Cookie Policy

1. What this Policy covers

1.1 This Policy explains the cookies and similar technologies we use on Lemma, what each is for, and how you control them. It forms part of the Privacy Policy.

1.2 Lemma is operated by SkillSwap Ltd, trading as Lemma, Larnaca, Cyprus (details in the Legal Notice). Questions about this Policy: privacy@getlemma.io.

---

2. The technologies we use

The law here is not about "cookies" as such: it covers any storing of information on your device, or access to information already stored there (ePrivacy Directive 2002/58/EC, Art. 5(3)). Following EDPB Guidelines 2/2023 on the technical scope of Art. 5(3), that includes all of the following, and we treat them identically:

2.1 Cookies — small text files a site stores in your browser and reads back later. 2.2 Local storage and session storage — key-value data held in your browser, used to keep you signed in and remember interface state. 2.3 IndexedDB — a larger in-browser store; our sign-in provider (Google Firebase) uses it to keep you signed in. 2.4 Pixels and tracking URLs — tiny images or link parameters that tell a sender a message was opened or a link followed (see 4.5). 2.5 Scripts and SDKs loaded from our providers, for example the live-video component. Payments take place on Stripe's own checkout page, under Stripe's cookie policy. 2.6 Device fingerprinting — combining device and browser characteristics into an identifier. We do not use device fingerprinting. Security checks such as rate limiting use the IP address of each request on our servers and read nothing from your device.

2.7 Users in the United Kingdom. The same consent rules apply to you under the Privacy and Electronic Communications Regulations 2003, regulation 6, as amended by the Data (Use and Access) Act 2025. We do not rely on the new UK exemption for statistical analytics: PostHog is still set only with your consent.

---

3. The consent rule we apply

3.1 Only strictly necessary technologies are set without your consent. "Strictly necessary" means needed to deliver the service you asked for — signing you in, keeping your Session connected, taking a payment, remembering your cookie choice. It does not mean useful to us.

3.2 Everything else — functional extras, analytics and any marketing technology — is set only after you opt in, by an affirmative act (GDPR Arts. 4(11) and 7).

3.3 Our banner meets these standards:

3.3.1 "Reject all" is presented as prominently as "Accept all" on the first layer — same level, same size, same visual weight, no greyed-out or hidden button. 3.3.2 Nothing non-essential is set before you choose, and closing the banner without choosing is treated as a refusal. 3.3.3 No pre-ticked boxes, no consent bundled with anything else, no "legitimate interest" toggles pre-enabled for purposes that need consent. 3.3.4 No deceptive design: no nagging repetition, no confusing wording, no button that looks like a refusal but is not (EDPB Guidelines 03/2022 on deceptive design patterns; and the prohibition of unfair commercial practices in Directive 2005/29/EC as transposed in Cyprus). 3.3.5 Refusing costs nothing. Lemma works without any non-essential technology, and refusal has no effect on your Sessions, Credits or SCI.

3.4 We ask again only if your stored choice expires (after 6 months) or if we introduce a new purpose. We do not re-ask on every visit to wear you down.

---

4. What we set, by category

The entries below come from our code for https://getlemma.io (the website) and https://app.getlemma.io (the app). We confirm them with a scan of both before each version of this Policy (see 10.1).

4.1 Strictly necessary — no consent required

The live-video connection for a Session runs over WebRTC and sets no cookie of its own.

4.2 Preferences you set — no consent required

These remember how you have set up the interface, and nothing else.

4.3 Analytics — consent required

Nothing in this category is loaded, and no analytics script is requested, until you switch on Analytics in the banner.

Google Tag Manager is loaded only after you allow Analytics or Marketing, and Google Consent Mode v2 is set to "denied" for every purpose before it loads, then updated to your choice.

4.4 Marketing — consent required (website only)

Set only if you switch on Marketing in the banner, and never in the app.

We do not use these technologies for Users under 18 (Privacy Policy, clause 10.3).

4.5 Email

Our emails are sent through Resend. Open tracking and click tracking are switched off for our sending domain, so our emails contain no tracking pixel and their links are not rewritten: we do not know whether you open an email or click a link in it. Every email that is not essential to your account carries a link to your email preferences and to unsubscribe.

---

5. Analytics need consent — legitimate interests is not an option

Analytics are not strictly necessary. Storing or reading an analytics identifier on your device requires consent under ePrivacy Art. 5(3), and that specific rule displaces the general GDPR balancing exercise: we cannot rely on legitimate interests here, however carefully documented. If you refuse, we measure nothing about your visit beyond aggregate server-side counts that read nothing from your device.

---

6. Changing your mind

6.1 Withdrawal is as easy as consent (GDPR Art. 7(3)). Use the Cookie settings link in the footer of every page of the website, or Settings → Account → Cookie settings in the app, to change any category at any time; one choice covers both. Withdrawing takes no more clicks than accepting did.

6.2 When you withdraw consent we stop setting that category immediately and delete or expire the identifiers already set, as far as we technically can. Anything a third party has stored may also need clearing in your browser.

6.3 Withdrawal has no effect on the lawfulness of what happened before it.

---

7. Browser and device controls

7.1 Every major browser lets you block or delete cookies and site data and offers a private-browsing mode. The instructions are in your browser's help pages; we do not reproduce them, because they change.

7.2 Blocking all cookies breaks sign-in and Sessions, which depend on strictly necessary technologies. Blocking third-party cookies alone generally does not.

7.3 Clearing site data also clears your recorded choice, so we will ask again next visit.

---

8. Do Not Track and Global Privacy Control

8.1 Do Not Track (DNT) was never finalised as a standard and has no agreed meaning, so we do not rely on it as a choice. (PostHog on the website does stop capturing when it sees DNT, but your choice in our banner is what governs.)

8.2 Global Privacy Control (GPC) is different: it is a machine-readable signal of a specific choice.

8.3 We honour GPC. If your browser sends a Global Privacy Control signal, we treat it as a refusal of all technologies that need consent, and we do not show you the banner for them.

---

9. Third parties and international transfers

9.1 Where a third party sets something through Lemma it is named in section 4 and in the Sub-processor List, and processes data under an Art. 28 contract or, where it acts for its own purposes, its own privacy notice.

9.2 Some providers process data outside the EEA. The safeguards — adequacy where the recipient is certified under the EU–US Data Privacy Framework, with the 2021 Standard Contractual Clauses layered as a fallback — are in section 7 of the Privacy Policy.

---

10. Changes and contact

10.1 We update this Policy whenever we add, remove or change a technology, and after each cookie scan. The version and effective date are at the top.

10.2 Questions or requests: privacy@getlemma.io. You can also complain to the Office of the Commissioner for Personal Data Protection — details in section 9 of the Privacy Policy.