Llano St, Ste B1039, Santa Fe, NM 87505, USA.