Privacy policy

Your sessions

Recordings, transcripts, summaries, insights and chat history are stored on your phone, not on our servers.

Processing

When you ask Lota to process a recording, it's handled on servers in the EU and deleted as soon as your phone has the result.

Never

We don't sell your data, use it for advertising, track you across apps or websites, or let anyone train AI on it.

No tracking

No analytics, advertising or tracking tools in the app or on this website.

On our servers

Only what we need to run Lota: your account, plan, usage allowance and notification settings.

Age

Lota is for adults aged 18 and over.

Lota is run by Aku Online Ltd., a company registered in England and Wales. We're the “controller” of the personal data described here, which means we decide how and why it's used and we're responsible for protecting it under UK and EU data protection law.

You can reach us about anything in this policy at support@lotamind.com.

Lota is built so that the content of your sessions stays with you.

• Recording. When you record a session or a reflection, or import an audio file, it's saved on your phone.
• Your consent comes first. Before Lota processes anything, the app explains what happens to your recording and asks for your explicit agreement. Nothing is uploaded until you've said yes.
• Processing in the EU. When you ask Lota to process a recording, the audio is sent over an encrypted connection to our processing service in Frankfurt, Germany. AssemblyAI turns it into text with speaker labels at its EU site in Dublin, Ireland, and Mistral AI writes the summary, themes and goals, also in the EU.
• Deleted after use. The audio is deleted from our storage as soon as it's been transcribed. The results are encrypted so only your phone can read them, and deleted from our servers as soon as your phone collects them.
• Chat. When you ask Lota a question about your sessions, your message and the parts of your notes needed to answer it are sent to the AI provider through our service. The reply comes back to your phone. We don't keep your chat history on our servers; it stays on your phone.
• Sharing is up to you. If you share a summary, a goal or a transcript, it goes wherever you send it, using your phone's share options. What happens to it then is up to you and the people you share it with.

If your phone backs up apps to iCloud or Google, Lota's data may be included in those backups, protected by Apple's or Google's security. You control this in your phone's settings.

We use a small number of service providers, under contracts that only let them use your data to provide their service to us. None of them may use it to train AI or for advertising.

Processing and hosting

Vercel, running our processing service in Frankfurt, Germany, and hosting this website.

Accounts and temporary storage

Supabase, in Frankfurt, Germany: your account, plan, usage and job status, and recordings while they're being processed.

Transcription

AssemblyAI, at its EU site in Dublin, Ireland. We tell it to delete the audio and transcript as soon as we have the result.

AI summaries and chat

Mistral AI, a French company, in the EU. It runs with zero data retention for Lota, so it keeps nothing after responding, and it doesn't train on your content.

Sign-in

Apple and Google, if you sign in with them.

Subscriptions

Apple and Google take payment; RevenueCat tells us your subscription status. We never see your card details.

Notifications

Expo's push service passes notifications to Apple and Google, who deliver them to your phone.

Email

Brevo, based in the EU, holds the waitlist.

You can ask us at any time for the current list of providers. If we change a provider that handles the content of your sessions, we'll update this list first.

We may also share information if the law requires it, or if it's needed to protect someone's safety, our users or Lota from fraud or abuse. We would never be able to share the content of your sessions, because we don't hold it.

UK and EU law require a legal reason for each use of your data. Ours are:

• Your explicit consent, for processing your recordings and chat. Therapy content can reveal information about your health, so we only process it after you've agreed in the app. You can withdraw consent at any time by not processing further recordings and deleting your data.
• Our contract with you, to run your account, apply your plan and allowance, and send the notifications you've asked for.
• Your consent, for the waitlist. You can unsubscribe at any time.
• Our legitimate interests, in keeping Lota and this website secure, preventing abuse, and answering your messages.
• Legal obligations, such as keeping records the law requires.

• Recordings: deleted from our storage as soon as they've been transcribed.
• Processing results: deleted as soon as your phone collects them. If your phone never does, they're deleted automatically within 7 days.
• Chat messages: not stored on our servers.
• Your account, plan and usage: kept while you have an account, and deleted when you delete it.
• The waitlist: kept until you unsubscribe, or until we no longer need it to tell you about Lota's launch.
• Emails to us: kept as long as needed to help you, then deleted.
• Technical logs: kept by our hosting providers for a short time for security, and never include the content of your sessions.

Data on your phone stays until you delete it.

• Delete a session from inside the app at any time.
• Delete everything in Settings: this erases Lota's data on your phone and closes your account, deleting what we hold about you.
• Export your sessions to keep your own copy.
• App lock with Face ID, Touch ID or your passcode.
• Notifications and permissions can be turned off in your phone's settings.
• Leave the waitlist using the unsubscribe link in any email, or by emailing us.

Subscriptions are managed in your App Store or Google Play account. Deleting the app doesn't cancel a subscription.

Under UK and EU data protection law, you have the right to:

• access the personal data we hold about you and get a copy of it;
• have it corrected if it's wrong;
• have it deleted;
• restrict or object to how we use it;
• receive it in a portable format;
• withdraw your consent at any time, without affecting what we did before.

To use any of these rights, email support@lotamind.com. We'll reply within one month, and we may ask you to confirm your identity first. Remember that the content of your sessions is on your phone, so you can export or delete it yourself at any time.

You can also complain to a data protection authority: in the UK, the Information Commissioner's Office; in the EU, the authority in the country where you live. We'd appreciate the chance to put things right first.

If you live elsewhere, including the United States or Canada, you may have similar rights under local law. Contact us and we'll help.

Your recordings, chat and account data are processed in the EU: our service and storage in Frankfurt, Germany, transcription at AssemblyAI's EU site in Dublin, Ireland, and summaries and chat with Mistral AI in the EU. As a UK company, we also handle some personal data, such as support emails, in the UK. The UK and the EU recognise each other's data protection standards.

Some of these providers, including Vercel, Supabase and AssemblyAI, are based in the United States and run Lota on their EU data centres. Like most technology companies, our providers also rely on their own sub-processors, some of which may be outside the UK and EU, for example for technical support or security. Where personal data could be accessed from outside the UK and EU, it's protected by recognised safeguards, such as adequacy decisions and standard contractual clauses.

A few providers, such as Apple and Google for sign-in and payments, and Expo and RevenueCat for notifications and subscriptions, may process limited data outside the UK and EU. None of it is the content of your sessions, and the same safeguards apply.

Recordings and results are encrypted in transit and at rest, results are encrypted so only your phone can read them, and storage on our side is private and access-controlled. We keep as little as possible on our servers, for as short a time as possible.

Because your sessions live on your phone, its security matters too: use a passcode, keep it up to date, and consider turning on Lota's app lock. No system is perfectly secure, but we've designed Lota so that there's very little to take from our side.

Lota is for adults aged 18 and over and isn't directed at children. If you think a child has given us personal data, contact us and we'll delete it.

If we change this policy, we'll update the date at the top. If the change is significant, for example a new use of your data, we'll tell you in the app or by email before it takes effect.

See also our terms of use, how Lota's AI works, and the plain-language overview of how Lota protects your privacy.

Questions, requests or concerns about your privacy: