Privacy Policy

1. Who We Are

LemonSugar Ai is operated by LemonSugar Ai LLC ("LemonSugar Ai", "we", "us"). For the personal data described in this notice, LemonSugar Ai LLC acts as the data controller. You can reach us at hello@lemonsugar.ai. Your use of LemonSugar Ai is also subject to our Terms of Service.

2. Information We Collect

We collect information you provide directly, such as your email address, password, and conversation data. We also collect usage data including model selections, cost metrics, savings calculations, routing preferences, and basic device/IP information for security and abuse prevention. We collect your birth year during signup solely to verify that you meet our minimum age requirement and comply with COPPA; we do not store your full date of birth.

3. How We Use Your Information

We use your information to operate the Service, route prompts to appropriate LLMs, calculate and display savings, manage your subscription and credit balance, send transactional emails, and improve our routing algorithms. We do not sell your personal data to third parties.

4. Legal Basis for Processing

Where GDPR or comparable laws apply, we rely on the following legal bases: performance of a contract (to provide the Service you signed up for and process orders); legitimate interests (to secure the Service, prevent fraud and abuse, and improve our routing quality); legal obligation (tax, accounting, and compliance); and consent where required (e.g. optional marketing emails), which you can withdraw at any time.

5. Data Sharing

We share personal data only with categories of recipients necessary to operate the Service: (a) third-party LLM providers (OpenAI, Anthropic, Google, and open-source model hosts) which receive your prompts as needed to generate responses; (b) infrastructure subprocessors that host and operate the Service; (c) Stripe, our payment processor, which handles card processing, subscription billing, invoicing, and refunds on our behalf — Stripe's processing of payment data is governed by Stripe's own privacy notice at stripe.com/privacy; (d) professional advisers and authorities where required by law.

6. Ai & LLM Data Processing Disclosure

This section explains how LemonSugar Ai processes your data through artificial intelligence and large language model (Ai/LLM) systems.

Ai Providers. We route your prompts to third-party Ai providers including OpenAI, Anthropic, Google, and open-source model hosts. Each provider receives only the data necessary to generate a response and processes it under their own terms and privacy policies.

Prompt Content. When you submit a prompt, the text and any attachments are transmitted to the selected model provider to generate a response. We do not modify, edit, or censor your prompts except as required by law or our content policy.

Classification & Routing. Our system automatically classifies prompts by task type, complexity, and cost profile to select the most suitable model. This classification is performed by automated systems and does not involve human review of your prompt content.

Third-Party Data Handling. Your prompts are processed by the Ai provider's infrastructure, which may be located in the United States or other jurisdictions. We encourage you to review each provider's privacy policy:

• OpenAI Privacy Policy
• Anthropic Privacy Policy
• Google Privacy Policy

Model Training Opt-Out. Where the provider supports it, we request that your prompts not be used to train or improve their models. You can also set a global opt-out preference in your Settings.

Metadata Logging. We log routing metadata — including the model used, token counts, estimated cost, and task classification — to operate and improve our service. We do not include the content of your prompts or responses in these logs.

No Ai Decision-Making About People. We do not use Ai systems to make decisions about individuals (such as hiring, credit, or eligibility determinations).

6a. Data Handling & On-Device Privacy

How we handle your prompts today. When you send a question, it is encrypted in transit to our servers, classified by our routing layer, and then forwarded to the selected model provider. We store the conversation so you can review, resume, and search it. You can disable conversation history or delete individual threads at any time in Settings.

Model-agnostic by design. Our router is built to select the cheapest capable model for each prompt, wherever that model runs. Today that means cloud providers such as OpenAI, Anthropic, Google, and open-source hosts via OpenRouter. As edge and on-device inference matures, the same routing layer can direct suitable questions to local or edge models without changing the experience for you.

On-device privacy over time. We do not currently run models on your device. We are tracking the maturity of local LLMs, browser-based inference, and private-edge hosting so that, when quality and compatibility are sufficient, we can offer stronger privacy options such as processing easy or sensitive prompts locally. Until then, we minimize data sent to providers, request no-training settings where available, and keep encryption and access controls in place.

This section describes our current architecture and planned direction; it is not a technical specification or a guarantee of future features. When on-device options become available, we will update this policy and notify users before any change in how their data is processed.

7. Cookies and Tracking

We use a minimal set of cookies and similar technologies (localStorage, sessionStorage, IndexedDB). The table below lists each category, what we use it for, and how long it persists.

EU/UK/EEA visitors are shown a consent banner on first visit; non-essential cookies are not set until you accept. You can change your preferences any time by clearing your browser storage for this site. California residents can use our Do Not Sell or Share My Personal Information page. We honor Global Privacy Control (GPC) signals as a valid opt-out under CPRA.

7a. Voice Input & Output (Biometric Notice)

LemonSugar Ai offers optional voice features: speech-to-text (STT) for dictating prompts and text-to-speech (TTS) for playback of responses.

• What we collect. When you tap the microphone, short audio clips are captured by your browser and transmitted to our STT sub-processor for transcription. TTS plays synthesized audio generated by our voice sub-processor; no audio recording of you is sent for TTS.
• How long we keep it. Audio is processed transiently. We do not store the audio after transcription completes. The resulting transcript is treated like any other chat message (see §10 Retention).
• Not biometric identification. We do not generate, store, or use voiceprints, voice templates, or any biometric identifier or biometric information to identify or authenticate you. We do not sell, lease, trade, or otherwise profit from voice data. This applies to laws including the Illinois Biometric Information Privacy Act (BIPA), the Texas Capture or Use of Biometric Identifier Act (CUBI), Washington HB 1493, and EU GDPR Art. 9.
• Legal basis (EU/UK). Consent (Art. 6(1)(a)) captured by your in-app tap to enable the microphone, and performance of contract (Art. 6(1)(b)) for delivering voice features you request. You may revoke consent any time by disabling microphone permissions in your browser or device.
• Children. Voice features are not directed at children. Do not enable the microphone for a user under our minimum age (see §13).

7b. Sub-processors

We use the following sub-processors to operate the Service. We maintain a Data Processing Addendum (DPA) with each where required and impose obligations at least as protective as those we owe you.

We may update this list. Material changes will be announced at least 30 days in advance via our sub-processors page and email notice to enterprise customers, who may object under their DPA.

7c. International Data Transfers

We are based in the United States. When personal data is transferred from the EEA, UK, or Switzerland to the US or other third countries, we rely on the European Commission's Standard Contractual Clauses (SCCs, 2021/914), the UK International Data Transfer Addendum (IDTA), and the Swiss FDPIC-recognized addendum, together with supplementary safeguards (encryption in transit and at rest, access controls, vendor due diligence). The EU-US Data Privacy Framework is used where the recipient is certified.

7d. Automated Decision-Making (GDPR Art. 22)

Our model-routing classifier is automated, but it selects which Ai model answers your prompt — it does not produce legal or similarly significant decisions about you. We do not use Ai to make decisions about hiring, credit, insurance, housing, education, or eligibility for any service.

8. Data Security

We implement industry-standard security measures including encryption in transit, secure authentication, and access controls. However, no method of transmission over the Internet is 100% secure.

9. Your Rights

Subject to applicable law (including GDPR for EEA/UK users), you have the right to access, rectify, erase, restrict, port, or object to our processing of your personal data, and to withdraw consent at any time. You can manage and delete your account and conversation history through the Settings page, or contact us at hello@lemonsugar.ai. EEA/UK users also have the right to lodge a complaint with their local supervisory authority.

10. Data Retention

We retain your data for as long as your account is active. When you delete your account or specific conversations, we remove that data from our active systems within a reasonable timeframe. Anonymized usage statistics may be retained for analytics.

11. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes via email or through the Service.

13. Children's Privacy

LemonSugar Ai is intended for users 16 years or older. We do not knowingly collect personal information from children under 13 (COPPA, US) or under 16 (GDPR Art. 8, EU). If you believe a child has provided us personal information, contact hello@lemonsugar.ai and we will delete it.

14. US State Privacy & Ai Disclosures

Residents of California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Utah (UCPA), Texas (TDPSA), Oregon, and other states with comprehensive privacy laws have rights to access, correct, delete, port, and opt out of sale, sharing, targeted advertising, and certain profiling. We do not sell personal information for money and do not engage in cross-context behavioral advertising. To exercise rights, see §9 or use the Do Not Sell or Share page.

Ai-specific notices: Under California AB 2013, our routing layer does not train models; upstream model providers publish their own training-data documentation. Colorado Ai Act (effective Feb 2026) — our routing is not a “high-risk” system because it does not make consequential decisions about individuals. Utah Ai Policy Act — when you interact with our chat in a regulated context, you are interacting with an Ai, as also disclosed in §6 above.

15. EU Ai Act Transparency (Art. 50)

You are interacting with an Ai system. Outputs may be inaccurate or fabricated. Synthesized voice (TTS) is Ai-generated. See our Content & Responsible Ai Policy for safety, agency, and accountability commitments.

16. Data Processing Addendum (DPA)

Business customers (including Relay API customers) who require a Data Processing Addendum can review and accept ours at /dpa. For most chat customers we act as controller; when you use Relay to build a product for your own end users, we act as your processor for the prompts and outputs you send through Relay.

12. Contact

For privacy-related questions, contact LemonSugar Ai LLC at hello@lemonsugar.ai.