Lyamo
Back to home

Privacy Policy

1. Data controller

The controller of your personal data is Piotr Kulbacki, Bendastr. 11, 12051 Berlin. Email: kontakt@lyamo.eu.

Further provider details are in the legal notice (Impressum).

2. Purposes and legal bases

We process personal data only for specified purposes:

  • User account (registration, login, settings) - Art. 6(1)(b) GDPR (contract).
  • Expense tracking, receipt OCR, and the AI assistant - Art. 6(1)(b) GDPR (contract).
  • Subscriptions, invoices, and billing - Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal obligation).
  • Contact form and support emails - Art. 6(1)(b) GDPR (pre-contractual request) or Art. 6(1)(f) GDPR (responding to enquiries).
  • Necessary cookies (session, language, consent record) - Art. 6(1)(b) and Art. 6(1)(f) GDPR.
  • Analytics and error monitoring (PostHog, Vercel Analytics, Sentry) - Art. 6(1)(a) GDPR (consent).
  • Legal obligations such as accounting records - Art. 6(1)(c) GDPR.

3. Special categories of data

Receipts that you upload may incidentally contain special categories of personal data (Art. 9 GDPR), for example pharmacy purchases. We do not request such data as a separate category. Processing happens only to provide the service you ordered. By uploading a receipt you give explicit consent to that processing (Art. 9(2)(a) GDPR). You can delete receipts and your account at any time.

4. What we store and for how long

We process account data (email, name, settings), transactions you save, AI chat messages, receipt scan results, and billing metadata. Retention:

  • Receipt images: deleted immediately after OCR on FREE; 60 days on PRO; 365 days on PREMIUM.
  • Transactions, chat, and account data: until you delete them or delete the account.
  • Inactive accounts may be deleted after 24 months without sign-in, after an email notice.
  • Cookie consent is stored for up to 365 days.
  • Billing and invoice data are kept for the period required by German tax and accounting law.
  • You can delete your account and application data at any time from Settings.

5. Recipients (processors and independent controllers)

To provide the service we use trusted providers. Your data may be processed by:

  • OpenAI, L.L.C. (USA) - receipt OCR and AI chat. According to OpenAI API terms, API data is not used to train OpenAI models.
  • Stripe Payments Europe, Ltd. (Ireland) - subscriptions. Stripe acts as an independent controller for payment card data; we do not receive your full card number.
  • Supabase, Inc. (USA/EU) - database and receipt image storage.
  • Vercel Inc. (USA/EU) - application hosting and, with consent, Web Analytics.
  • Brevo (France/EU) - transactional email.
  • PostHog (EU) - product analytics, only after you consent.
  • Functional Software, Inc. / Sentry (USA/EU) - error monitoring, only after analytics consent.
  • Upstash, Inc. (USA/EU) - rate limiting (request metadata such as IP address).
  • Google Ireland Limited / Google LLC - Google Sign-In (email, name, profile picture) if you choose that login method.

6. International transfers

Some providers (in particular OpenAI, Supabase, Vercel, Sentry, Upstash, and Google) may process data in the United States or other countries outside the EEA. Where required, transfers are based on the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as applicable to the provider.

7. Your rights

Under the GDPR you have the right to:

  • Access your data (in the app and by emailing the controller).
  • Rectify data (edit in Settings or by contacting us).
  • Erase data - delete individual data or the entire account in Settings. Deletion of application data is permanent.
  • Restrict processing.
  • Object to processing based on legitimate interests.
  • Data portability where processing is based on a contract or consent. A self-service export is not yet available; you can request a copy by email.
  • Withdraw consent for optional cookies without affecting the lawfulness of processing before withdrawal.
  • Lodge a complaint with a supervisory authority, in particular the Berlin DPA listed below, or another authority in your country of residence (for example UODO in Poland).

8. Google account data

If you use Google Sign-In, we access only your email address, first and last name, and profile picture to create an account and authorize access. We do not access Google Drive, Gmail, or other Google data. This profile data is not sold.

9. Cookies

We use the following cookie categories (TDDDG § 25):

  • Necessary cookies - required for sign-in, session security, language, and storing your cookie choice. These cannot be disabled.
  • Analytics cookies - PostHog, Vercel Analytics, and Sentry, only after consent.
  • Marketing cookies - this category is reserved. No marketing pixels or ad scripts are loaded at present.

Cookies and similar technologies we use:

  • sec_session - necessary - keeps you signed in (up to 7 days).
  • sec_locale - necessary - language preference (up to 1 year).
  • sec_cookie_consent - necessary - stores your cookie decision (up to 365 days).
  • PostHog cookies / localStorage - analytics - product usage, only after consent.
  • Vercel Analytics - analytics - aggregated traffic, only after consent.

Analytics technologies are enabled only after you give consent. We store your cookie decision for up to 365 days. You can change it at any time:

10. Data protection officer and complaints

No data protection officer has been appointed, as this is not legally required for this service. You may contact the controller at kontakt@lyamo.eu or lodge a complaint with the competent supervisory authority:

Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin.

11. Security

We use HTTPS, hashed passwords, access-controlled storage for receipt images, and we do not sell your personal data. No processing is fully automated decision-making with legal effects under Art. 22 GDPR.

Privacy Policy | Lyamo