Privacy notice
Notice under Articles 13 and 14 of Regulation (EU) 2016/679 («GDPR»). Version 1.2 · updated 13 October 2026.
This notice explains which personal data Lemma (the Ancient Greek and Latin tutor at lemma.algon.one) processes, why, for how long, who it is shared with and how you can exercise your rights. For cookies see the Cookie policy; the rules of use are in the Terms of service.
1. Who is the data controller
IMANAGER S.R.L., a limited liability company with registered office at Viale Monza 256, 20126 Milano (MI), Italia; tax code and VAT number 10275570967; entered in the Milan Monza Brianza Lodi Register of Companies, REA number MI-2518617; share capital € 26,568.47 fully paid up; certified email (PEC) imanager@legalmail.it; contact email ciao@lemma.algon.one.
We have not appointed a Data Protection Officer (DPO). For any request about your data write to ciao@lemma.algon.one.
2. Which data we process, why and on what legal basis
| What | Which data | Why | Legal basis (Art. 6 GDPR) |
|---|---|---|---|
| Registration and sign-in (free trial and subscription) | first and last name, email, city, country, language; date and country of the request; one-time sign-in links (we keep only their cryptographic fingerprint); work session | create your account and let you in without a password | performance of a contract or pre-contractual steps at your request (point b). Without these data we cannot create the account. |
| Age declaration | your declaration that you are at least 14 (date and version of the terms) | comply with age limits for online services (Art. 8 GDPR; Art. 2-quinquies of the Italian Privacy Code) | legal obligation (point c) |
| Using Lemma | the questions you ask, the answers, the conversations, the texts you paste or upload in your folders, your preferences; photos you send and the audio of voice dictation (see section 3: we do not keep them) | provide the service: answer, remember conversations, search your texts | performance of the contract (point b) |
| Fair use and cost control | number of questions, when, model used, amount of text processed and estimated cost (never the content) | apply the fair use described in the Terms and keep costs under control | performance of the contract (point b) and legitimate interest (point f) |
| Abuse prevention and security | fingerprint (HMAC, not reversible) of the IP address and of the normalised email; country; a random identifier in the technical cookie «lemma_prova»; anti-bot check (Cloudflare Turnstile); technical operation logs | prevent the free trial from being requested repeatedly with different details, stop automated use, protect the service | our and other users' legitimate interest (point f); you may object (section 8) |
| Newsletter (optional) | email, first and last name, language, plan, country; the record of your consent (date, text shown, version, channel); open and click statistics of the emails | send you news, study tips and offers from Lemma | consent (point a), which you give by ticking a dedicated box and can withdraw at any time |
| Support | the messages you write to ciao@lemma.algon.one or in the app's help box (with the page you write from and the service version number) and the data they contain | reply to you | performance of the contract or legitimate interest (points b, f) |
| Error reports | the text of the question and answer you report, the note you write, the service version | fix errors and improve Lemma's quality | legitimate interest (point f): it is a feature you use on your own initiative |
| Administrative and tax duties | (once online payments are active) billing and payment data | issue invoices and keep accounts | legal obligation (point c) |
We do not profile you, we do not take automated decisions with legal effects on you (Art. 22 GDPR) and we do not sell your data. We do not use your conversations to train artificial-intelligence models and we do not read them routinely: we look at them only if you ask us for support, if you report them as an error, to investigate abuse or a security incident, or where the law requires.
The data are provided by you, directly or by using the service (questions, texts, settings); technical and security data are generated when you use it. We do not receive data about you from other sources.
3. How we use artificial intelligence
You are interacting with a generative artificial-intelligence system: Lemma answers your questions on ancient texts with a language model and cites the sources of the dictionaries, grammars and analyses it uses. Answers may contain errors: check them (see the Terms). We tell you on every screen that you are talking to an artificial-intelligence system, and answers point to their sources so you can check them (Article 50 of Regulation (EU) 2024/1689). We do not profile you or take automated decisions with legal effects on you (Art. 22 GDPR); your questions are not used to train the models.
To answer, we send to the model provider (Google, through Cloudflare's infrastructure) the text of your question, the passages you pasted or that Lemma retrieves from your folders and, if you use it, the photo to transcribe. The text and photos are used only to produce the answer or transcription. Lemma does not store photos: the transcription comes back to you as a proposal to proofread. Under the terms of Google's paid API, the content sent is not used to improve Google's products and Google may retain it for a limited period solely to detect prohibited use and meet legal obligations. The Cloudflare infrastructure that routes the calls is configured not to log the content of requests and not to reuse responses across different users.
Voice dictation. If you use the microphone to dictate a question, your browser asks for permission and the audio is sent to Lemma only while you record; it is converted to text by a speech-recognition model running on Cloudflare's network (Workers AI) and is not stored: what remains is the text, which returns to the question box and which you send or delete yourself.
Please do not enter other people's personal data or special categories of data (for example health data): Lemma is for studying ancient texts and does not need them.
4. Who we share data with
We process data with the help of providers acting as processors under data processing agreements (Art. 28 GDPR):
| Provider | What it does for us |
|---|---|
| Cloudflare, Inc. (United States) | hosts the site and the databases (EU jurisdiction for customer and conversation data), the file storage, the service's incoming and outgoing email, the anti-bot check, the transcription of voice dictation and the infrastructure that routes calls to the models |
| Google LLC (United States), through Cloudflare | processes questions and photos with the artificial-intelligence model (section 3) |
| Sendinblue SAS, operating as «Brevo» (France) | sends the newsletter; receives data only if you gave consent |
| Advisers and professionals (accountant, lawyers) | for administrative and tax duties and to protect our rights |
| Stripe Payments Europe, Ltd. (Ireland), with Stripe, Inc. (USA) | collects card payments, manages the subscription and calculates tax. For executing payments, fraud prevention and anti-money-laundering duties it acts as an independent controller (stripe.com/privacy); for managing the subscription it is our processor. We do not store your card details |
We may disclose data to public authorities where the law requires. We do not publish your data.
5. Transfers outside the European Economic Area
Customer and conversation databases are hosted in the European Union. Cloudflare and Google are US companies: processing of questions and transit of data through their network may involve processing in the United States. These transfers rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework for certified providers or, alternatively, on the standard contractual clauses approved by the Commission, with the supplementary safeguards the providers offer. You can ask us for a copy of the safeguards by writing to ciao@lemma.algon.one.
The search index is an exception: to search your texts and folders Lemma derives numerical representations (vectors) from them, without the text, linked to opaque codes (not to your name or email); the Cloudflare index that holds them does not allow choosing EU jurisdiction. The text itself stays in the databases and storage under EU jurisdiction.
6. How long we keep data
| Data | Retention |
|---|---|
| Trial accounts (details, conversations, consents, newsletter contact) | deleted 90 days after registration at the latest, unless you move to a paid plan; earlier if you ask for deletion |
| Accounts with a plan | as long as the account exists; we delete them when you ask (from the Subscription page) or by email |
| Conversations, uploaded texts, preferences | until you delete them or delete the account. They may remain, for a limited time and normally no longer than 30 days, in providers' technical backup copies |
| Consent record | as long as the account exists; deleted with the account |
| Abuse-prevention record (fingerprints, not plain data) | 12 months from the trial request, even if the account has been deleted in the meantime: otherwise deletion would entitle you to a new trial |
| Deletion record (email fingerprint, reason, date) | 5 years, so we can show that data were deleted |
| AI usage and cost record | 13 months; when the account is deleted the rows remain but no longer linked to you |
| Technical operation data (timings, outcomes; no content) | 13 months, then deleted; daily counters 35 days. When the account is deleted they remain but no longer linked to you |
| Error reports | 12 months; also deleted with the account |
| Messages sent to ciao@lemma.algon.one | 24 months, or earlier if you ask for deletion |
| Messages written in the app's help box | 24 months; also deleted with the account |
| Record of service emails sent (recipient, type, outcome) | 12 months |
| Sign-in links | expire after 30 minutes and after use; expired fingerprints are removed within 7 days |
| Failed sign-in attempts to the administration area (network fingerprint, not the IP address) | 24 hours |
| Newsletter | until you withdraw consent or delete the account; then removed from Brevo |
| Tax and accounting data | 10 years, as required by law |
| Infrastructure logs (Cloudflare) | for the period set by the provider, normally a few days |
7. How we protect data
We adopt technical and organisational measures appropriate to the risk, including: encrypted connections; separate databases for customer details and for conversations, in EU jurisdiction; short-lived one-time sign-in links, of which we keep only the fingerprint; non-reversible fingerprints for the identifiers used against abuse; access to data limited to those who need it; usage limits that reduce the risk of abuse. No system is one hundred per cent secure: in case of a personal data breach we notify you and the supervisory authority in the cases and times required by law.
8. Your rights and how to exercise them
At any time you may ask for access to your data, rectification, erasure, restriction of processing, portability (to receive the data in a structured format) and object to processing based on legitimate interest. You may withdraw your newsletter consent without affecting processing already carried out.
- On your own, on the Subscription page (after signing in): «Download my data», «Delete my account» (two steps), newsletter subscription and withdrawal. Every newsletter email also has an unsubscribe link.
- By email to ciao@lemma.algon.one: we reply without undue delay and in any case within one month, extendable by two months in complex cases, telling you. We may ask you to verify your identity.
If you believe the processing breaches the law, you have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it) or the authority of your country, and to go to court.
9. Minors
Lemma is for people aged 14 or over. To register we ask you to declare that you are at least 14; we do not want to collect data from younger people and, if we learn of it, we delete it. If you are under 18, an adult with parental responsibility must take out any paid subscription for you (see the Terms).
10. Cookies and similar technologies
We use only technical cookies and data stored on your device that are strictly necessary for operation: see the Cookie policy. We use no advertising cookies and no third-party analytics cookies.
11. Changes
If our practices or the law change we update this notice, with the new date and version number at the top. For substantial changes, and in particular if the controller changes, we notify you by email before they take effect.
Related documents: Cookie policy · Terms of service · Sources and licences.