Privacy Policy

1. Who we are, and how to contact us

1.1 The controller

Lemma is operated by SkillSwap Ltd, trading as Lemma (a business name registered under the Registration of Business Names Law, Cap. 116), a private company limited by shares incorporated in the Republic of Cyprus, registration number HE 475899, registered office Dodekanisou 18, Office 201, 7060 Larnaca, Cyprus. The Company is the controller of the personal data described in this Policy (GDPR Art. 4(7)), unless this Policy says otherwise for a specific activity.

1.2 What this Policy is

This is the information notice required by Articles 13 and 14 of the GDPR (Reg. (EU) 2016/679), read with Cyprus Law 125(I)/2018. It tells you what personal data we process, why, on what lawful basis, who receives it, how long we keep it and what you can do about it.

1.3 How to contact us about privacy

Write to privacy@getlemma.io, or by post to SkillSwap Ltd, trading as Lemma, Dodekanisou 18, Office 201, 7060 Larnaca, Cyprus. Just say what you want — you need not cite an article of the GDPR.

1.4 Privacy lead

We have not appointed a data protection officer under GDPR Art. 37. Data protection matters are handled by our privacy lead, reachable at privacy@getlemma.io.

1.5 Where we get your data

Most comes from you: what you enter when you register, build a profile, book or run a Session, take an assessment, or contact us. Some is generated by your use of the Platform — Evidence Events, device and log data. Some comes from third parties, and this is your Art. 14 notice for it:

1.5.1 Google / Firebase Authentication — where you sign in with Google, we receive your name, email address and account identifier. 1.5.2 Other Users — confirmations of your skills, ratings, reviews, reports and messages that name you. 1.5.3 API Clients — where an organisation invites you to take an assessment, it supplies your name and email address. For that activity only, the API Client is the controller and we act as its processor under GDPR Art. 28; we contact you on its instructions and tell you who asked. 1.5.4 Stripe — payment status and fraud signals. 1.5.5 Accounts you connect — if you connect GitHub, Figma or Vercel, we receive your account identifier and the names and ownership details of the repositories, files or projects you choose; if you connect Google Calendar, we receive the times you are busy; if you connect Telegram, we receive the chat identifier we use to send you notifications.

---

2. What we do with your personal data

This table is the core of this Policy. "Art. 6(1)(b)" means processing necessary to perform our contract with you; "6(1)(c)" a legal obligation; "6(1)(f)" our legitimate interests; "6(1)(a)" your consent.

2.22 Special categories of data

We do not ask for special category data (Art. 9) and never use it as an SCI input. A Session is a live conversation; please do not disclose sensitive information you do not want shared with the other participant. We do not record Sessions.

2.23 If you do not provide data

Where data is needed to perform the contract — an email address, for example — we cannot run your account without it. Everything else is optional and refusing it costs you nothing.

---

3. Automated decision-making and the Skill Credibility Index

3.1 The SCI is computed automatically

The Skill Credibility Index is a per-skill score from 0 to 100, produced wholly automatically from your own Evidence Events. No human writes it or reviews it before it is shown. Part of it (Freshness) falls with inactivity.

3.2 We treat the SCI as an Article 22 decision

Where an SCI is disclosed to an API Client and that organisation draws strongly on it in deciding about you — whether to interview you, hire you, or admit you to a programme — we treat the score itself as the automated decision within GDPR Art. 22(1). This follows the Court of Justice in C-634/21 SCHUFA (7 December 2023). We do not argue that the score is "only an input" in order to avoid Art. 22.

3.3 Disclosure requires separate explicit consent

3.3.1 No SCI is disclosed to any API Client unless you have given separate, explicit, opt-in consent (Arts. 6(1)(a) and 22(2)(c)). 3.3.2 That consent is granular per audience: you consent to one named organisation, and it lasts until you withdraw it. You give it with a separate, unticked box (for example on an assessment invitation from that organisation) and confirm at the same time that you are 18 or older. 3.3.3 It is never bundled into the Terms of Service, never pre-ticked, and never a condition of using Lemma. Accepting the Terms permits no disclosure at all. 3.3.4 You can withdraw it at any time in Settings → Account → Employer access, with one click (Art. 7(3)). Withdrawal stops future disclosures at once; it cannot undo a disclosure already made. The same page lists every lookup each organisation has made, with its date.

3.4 Your safeguards

Whenever an SCI is used in this way you have the right to obtain human intervention on our part, to express your point of view and to contest the outcome (Art. 22(3)). You exercise these through the SCI Review & Appeal process in the SCI Methodology & Rights Notice, which states our response deadline. A person with authority to change the result handles the review; we never answer an appeal with the algorithm that produced the score.

3.5 Meaningful information about the logic

The SCI Methodology & Rights Notice discharges Arts. 13(2)(f) and 15(1)(h). It explains the inputs, the points each can add, the Freshness rules, and gives a counterfactual-style explanation — what would have to change for your score to be different — in line with C-203/22 Dun & Bradstreet (27 February 2025). Commercial confidentiality is not a blanket shield: where fuller disclosure of the logic is required, we will provide it to the Commissioner or to a court under appropriate confidentiality protection.

3.6 What the SCI never uses

The SCI is never fed by off-platform social behaviour, by special category data, or by anything unrelated to the skill it scores, and is never reused for an unrelated purpose. It is also one of the factors used to rank Session-partner suggestions (row 2.3). These are binding commitments.

3.7 Users under 18

Users under 18 are excluded from the Verification API entirely. No under-18 User's SCI is disclosed to an API Client and no under-18 User can be the subject of a Verification, whether or not they or a parent would consent.

3.8 Other automated processing

We use automated signals in fraud, security and moderation. None produces a legal or similarly significant effect without human review: any restriction affecting a Practitioner's ability to teach is reviewed by a person, and human review of any moderation decision is available on request.

---

4. No recording of Sessions

We do not record Sessions, and the Platform offers no recording feature. If we ever introduce one, it will require the opt-in consent of every participant before recording starts, and we will update this Policy first.

---

5. AI processing

5.1 The features

5.1.1 The AI Tutor runs on models provided by OpenAI, with Anthropic as a fallback. It keeps a short AI-generated memory of your progress. It is an AI system and is labelled as such at or before your first interaction with it (AI Act Reg. (EU) 2024/1689, Art. 50(1)). 5.1.2 Assessment questions are generated for each attempt, and some answers are scored, with models provided by OpenAI (with Anthropic as a fallback). Monthly report cards summarising your progress are written with models provided by Anthropic. 5.1.3 The assistant on our website runs on models provided by OpenAI, reached through Vercel's AI Gateway, and is labelled as AI. 5.1.4 AI-generated content is labelled as such where it appears. Detail: AI Transparency Notice.

5.2 What our AI providers may do with your data

Anthropic and OpenAI act as our processors under Art. 28 contracts, on our instructions and for no purpose of their own. Under their API terms they do not use our data to train their models, and they may keep it for a limited period for abuse monitoring.

5.3 No training on your content

We do not train AI models on your content, and our AI providers do not either (5.2). If we ever want to, we will update this Policy first and, where required, ask for your consent.

---

6. Recipients and sub-processors

6.1 The list

The current sub-processors, with the service each provides, the data involved and the country of processing, are published in the Sub-processor List. We give notice of a new sub-processor before it starts processing.

6.2 Categories of recipient

6.2.1 API Clients — organisations that receive an SCI through the Verification API. They are independent controllers, not our processors: they decide what to do with what they receive, they answer to you for it under their own privacy notice, and the instrument between us is a Data Sharing Agreement, not an Art. 28 processing agreement. The one exception is employer-initiated assessment invites, where the API Client is the controller and we are its processor (clause 1.5.3). 6.2.2 Infrastructure and service providers — Vercel and Railway (hosting, including Vercel's AI Gateway for the website assistant), Neon (database), Cloudflare R2 (file storage), LiveKit (live audio and video), Google Firebase (authentication and real-time chat), Resend (email), Sentry (error monitoring), PostHog (analytics, with your consent), Google (Tag Manager, Analytics 4 and Ads conversion measurement on the website, with your consent), Anthropic and OpenAI (AI features), Sanity (website content). All act as our processors under Art. 28. 6.2.2A Services you connect — GitHub, Figma, Vercel, Google Calendar and Telegram receive data from us only when you connect them, and act under their own terms as independent controllers. 6.2.3 Payment providers — Stripe, which acts as an independent controller for its own regulatory and fraud-prevention purposes and as our processor for the rest. 6.2.4 Professional advisers — lawyers, accountants and auditors, bound by professional confidentiality. 6.2.5 Authorities and courts — where a valid legal obligation applies, including tax authorities and the competent authorities under DSA Art. 18. We check that a request is lawful and proportionate before answering it, and tell you unless legally prohibited. 6.2.6 A buyer of the business — in a merger or restructuring, with the same protections continuing.

6.3 We do not sell your data

We do not sell personal data and do not share it with data brokers. The only data that reaches an advertising network is the optional Google Ads conversion measurement on our website (row 2.19A), and only if you switch on Marketing in the cookie banner.

---

7. International transfers

7.1 Where data goes

Our database (Neon, Frankfurt), API and background jobs (Railway, Amsterdam), application functions (Vercel, Frankfurt), email sending (Resend, Ireland), error monitoring (Sentry, Germany) and analytics (PostHog, EU) run in the EU. Some providers in the Sub-processor List process data in the United States or other third countries, or are US companies that may access EU-hosted data, including our AI providers, payments, authentication and real-time chat, email, and Google's website analytics and advertising measurement.

7.2 How we make those transfers lawful

7.2.1 Where the recipient is certified under the EU–US Data Privacy Framework, we rely on the European Commission's adequacy decision of 10 July 2023 (GDPR Art. 45). 7.2.2 In every such case we also put the 2021 Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in place as a contractual fallback, so the transfer does not depend on adequacy surviving (Art. 46(2)(c)). 7.2.3 For recipients outside the Framework, the SCCs are the primary mechanism, with supplementary technical and organisational measures where a Transfer Impact Assessment shows they are needed.

7.3 Why the fallback matters

The General Court upheld the Data Privacy Framework in T-553/23 Latombe on 3 September 2025. That judgment is under appeal to the Court of Justice, lodged on 31 October 2025 and still pending. We maintain SCCs precisely against that contingency: if the adequacy decision were annulled, transfers would continue on the contractual mechanism without interruption.

7.4 Getting a copy

Ask at privacy@getlemma.io for a copy of the relevant safeguards (Art. 46(1)). We may redact commercial terms.

---

8. How long we keep your data

8.1 The principle

We keep personal data only as long as the purpose needs, then delete or anonymise it. The retention column in section 2 is the summary; the operational detail, system by system, is in the Data Retention Schedule.

8.2 Statutory retention

8.3 Deleted does not always mean instantly gone

What you delete leaves the live service immediately and the backups as they rotate. Where a record must be kept — an accounting entry, an open dispute, a legal hold — we keep only that record, for that purpose only.

---

9. Your rights

9.1 What you can ask for

9.1.1 Access — a copy of your personal data and the information in this Policy (Art. 15). 9.1.2 Rectification — correction of inaccurate data and completion of incomplete data (Art. 16). 9.1.3 Erasure — deletion, where a ground in Art. 17 applies. An Evidence Event a counterparty relies on, and records we must keep by law, may survive account closure. 9.1.4 Restriction — pause processing while a dispute about accuracy or lawfulness is resolved (Art. 18). 9.1.5 Portability — your data in a structured, commonly used, machine-readable format, or sent directly to another controller where feasible (Art. 20). You can request a download of your data in Settings → Account at any time. 9.1.6 Objection — object to processing based on legitimate interests, including profiling, on grounds relating to your situation (Art. 21(1)); and object to direct marketing at any time, absolutely (Art. 21(2)). 9.1.7 Withdraw consent — at any time, as easily as you gave it, without affecting the lawfulness of what happened before (Art. 7(3)). 9.1.8 Not be subject to an automated decision — including the rights in section 3 (Art. 22).

9.2 How to exercise them

Use the tools in your account settings, or write to privacy@getlemma.io. We may ask for information to confirm it is really you — only what is proportionate, and used for nothing else.

9.3 How fast we respond

Within one month of your request. Where it is complex, or you have made several, we may extend by up to two further months and will tell you within the first month, with reasons (Art. 12(3)).

9.4 Cost

Free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive, particularly because it is repetitive — and we must show that it is (Art. 12(5)).

9.5 Complaining to the supervisory authority

You can complain to the Office of the Commissioner for Personal Data Protection (Γραφείο Επιτρόπου Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), the Cyprus supervisory authority:

• Address: 15 Kypranoros Street, 1061 Nicosia (P.O. Box 23378, 1682 Nicosia)
• Telephone: +357 22 818 456
• Email: commissioner@dataprotection.gov.cy
• Website: www.dataprotection.gov.cy

You may also complain to the supervisory authority where you live or work (in the UK, the ICO: section 12A), or go to court (Arts. 77–79). We would rather you told us first at privacy@getlemma.io — but you do not have to.

---

10. Children and young people

10.1 Minimum age 16

You must be at least 16 to use Lemma. This is our own floor, and it is more conservative than Cyprus law requires: the age of consent for information society services under GDPR Art. 8(1) is set at 14 in Cyprus (Law 125(I)/2018, s. 8). We chose 16 because Sessions are live, one-to-one and unsupervised.

10.2 Age assurance

You confirm that you are at least 16 when you sign up, and we store that confirmation. We do not demand an identity document from every User. Where there is a specific reason to doubt someone's age, or a feature carries higher risk, we may ask for a further proportionate check, in line with EDPB Statement 1/2025. Data collected for an age check is used only for that check.

10.3 No profiling of minors for advertising

We do not carry out behavioural profiling of Users under 18 for advertising, and we do not serve them targeted advertising.

10.4 Under-18s and the Verification API

Users under 18 are excluded from the Verification API entirely (clause 3.7).

10.5 If a child has got through

Tell us at privacy@getlemma.io. We will check and, if the account belongs to someone under 16, close it and delete the data promptly.

---

11. How we protect your data

We take the measures required by GDPR Art. 32, appropriate to the risk:

11.1 Encryption in transit — TLS across the Platform and to every sub-processor; SRTP for live Session media on LiveKit. 11.2 Encryption at rest — for the database, for object storage and for backups. Calendar access tokens are additionally encrypted with AES-256-GCM, and API keys are stored only as hashes. 11.3 Access control and least privilege — role-based access, individual named accounts and no shared credentials. The internal administration console has its own accounts with hashed session tokens, and its actions are recorded in an audit log. Access to messages and Session data is limited to a defined investigative need. 11.4 Logging and monitoring — administrative actions and API access are logged, and errors are monitored. 11.5 Append-only ledgers — Evidence Events and the Learning Credits ledger are append-only. A correction is a new entry, never a silent edit, so the record cannot be quietly rewritten. 11.6 Segregation and minimisation — production data is not used in development or testing; we collect what a purpose needs and no more. 11.7 Sub-processor diligence — Art. 28 contracts, security review before onboarding, and the transfer safeguards in section 7. 11.8 Backups and recovery — encrypted point-in-time history of the database for the last 6 hours, from which it can be restored. 11.9 Breach procedure — an incident response process. Where a personal data breach is likely to result in a risk to your rights and freedoms, we notify the Office of the Commissioner within 72 hours of becoming aware of it (Art. 33), and where the risk is high we tell affected Users without undue delay (Art. 34). We keep an internal register of all breaches, including those we need not report. 11.10 Report a vulnerability to security@getlemma.io. We will not pursue good-faith research that respects User privacy and does not degrade the service.

No system is perfectly secure. What we commit to is doing the above, and telling you honestly when something goes wrong.

---

12. Cookies and similar technologies

We use cookies and similar technologies, and ask for your consent before setting anything that is not strictly necessary. On our website, analytics (PostHog, Google Analytics) and advertising measurement (Google Ads) load only after you choose them. "Reject all" is as prominent as "Accept all" on the first layer of our banner, and analytics require your opt-in. The full detail — every category, what it does, who sets it, how long it lasts and how to change your mind — is in the Cookie Policy.

---

12A. If you are in the United Kingdom

12A.1 UK GDPR. If you are in the UK, we also process your personal data under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. The lawful bases, purposes, retention and rights in this Policy are the same.

12A.2 Contact. We are not established in the UK. You can contact us about any data protection matter at privacy@getlemma.io.

12A.3 Complaints. You may complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), as well as to the Cyprus Commissioner.

12A.4 Transfers. The UK recognises the EEA as adequate, so data held by us in the EU is protected. Where UK personal data goes to a third country without UK adequacy, we use the UK Extension to the EU–US Data Privacy Framework for certified US recipients, or the UK International Data Transfer Addendum to the 2021 Standard Contractual Clauses, with a transfer risk assessment.

12B. If you are in the United States

12B.1 Lemma is a Cyprus company and this Policy, governed by the GDPR, applies to you.

12B.2 US state privacy laws. We do not currently meet the thresholds of the California Consumer Privacy Act (for example, annual gross revenue above US$26,625,000, or the personal information of 100,000 or more California consumers or households) or of other comprehensive US state privacy laws. We nevertheless give every User the rights in section 9, wherever they live. We do not sell personal information. The only advertising-related processing is the optional Google Ads conversion measurement on our website (row 2.19A), which runs only if you switch on Marketing in the cookie banner.

12B.3 Children. Lemma is not directed at children under 13, and you must be at least 16 to use it (section 10). We do not knowingly collect personal information from children under 13 (Children's Online Privacy Protection Act). If we learn that we have, we delete it.

12B.4 Email. Our marketing emails identify us, include our postal address and a working unsubscribe link, and we act on unsubscribe requests within 10 business days (CAN-SPAM Act).

13. Changes to this Policy

13.1 We update this Policy when our processing changes, when the law changes, or when we can explain something better.

13.2 For a material change we give at least 30 days' notice by email and in the Platform before it takes effect, explaining what is changing and why. Where a change would need your consent, we ask for it — we never treat continued use as consent.

13.3 The version number and effective date are at the top. We keep an archive of previous versions and will supply one on request.

13.4 This Policy is drafted in English and the English version governs. If we provide a translation, it is for convenience only.