Record of Processing Activities

In compliance with GDPR Article 30, this page documents all data processing activities performed by LetEmily, including the purposes, legal basis, data categories, and security measures.

Last Updated: November 29, 2025

Data Controller Information

Organization Name
LetEmily
Contact Email
privacy@letemily.com
Data Protection Officer
privacy@letemily.com
Security Contact
security@letemily.com

Processing Activities

1. User Account Management

Purpose of Processing
To provide user authentication, account management, and access to the LetEmily platform services.
Legal Basis
Contract (GDPR Article 6(1)(b)) - Processing is necessary for the performance of a contract with the user.
Categories of Data Subjects
  • Registered users
  • Team administrators
  • Team members
Categories of Personal Data
  • Identity data: name, email address, password (hashed)
  • Account data: user preferences, settings, language
  • Authentication data: login timestamps, session tokens
  • Profile data: bio, avatar, work location
Recipients
  • Internal: Application servers, database servers
  • External: None - data stored internally only
International Data Transfers
Data stored in US data centers with appropriate security measures.
Retention Period
Active users: Retained while account is active. Soft-deleted users: 60 days. Hard-deleted users: 30 days (billing/legal only).
Security Measures
  • Bcrypt password hashing (cost factor 12)
  • TLS 1.3 encryption in transit
  • Database encryption at rest
  • Access controls and authentication
  • Regular security audits

2. Team Collaboration & Meeting Management

Purpose of Processing
To enable team collaboration, meeting scheduling, note-taking, and follow-up management.
Legal Basis
Contract (GDPR Article 6(1)(b)) - Processing is necessary to provide the contracted services.
Categories of Data Subjects
  • Team members
  • Meeting participants
  • Team administrators
Categories of Personal Data
  • Team data: team name, member roles, permissions
  • Meeting data: titles, dates, agendas, attendees
  • Notes and content: meeting notes, decisions, action items
  • Follow-ups: tasks, assignments, due dates
  • Feedback: survey responses, sentiment analysis
Recipients
  • Internal: Application servers, database
  • External: None - shared only within authorized team members
International Data Transfers
Data stored in US data centers with appropriate security measures.
Retention Period
Active teams: Retained while team exists. Meeting data: Retained until account deletion or user-initiated deletion.
Security Measures
  • Role-based access controls (RBAC)
  • Team-level data isolation
  • Audit logging of data access
  • Encrypted data transmission
  • Regular backups (90 days, encrypted)

3. AI-Powered Features (Ask Emily, Content Generation)

Purpose of Processing
To provide AI-powered assistance including mentor conversations, meeting content generation, and intelligent suggestions.
Legal Basis
Consent (GDPR Article 6(1)(a)) - Users explicitly opt-in to AI features via consent management.
Categories of Data Subjects
  • Users who have consented to AI features
  • Team members using AI-generated content
Categories of Personal Data
  • Chat messages: user questions, mentor responses
  • Context data: meeting titles, user preferences
  • Usage data: feature usage, AI model interactions
  • Generated content: AI-created meeting agendas, summaries
Recipients
  • Internal: Application servers, AI service layer
  • External: OpenAI (DPA in place, zero data retention agreement)
International Data Transfers
Data sent to OpenAI (US) for processing with Data Processing Agreement. OpenAI does not train on customer data.
Retention Period
Ask Emily conversations: 365 days after soft deletion. AI cache: 30 days. Usage logs: 90 days.
Security Measures
  • Data Processing Agreement with OpenAI
  • Zero data retention guarantee from OpenAI
  • Encrypted API communications
  • User consent required before processing
  • Audit logging of all AI interactions

4. Payment Processing & Subscription Management

Purpose of Processing
To process payments, manage subscriptions, and handle billing for paid plans.
Legal Basis
Contract (GDPR Article 6(1)(b)) & Legal Obligation (GDPR Article 6(1)(c)) - Required for service delivery and tax compliance.
Categories of Data Subjects
  • Paying customers
  • Subscription holders
Categories of Personal Data
  • Payment data: credit card details (tokenized), billing address
  • Transaction data: payment amounts, dates, invoice numbers
  • Subscription data: plan type, billing cycle, status
Recipients
  • Internal: Billing system, application database
  • External: Stripe (payment processor, PCI-DSS compliant)
International Data Transfers
Payment data processed by Stripe (US/EU) with Data Processing Agreement and PCI-DSS Level 1 certification.
Retention Period
Active subscriptions: Retained while subscription active. Cancelled subscriptions: 7 years (legal requirement for tax/accounting).
Security Measures
  • Stripe tokenization (no card details stored)
  • PCI-DSS Level 1 compliance via Stripe
  • Data Processing Agreement with Stripe
  • Encrypted communication with payment gateway
  • Regular security audits

5. Third-Party Integrations (Google, Microsoft, Slack, Zoom)

Purpose of Processing
To enable calendar synchronization, file storage, communication platform integrations, and video conferencing.
Legal Basis
Consent (GDPR Article 6(1)(a)) - Users explicitly authorize integrations via OAuth consent flow.
Categories of Data Subjects
  • Users who connect third-party integrations
Categories of Personal Data
  • OAuth tokens: access tokens, refresh tokens (encrypted)
  • Calendar data: events, meeting times (read-only)
  • File metadata: document names, locations (no content stored)
  • Integration logs: sync status, error messages
Recipients
  • Internal: Integration service, encrypted database
  • External: Google Workspace, Microsoft 365, Slack, Zoom (as authorized by user)
International Data Transfers
Data exchanged with Google (US), Microsoft (US), Slack (US), Zoom (US) via their respective OAuth APIs with user consent.
Retention Period
Active integrations: Retained while connection active. Disconnected integrations: Tokens immediately deleted. Logs: 90 days.
Security Measures
  • OAuth 2.0 authorization flow
  • Token encryption with libsodium (XSalsa20-Poly1305)
  • Read-only access where possible
  • Tokens deleted immediately upon disconnection
  • Integration audit logging

6. Marketing Communications & Email Campaigns

Purpose of Processing
To send product updates, feature announcements, and promotional content to users who have consented.
Legal Basis
Consent (GDPR Article 6(1)(a)) - Users explicitly opt-in via consent management or early access signup.
Categories of Data Subjects
  • Users who have consented to marketing emails
  • Early access signup users
Categories of Personal Data
  • Contact data: email address, name
  • Preference data: communication preferences, opt-in status
  • Engagement data: email opens, clicks (anonymized after 90 days)
Recipients
  • Internal: Marketing system, email service
  • External: Email service provider (if applicable)
International Data Transfers
Data stored in US data centers. Email service provider may process data in US.
Retention Period
Active consent: Retained while consent valid. Withdrawn consent: Email deleted immediately, logs anonymized after 90 days.
Security Measures
  • Consent tracking with timestamps
  • Easy unsubscribe in all emails
  • IP address anonymization after 90 days
  • Encrypted data storage
  • Regular consent audit

7. Security Monitoring & Fraud Prevention

Purpose of Processing
To detect and prevent unauthorized access, abuse, DDoS attacks, and fraudulent activities.
Legal Basis
Legitimate Interest (GDPR Article 6(1)(f)) - Necessary to protect the security of our systems and users' data.
Categories of Data Subjects
  • All users and visitors
  • Potential attackers or abusers
Categories of Personal Data
  • Security logs: login attempts, failed authentication, IP addresses
  • Rate limiting data: request counts, IP addresses
  • Security incidents: breach reports, investigation notes
  • Audit logs: data access, admin actions, system events
Recipients
  • Internal: Security team, system administrators
  • External: None (unless required by law enforcement)
International Data Transfers
Data stored in US data centers with strict access controls.
Retention Period
Login attempts: 90 days. Rate limits: 90 days. Security events: 180 days (then anonymized). Audit logs: 365 days.
Security Measures
  • Real-time monitoring and alerting
  • Automated threat detection
  • IP address anonymization after retention period
  • Access restricted to security personnel
  • Encrypted logs and secure storage

8. GDPR Compliance & User Rights Management

Purpose of Processing
To fulfill GDPR obligations including consent management, data export, account deletion, and audit logging.
Legal Basis
Legal Obligation (GDPR Article 6(1)(c)) - Required by GDPR Articles 15-22 and Article 30.
Categories of Data Subjects
  • All users exercising GDPR rights
  • Users viewing privacy information
Categories of Personal Data
  • Consent records: consent type, granted/withdrawn dates, IP address
  • Audit logs: data access, exports, deletions, admin actions
  • Cookie consent: preferences, timestamps, session IDs
  • Data requests: export requests, deletion requests
Recipients
  • Internal: Compliance system, audit database
  • External: Supervisory authorities (if breach notification required)
International Data Transfers
Data stored in US data centers. Breach notifications to EU supervisory authorities as required by Article 33.
Retention Period
Consent records: 13 months after expiration. Audit logs: 365 days. Cookie consent: 13 months. Breach records: 5 years (legal requirement).
Security Measures
  • Immutable audit logs
  • Tamper-proof logging system
  • Access controls on compliance data
  • 72-hour breach notification tracking
  • Regular compliance audits

International Data Transfers

LetEmily operates from the United States. Personal data from EU residents is transferred to and processed in the US. We implement appropriate safeguards in compliance with GDPR Chapter V:

  • Standard Contractual Clauses (SCCs) with third-party processors
  • Data Processing Agreements with all sub-processors
  • Technical and organizational security measures
  • Regular security audits and assessments
  • User rights enforcement mechanisms

Contact & Data Protection

For questions about this record of processing activities or to exercise your GDPR rights: