Privacy Policy

The short version

• Your notes are visible only to you. We do not sell data, show ads or use trackers.
• When you capture a note, ask a question, speak or draw a portrait, that content is sent to an AI provider to be processed. It is not used to train AI models.
• Voice recordings are not stored. Photos are not stored unless you keep one as a picture.
• Your location is never stored on our servers. It is only used, rounded, when you look for errands near you.
• You can export your data or delete your account at any time.

1. Who is responsible

Lorami is provided by DAVOS TECHNOLOGIES S.R.L., Bucharest, Romania, fiscal code (CUI) 50480681 ("we", "us"). We are the controller of the personal data described in this policy. You can reach us at hello@lorami.app about anything in it.

2. What we collect, and why

Your account

Your name, email address and password. The password is stored only as a secure hash, never in readable form. We also keep your settings: language, time zone, the hour you want reminders, and preferences such as whether pictures are drawn by AI. We need these to provide the service (Article 6(1)(b) GDPR, performance of a contract).

What you save

The notes, people, places, things, connections, categories, to-dos and reminders you create, and the pictures you choose to keep. This is the service itself, so the legal basis is again the contract with you.

Voice recordings

When you speak to Lorami, the recording is sent to our AI provider to be transcribed and understood. It is not stored by us after the request is handled. The resulting text is shown to you, and only what you save is kept.

Photos

When you ask for a drawn portrait, the photo is reduced in size on your device and sent to our AI provider, which returns a drawing. We do not store the photo. If you keep the drawing, it is stored as that person's picture. If you turn drawing off, the photo never leaves your device except as the cropped square picture you choose to keep.

Approximate location

Only if you use errands near you and allow location in your browser or device. Your device sends its position to our server, which rounds it to about 100 metres before asking OpenStreetMap services which shops and places are nearby. The position is sent in the request body, is not stored and is not written to our logs. Your device then compares its own position with those places. You can withdraw permission at any time in your browser or device settings. When you search for a place by name, the search text is sent to OpenStreetMap's Nominatim service.

Notifications

If you turn on reminders on a device, we store the push subscription your browser creates (an address and encryption keys) so we can deliver notifications to it. You can turn this off at any time.

Usage and cost counters

For each day we count how many AI requests you made, what they cost us and how many portraits were drawn. We use this to apply the monthly allowance of your plan and to prevent abuse. The legal basis is the contract and our legitimate interest in fair use and security (Article 6(1)(f) GDPR).

Security and technical data

Like any website, our hosting provider processes technical data such as IP addresses and browser information when you connect. We use IP addresses to limit repeated sign-in attempts. This is based on our legitimate interest in keeping accounts and the service secure.

Payments (planned)

When paid plans launch, payments on the website will be handled by Stripe, and payments in the phone apps by Apple or Google, with RevenueCat keeping track of subscriptions. We will not receive or store your full card details. We keep records of purchases as required by tax and accounting law (Article 6(1)(c) GDPR, legal obligation).

The waitlist

If you join the waitlist before Lorami opens, we keep your email address, the page you joined from and where you came to the site from (for example a search engine), and a scrambled form of your IP address that only lets us limit repeated sign-ups. We use it for one thing: a single email when Lorami opens. The address is deleted from the list as soon as that email is sent. This is based on your consent (Article 6(1)(a) GDPR); to be removed earlier, email hello@lorami.app.

Messages to us

If you email us, we keep the conversation for as long as needed to help you and handle any follow-up.

3. Notes about other people

Lorami is made for remembering things about the people in your life, so your notes will contain information about others. Please save only what you have a fair reason to remember, and treat it with the care you would want for yourself. Avoid saving sensitive details, such as someone's health, religion or sexual orientation, unless it genuinely helps you care for them and they would be comfortable with it. Your notes are private to your account and are never shown to the people they are about or to anyone else.

4. How the AI features use your data

To understand a note or answer a question, the AI needs context. With each request we send the content you gave (text, recording or photo) and the relevant parts of what you already saved, for example the names of people you know and the notes about the person you asked about. We send only what the request needs.

Requests go through OpenRouter to Google's Gemini models. OpenRouter is configured to use only providers that do not train on the data sent to them. Providers may keep requests for a short period for abuse monitoring, as described in their terms. Neither we nor they use your content to train AI models.

AI can make mistakes. Lorami shows you what it understood before anything is saved, and you can correct or delete any note. The AI does not make decisions about you that have legal or similarly significant effects.

5. Who processes your data

We use the following service providers. Each processes data only to provide its part of the service, under a data processing agreement or equivalent terms.

Cloudflare, Inc.

Hosting, database, file storage, network security and delivery of the website and app.

Data: All account data, notes, pictures you keep, push subscriptions, usage counters, technical request data such as IP addresses.

OpenRouter, Inc.

Routes AI requests to the model provider. Configured so that requests only go to providers that do not train on the data.

Data: The note, question, voice recording or photo you send, and the saved notes needed to handle it.

Google (Gemini models)

Runs the AI models that understand notes, transcribe voice, answer questions and draw portraits.

Data: The same content as above, received through OpenRouter.

OpenStreetMap services (Overpass API, Nominatim)

Finding shops and places near you for errands, and searching for a place by name. Only when you use these features.

Data: A position rounded to about 100 metres, or the place name you search for. Never your account or notes.

Web push services (Apple, Google, Mozilla, depending on your browser)

Deliver reminder notifications to your device.

Data: An encrypted notification and the address of your device subscription. The push service cannot read the text.

Resend (planned)

Sending account emails such as password resets, and the one waitlist email when we open.

Data: Your email address and the message.

Stripe (planned)

Payments for subscriptions bought on the website.

Data: Billing details and card data, which Stripe handles directly. We receive only the subscription status.

RevenueCat (planned)

Keeps track of subscriptions bought in the phone apps.

Data: An account identifier and the subscription status.

Apple App Store and Google Play (planned)

Payments for subscriptions bought in the phone apps. They act under their own terms and privacy policies.

Data: Whatever you give them for the purchase. We receive only the subscription status.

"Planned" means the service is not used yet and will be used when that feature launches.

6. Transfers outside the European Economic Area

Some providers are based in the United States or process data there. Where that happens, the transfer is protected by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

7. How long we keep data

• Your account and everything you save: for as long as you keep your account.
• Something you delete: removed from the live database straight away, and from backups within 30 days.
• Your whole account, once you delete it: removed from the live database straight away, and from backups within 30 days.
• Voice recordings and photos sent for drawing: not stored by us after the request.
• Location: not stored.
• Waitlist email addresses: until the launch email is sent, then deleted.
• Usage and cost counters: for as long as the account exists.
• Purchase records: for as long as tax and accounting law requires.

8. Cookies and storage on your device

We use one strictly necessary cookie, which keeps you signed in. We do not use analytics, advertising or tracking cookies, so there is no cookie banner. The app also stores a few preferences in your browser's local storage, such as your theme and the positions of people you moved on your map. These never leave your device.

9. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Export your data in a portable format.
• Correct inaccurate data. You can edit your notes and account details directly in the app.
• Delete your data. You can delete notes, people and your whole account in the app.
• Restrict or object to processing based on our legitimate interests.
• Withdraw permission for location or notifications at any time.

For anything you cannot do in the app, write to hello@lorami.app. We answer within one month. You also have the right to complain to the Romanian data protection authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, dataprotection.ro), or to the authority where you live.

10. Security

All traffic is encrypted with HTTPS. Passwords are stored as hashes. Every piece of saved data is tied to its account, and the service is built so one account can never read another's data. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

11. Children

Lorami is not meant for anyone under 16, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

12. Changes to this policy

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect. The date at the top always shows the latest version.