Privacy Policy

Last updated: 2026-05-05

Lammii, Inc. ("Lammii", "we") respects your privacy. This Policy explains what we collect, why, and your rights — including under GDPR (EU), UK GDPR, CCPA/CPRA (California), and PIPEDA (Canada).

1. What we collect

Account data: email, name, password hash, profile.
Content: products, link pages, drops, generated assets, broadcasts.
Connected platforms: tokens for Gmail, Instagram, TikTok, YouTube, Shopify (encrypted at rest). We only access scopes you authorize.
Audience data: contacts you import or sync into Audience Passport (with consent).
Usage: device/browser, IP, page views, feature events. Used to improve the Service and detect abuse.
Payment data: handled by Stripe. We never see card numbers — only the last 4 digits + tokens.

2. Why we use it

To provide the Service (analyze your inbox for brand deals, draft counters, run drops, etc.).
To bill, prevent fraud, and comply with tax/AML obligations.
To send transactional emails (account, security, payment, drop status, brand-deal detection).
To send marketing emails — only with opt-in. Unsubscribe any time.
To improve the Service (aggregated analytics; never selling personal data).

3. Legal bases (GDPR Art. 6)

Contract — to deliver the Service you signed up for.
Legitimate interest — to secure the Service, prevent abuse, and improve features.
Consent — for marketing emails and non-essential cookies.
Legal obligation — tax, AML, court orders.

4. Sharing & subprocessors

We use the following subprocessors to operate Lammii:

Supabase — database, auth, storage (US/EU regions)
Vercel — hosting, edge network
Stripe — payments, payouts (Stripe Connect Express)
Anthropic — AI inference (Claude)
Resend — transactional email
Google — Gmail API (user-authorized OAuth only), YouTube Data API
Meta — Instagram Graph API (user-authorized only)
TikTok — Display API (user-authorized only)
Cloudflare — DDoS protection, image caching
Sentry — error tracking (no PII in stack traces)
PostHog — product analytics (self-hosted, EU region)

We do not sell your personal data. We do not share it with advertisers.

5. International transfers

For users outside the US, your data may be processed in the United States. We rely on Standard Contractual Clauses (SCCs) with our US-based subprocessors.

6. Retention

We keep account data while your account is active and for up to 30 days after deletion (for backup recovery), then erase. Audit logs are retained for 12 months. Tax records are retained for 7 years per IRS requirements.

7. Your rights

Access & export — Settings → Privacy → Export My Data (full JSON + CSV).
Delete — Settings → Privacy → Delete Account (immediate, irreversible after 30-day grace).
Correct — Edit any field in Settings.
Object — Opt out of marketing in email footer or Settings.
Portability — Audience Passport CSV export.
Lodge a complaint — with your local Data Protection Authority.

8. California (CCPA/CPRA)

California residents may opt out of "selling" or "sharing" personal data — though we don't do either. To exercise rights, email privacy@lammii.com. We do not discriminate against rights-exercisers.

9. Children

Lammii is not directed to children under 18. We don't knowingly collect data from minors. If you believe we have, email privacy@lammii.com and we'll delete it.

10. Security

Encryption in transit (TLS 1.3) and at rest. Tokens are encrypted with AES-256. Row-level security on every database table. SOC 2 Type II audit in progress.

11. Contact

Privacy: privacy@lammii.com · DPO: dpo@lammii.com