Privacy Policy
Version 1.0.0 · Effective 2026-08-12
This policy explains what personal data we process, why, on what legal basis, and what rights you have. It is an information notice under Art. 13 and 14 GDPR — there is nothing here for you to "accept".
Where your data goes in technical detail is set out on our AI & Sub-processors page, which forms part of this policy.
Last updated: 2026-08-12
1. Controller
Alaa Al Sayegh, Weiterstadt, 64331, Germany Email: info@loremi.ai
We have not appointed a Data Protection Officer. We are not required to under Art. 37 GDPR or § 38 BDSG. You can raise any data protection matter with us directly at the address above.
2. Two roles: our data and your data
This distinction determines your rights, so it matters:
Account data — we are the controller. Information about you as a user: your name, email, workspace and how you use the service. This policy governs it.
Document content — we are a processor. When you upload documents, your organisation decides what goes in and why. We process it on their instructions. If you are an employee using a workspace your employer created, direct requests about document content to your employer; we will support them in responding. The governing terms are the Data Processing Agreement rather than this policy.
3. What we process, and why
3.1 Account and workspace data
Collected when you register: first and last name, email address, company/workspace name, and a password (stored only as a salted hash — we never see it).
- Purpose: creating and operating your account, authentication, support.
- Legal basis: Art. 6(1)(b) GDPR — performance of a contract.
- Required? Yes. We cannot provide an account without it.
3.2 Email verification
We send a six-digit code to confirm your address.
- Purpose: verifying the address belongs to you; preventing abuse.
- Legal basis: Art. 6(1)(b) and Art. 6(1)(f) — our legitimate interest in preventing fraudulent sign-ups.
3.3 Document content
Files you upload, the text extracted from them, and the search index built from that text. Documents may contain personal data about third parties — that is your organisation's decision and responsibility as controller.
- Purpose: providing the service you asked for: OCR, search, AI answers.
- Legal basis: Art. 6(1)(b), and Art. 28 GDPR in our role as processor.
- Please note: do not upload special categories of data under Art. 9 GDPR during the Beta.
3.4 Queries and AI interactions
The questions you ask and the answers generated.
- Purpose: producing answers; diagnosing faults.
- Legal basis: Art. 6(1)(b).
3.5 Legal acceptance records
When you accept our Terms, we record which document version you accepted, when, your IP address and your browser user agent.
- Purpose: demonstrating agreement, as Art. 7(1) GDPR requires us to be able to do.
- Legal basis: Art. 6(1)(c) — compliance with a legal obligation.
3.6 Sign-in records and server logs
When you sign in, we store your IP address together with the session, and we record the sign-in event (including failed attempts) in our server logs.
- Purpose: letting you see and end active sessions, detecting unauthorised access, and blocking brute-force attempts on your account.
- Legal basis: Art. 6(1)(f) — legitimate interest in keeping accounts secure.
3.7 What we do not do
We use no analytics, no tracking pixels, no advertising networks and no third-party cookies. We do not profile you. We do not sell or rent personal data. We do not make automated decisions producing legal or similarly significant effects about you within the meaning of Art. 22 GDPR — AI-generated answers are informational output, not decisions about you.
4. Cookies and local storage
We store only what the service cannot run without:
| What | Purpose | Duration |
|---|---|---|
| Session cookie (HttpOnly) | Keeps you signed in | Until sign-out / expiry |
localStorage: language, theme | Remembers your display preferences | Until you clear it |
All of this is strictly necessary under § 25(2) TDDDG, so no consent banner is required and we do not show one.
5. Recipients and international transfers
We use sub-processors to run the service. The complete, current list — with each provider's location, purpose and transfer safeguard — is on the AI & Sub-processors page.
In summary: hosting and search indexing take place in German based data centers. Some AI providers process data in the United States, and our development partner AST is located in Lebanon. Neither the USA (outside the Data Privacy Framework) nor Lebanon is covered by a general EU adequacy decision. Those transfers are therefore made on the basis of EU Standard Contractual Clauses under Art. 46(2)(c) GDPR, supported by a Transfer Impact Assessment. You may request a copy of the safeguards at info@loremi.ai.
Beyond these, we disclose personal data only where legally obliged.
6. Retention
| Data | Retained for |
|---|---|
| Account data | Duration of the account, then deleted within 90 days |
| Documents and search index | Until you delete them, or 90 days after account closure |
| Legal acceptance records | 3 years after the contract ends (limitation period, § 195 BGB) |
| Invoices and tax records | 10 years (§ 147 AO, § 257 HGB) |
| Session records (incl. IP) | Until the session ends or you delete it |
| Server logs | 7 days |
Deleting a document removes it from storage and from the search index in both tiers.
7. Security
The service runs on a Kubernetes cluster in a German data centre. Data is encrypted in transit (TLS) and at rest. Passwords are stored as salted hashes and are never recoverable, by us or anyone else. Every database query is scoped by workspace so tenants remain separated. Administrative access is restricted to named individuals, logged, and bound by confidentiality undertakings.
Optional PII masking can remove personal data before content reaches an AI provider — see the AI & Sub-processors page for its capabilities and its limits.
8. Your rights
Under the GDPR you may:
- Access your data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Erase your data (Art. 17)
- Restrict processing (Art. 18)
- Port your data in a machine-readable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time, without affecting prior lawful processing (Art. 7(3))
Write to info@loremi.ai. We aim to answer within one week, and in any case within one month, as Art. 12(3) GDPR requires.
If something is wrong, please come to us first. Almost every issue is faster to fix directly, and we would rather hear about it than not.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — either the authority responsible for us, or the one where you live or work
9. Changes
We will notify workspace administrators by email of material changes at least 30 days in advance. The version and effective date are shown at the top of this page.