Privacy Policy

This policy explains how Limineer (“we”, “us”) processes personal data when you use LimOS (the “Service”). We keep it plain: what we collect, why, who touches it, how long we keep it, and the rights you have. Limineer is the controller for account and product data; for content your organization puts into the Service, we generally process it on your organization's behalf.

1. What we collect

• Account and profile data: name, email, job title, discipline, locale, and the profile you write for your personal agent (responsibilities, current focus, the agent's name and personality).
• Organization content: objectives and measures, bets, projects, Captain's Logs, digests, brain entries, and related records your team creates.
• Agent conversations and memory: your chats with the AI agents, their tool activity, and the bounded personal memory your agent keeps of you. That memory is visible and editable by you in Settings, and only your account can read it.
• Voice data: if your organization enables the voice module, audio of voice check-ins is processed to produce transcripts; the transcript, not the audio, is what the Service keeps.
• Technical data: authentication cookies, IP addresses and timestamps in security and server logs, and basic usage events needed to operate and secure the Service.

2. Why we process it

• To provide the Service (performance of contract): accounts, sharing within your organization, the weekly ritual, digests, and the AI features you invoke.
• To keep it secure and running (legitimate interest): authentication, rate limiting, abuse prevention, debugging from server logs.
• To communicate (performance of contract / legitimate interest): transactional email such as invitations, digest deliveries, and reminders your organization configures. No marketing email without consent.

We do not sell personal data, we do not run third-party advertising or cross-site tracking, and we do not use your content to train foundation models.

3. Cookies

The Service uses essential cookies only: session cookies that keep you signed in (Supabase authentication) and operational cookies strictly needed for the app to function. There are no advertising or analytics trackers requiring consent banners.

4. Who processes it (subprocessors)

We use a small set of infrastructure providers to run the Service:

• Supabase: database, authentication, and storage.
• Vercel: application hosting and delivery.
• Anthropic: AI model processing for the agents. Conversations sent for processing are governed by API terms that prohibit training on your data.
• ElevenLabs: speech-to-text and text-to-speech, only when your organization has enabled the voice module.
• Postmark / Resend: transactional email delivery.

Where processing happens outside the European Economic Area, we rely on appropriate safeguards such as adequacy decisions or standard contractual clauses with these providers.

5. How long we keep it

• Account and organization content: for as long as the account or organization is active.
• Personal agent memory: bounded and self-pruning; deletable by you at any time, and deleted with your account.
• Security and server logs: short rolling windows appropriate to their purpose.
• On account deletion or organization offboarding, content is deleted in the normal course of operations; residual copies in backups expire on the backup cycle.

6. Security

Data access in the Service is enforced at the database layer with row-level security: every read and write, including by the AI agents, runs under the requesting user's own access rights, never above them. Secrets are held server-side only, transport is encrypted, and preview environments never point at production data.

7. Your rights

Depending on where you live (and always under the GDPR), you have the right to access, rectify, erase, and export your personal data, to restrict or object to processing, and to withdraw consent where processing is based on it. Much of this is available directly in-product (profile settings, agent memory management); for the rest, email us and we will respond within the statutory period. You also have the right to lodge a complaint with your supervisory authority.

8. Children

The Service is a workplace tool and is not directed at children under 16.

9. Changes to this policy

We will update this policy as the Service evolves and give in-product or email notice of material changes before they take effect.

10. Contact

Privacy questions and rights requests: alex@limineer.com · limineer.com