Privacy Policy

1. Who We Are

LF Labs ("we", "us", "our") is the data controller responsible for your personal data. Llewra is an AI executive assistant product operated by LF Labs.

• Company: LF Labs (co-founded by Francois Coertze & Llewellyn Hanekom)
• Location: Mallorca, Spain (European Union)
• Website: llewra.io
• Contact: francois@p-yconsulting.com

2. What Data We Collect

We collect data in several ways depending on how you interact with Llewra:

2.1 Waitlist & Account Information

When you sign up for our waitlist or create an account, we collect:

• Full name
• Email address
• Phone number
• Company name

2.2 WhatsApp & Service Data

When you use Llewra as your AI assistant via WhatsApp, we process:

• WhatsApp messages you send to and receive from Llewra
• Calendar events, email content, and task data you grant access to
• Scheduling preferences and communication patterns
• Files or documents you share with the assistant

2.3 Technical & Analytics Data

• IP address, browser type, device information
• Pages visited, time on site, referral source
• Cookie identifiers and localStorage data

3. Why We Process Your Data (Legal Bases)

Under the EU General Data Protection Regulation (GDPR), we process your data on the following legal bases:

4. AI & Automated Processing

Llewra uses artificial intelligence models (including technology from Anthropic and OpenAI) to process your data and provide assistant services. This means:

• Your messages and connected data (calendar, email, tasks) are sent to AI models for processing
• AI generates responses, summaries, scheduling suggestions, and task management actions on your behalf
• No fully automated decisions with legal or similarly significant effects are made without human oversight
• You can request human review of any AI-generated action or output

Under Article 22 GDPR, you have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Llewra's AI assists and suggests — final actions require your confirmation.

5. How We Share Your Data

We share your data only with trusted third parties necessary to deliver our service:

We do not sell your personal data to third parties.

6. International Data Transfers

Some of our service providers are based outside the European Economic Area (EEA), primarily in the United States. When we transfer your data internationally, we ensure adequate protection through:

• EU-US Data Privacy Framework — for providers certified under this framework
• Standard Contractual Clauses (SCCs) — approved by the European Commission
• Adequacy decisions — where applicable

You may request a copy of the safeguards in place by contacting us.

7. Data Retention

• Waitlist data: Until you unsubscribe or 24 months of inactivity
• Account data: Duration of your account plus 30 days after deletion
• WhatsApp messages & service data: As long as your account is active; deleted within 90 days of account closure
• Analytics data: Up to 26 months (Google Analytics default)
• Legal/tax records: As required by Spanish law (typically 5–6 years)

8. Cookies & Tracking

Our website uses the following cookies and tracking technologies:

Essential

• localStorage (cookie consent) — Remembers your cookie preferences. No expiry (persistent until cleared).

Analytics (require consent)

• Google Analytics 4 (G-2KDMF0HS0B) — Measures website traffic and usage patterns. Cookies: _ga (2 years), _ga_* (2 years).
• LinkedIn Insight Tag — Measures ad performance and provides audience insights. Cookies: li_sugr, bcookie, lidc.

You can manage cookies through your browser settings or our cookie consent banner. In accordance with Spanish LSSI-CE (Ley de Servicios de la Sociedad de la Información), we obtain your consent before placing non-essential cookies.

9. Your Rights

Under GDPR, you have the following rights regarding your personal data:

To exercise any of these rights, email us at francois@p-yconsulting.com. We will respond within 30 days.

10. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (TLS/HTTPS) and at rest
• Access controls and authentication
• Regular security reviews
• Secure cloud infrastructure with reputable providers

No system is 100% secure. If we become aware of a data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR.

11. Children's Privacy

Llewra is designed for business professionals and is not directed at children under 16. We do not knowingly collect personal data from anyone under 16 years of age. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

12. Complaints

If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD):

• Website: www.aepd.es
• Address: C/ Jorge Juan, 6, 28001 Madrid, Spain
• Phone: +34 91 266 35 17

You may also contact your local EU data protection authority if you reside in another member state.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via our website or email. Continued use of Llewra after changes constitutes acceptance of the updated policy.

14. Contact Us

For any privacy-related questions or to exercise your data rights: