LetEmily Privacy Policy

1. Information We Collect

When you use LetEmily, we collect:

• Account Information: name, email, login credentials.
• Manager Notes & Insights: content you enter, upload, or generate in LetEmily, including AI-generated insights and recommendations (such as Emily, the Morning Report, and the Weekly Reflection).
• Calendar & Meeting Data: if you connect a calendar (e.g. Microsoft 365), the meeting and 1:1 events LetEmily imports on your behalf.
• Connected Workspace Content: if you connect Slack, the notes and follow-ups you capture from Slack and the reminders/notifications we deliver there.
• Uploaded Content: images, documents, or files that you choose to upload.
• Billing Information: handled securely by Stripe (we do not store credit card details).
• Usage Data: basic analytics on how the service is used (to improve performance and reliability).

2. How We Use Your Information & Legal Basis (GDPR Article 6)

We process your personal data based on the following legal grounds:

3. Data Storage, Security & Retention

Data Location & International Transfers

All data is stored on servers located in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or other regions with data transfer restrictions, your data will be transferred to and processed in the United States. We rely on standard contractual clauses and adequacy decisions where applicable to ensure your data receives adequate protection.

Security Measures

We implement multiple layers of security to protect your data in accordance with GDPR Article 32 (Security of Processing):

• Transport Layer Encryption: All data transmission uses TLS 1.3 with 256-bit encryption
• Password Protection: Passwords are hashed using bcrypt with cost factor 12 (irreversible, OWASP-compliant)
• API Token Encryption: OAuth tokens and API credentials are encrypted using libsodium XSalsa20-Poly1305 authenticated encryption with 256-bit keys before database storage
• Database Security: Binary data (avatars, screenshots) stored in encrypted database with access controls
• Key Management: Encryption keys are stored securely in environment variables, never in code or version control
• Regular Audits: Security reviews, vulnerability assessments, and encryption validation
• Access Controls: Role-based permissions and authentication required for all sensitive operations
• Audit Logging: Comprehensive logging of data access, exports, and deletions for accountability

Data Retention Periods

• Active Accounts: Data retained while account is active
• Account Deletion: Immediate hard delete with 30-day anonymized audit trail
• Cancelled or Expired Subscriptions: Your account continues on the Free plan and your data is retained: your people, notes, meetings and commitments are not deleted. Deletion happens only when you delete your account
• Login Attempts: 90 days
• AI Conversation Cache: 30 days
• Deleted Conversations: 60 days before permanent removal
• Encrypted Backups: 90 days maximum
• Cookie Consents: 13 months from last consent

4. Data Processors & Third-Party Services

We do not sell your personal information. We work with the following GDPR-compliant data processors:

We may also share data when:

• Required by law, court order, or legal process
• To protect our rights, property, or safety
• In connection with a business transaction (merger, acquisition)

5. Uploaded Content Policy

• You are responsible for any content you upload.
• Content must not violate laws, infringe on others' rights, or contain harmful or abusive material.
• Uploaded documents and images may be processed by AI to provide insights within LetEmily.

6. Age Restrictions

LetEmily is not intended for use by anyone under 18 years old. We do not knowingly collect information from minors.

7. Your Rights Under GDPR

Under GDPR Articles 15-21, you have comprehensive data protection rights:

How to Exercise Your Rights:

• Most rights available directly in Settings > Privacy & Data
• Email privacy@letemily.com for complex requests or questions
• We respond within 30 days per GDPR Article 12
• If unsatisfied with our response, you may lodge a complaint with your data protection authority

8. Ask Emily: AI-powered leadership support

Data Collection

When you use Ask Emily, we collect:

• Chat Conversation Content: Your messages, questions, and AI-generated responses.
• Conversation Metadata: Timestamps, conversation titles, and usage patterns.
• User Preferences: Your interaction patterns and feature engagement data.
• Team Context: Information about team members when explicitly referenced in conversations.
• Usage Analytics: Feature engagement and conversation frequency for service improvement.

Data Retention

• Active Conversations: Stored until user account termination or manual deletion.
• Deleted Conversations: Retained for 60 days before permanent deletion.
• Analytics Data: Aggregated and anonymized after 90 days for service improvement.

Data Usage

We use Ask Emily data for:

• Providing leadership guidance drawn from your own team context.
• Service improvement and feature development based on usage patterns.
• User experience personalization and conversation continuity.
• Security monitoring and abuse prevention.
• Customer support and troubleshooting when requested.

Emily & AI-Generated Insights

Beyond Ask Emily, LetEmily generates insights and recommendations from the notes, meetings, commitments, and team context you record. These power features such as Emily (your recommended next conversations), the Morning Report, the Weekly Reflection, and team insight reports.

• Many insights (including Emily recommendations, the weekly reflection and the Worth Noticing signals) are computed deterministically from your own data, without any external AI call.
• Where AI narration is used (for example, the Morning Report summary), requests run through OpenAI's API and are not retained for model training.
• Insights are visible only to you and are derived solely from your own workspace: they are never shared with other managers or used to build cross-customer profiles.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you before they take effect.