Privacy Policy

Version 1 · effective October 24, 2026 · This is a translation. If it differs from the Portuguese version, the Portuguese version prevails.

1. Who we are

Lore (ilore.app) is provided by Leeway Consultoria e Tecnologia Ltda., a Brazilian company, CNPJ 61.738.333/0001-07, located at Rua Pais Leme, 215, suite 1713, Pinheiros, São Paulo/SP, 05424-150, Brazil (“Leeway”, “we”).

This policy explains how we process personal data in Lore under the Brazilian General Data Protection Law (Law 13,709/2018, “LGPD”) and, where applicable, other data protection laws.

Data Protection Officer (DPO): dpo@getleeway.co.

2. Our role for each kind of data

• Your account, usage and billing data: Leeway is the controller.
• Content you put in your brain (the space where Lore keeps your knowledge): you decide what goes in. We process this content to provide the service to you, following your instructions.
• Use through an organization: when you use Lore through a company or other organization that contracted the service, that organization may set rules for access, ownership and retention. In that case, for the content, the organization is the controller and Leeway acts as processor under its contract with the organization.

3. Data we process

Data you give us

• Account: name, email and the identifier of the account you sign in with (for example, your Google account). From Google we receive only your name, email and profile picture, if any.
• Organization: the organization you belong to and your role in it.
• Content: text, notes, emails, documents and other material that you, or an AI assistant you connected, send to Lore. This includes content from sources you choose to connect or import.
• Your own AI keys: if you choose to use your own account with an AI provider, we store the key encrypted.
• Billing: amounts purchased, balance, usage and statements. Card and payment details are collected and stored by the payment processor (Stripe), not by Leeway.

Data we generate

• Derived knowledge: from your content, Lore identifies people, organizations, projects, decisions, facts and the relationships among them, and writes summaries and syntheses. This knowledge may contain personal data about you and about other people mentioned in the content.
• Source and history: where each piece of information came from, when it arrived and what changed, so you can check the source of every answer.
• Access credentials: tokens and AI assistant connections. Tokens are stored only as hashes.
• AI usage and cost: the amount of processing and the cost of each AI model call, without the content.
• Technical data: IP address, request date and time, and error logs, used for security, rate limiting and troubleshooting.

We do not use analytics, tracking or advertising tools.

4. Purposes and legal bases

If a feature depends on your consent, we will ask for it specifically, and you can withdraw it at any time.

5. How AI processes your data

• To extract knowledge, organize it and answer queries, your content is processed by AI models from providers we contract.
• We do not use your content to train AI models, and we contract providers that do not use the data sent to them to train their models either.
• Lore periodically runs a background consolidation: it merges duplicates, updates facts that changed, writes summaries, and lowers the weight of items not mentioned for a long time. This consolidation does not delete your content; to delete, use the options in section 9.
• Content written by other people (for example, a third party's message in an email) is marked as external. Significant changes to your knowledge supported only by such content wait for your approval.
• If you set up your own key with an AI provider, content processed with it is also subject to the terms of that provider, which you contracted directly.
• We do not make automated decisions that produce legal effects on you.

6. Other people's data in your content

Content you send may mention other people, such as colleagues, clients and email contacts. By sending it, you represent that you have a legal basis to do so, such as your legitimate professional interest, and you agree not to send data you are not allowed to process.

Lore keeps knowledge, not copies of the original documents: for each item, it keeps a text representation and what was extracted from it. People who are not Lore users may send requests to our DPO, and we will handle them together with the user responsible for the content where appropriate.

7. Sharing

We do not sell or rent personal data and do not use it for advertising. We share data only with:

• Providers that run the service for us, under contract and only for that purpose: cloud infrastructure and storage; network, protection and content delivery; authentication (such as Google sign-in); AI model providers; and payment processing.
• Services you connect yourself, such as the AI assistants that query Lore or a GitHub repository of yours that holds a copy of your brain. In these cases data goes where you sent it, under those services' terms.
• Your organization, when you use Lore through it, within the limits of its contract. Organization administrators see billing and usage data, not the content of your brain, unless the organization agreed otherwise and told you so.
• Authorities, when required by law or court order.
• Successors, in a merger, acquisition or reorganization, with the protections of this policy kept in place.

The current list of providers is available from the DPO on request.

8. International transfers

Lore data is stored in data centers in the United States, and AI processing may take place in other countries where our providers operate. These transfers follow article 33 of the LGPD, with contractual clauses and safeguards equivalent to those required in Brazil.

9. Retention and deletion

• Content and derived knowledge: kept while your account exists or until you delete them.
• Forgetting an item or a source: removes the item and what was extracted from it from your knowledge. The previous version may remain in your brain's history so you can undo it.
• Forgetting permanently: also erases the item from the history and from activity records. Backups made before that expire within the period below.
• Server logs: up to 7 days.
• Backups: up to 7 days.
• Account closure: we delete your content and account data within 30 days of the request, plus the backup period.
• Billing and tax records: kept for the period required by law, even after closure.

10. Your rights

Under the LGPD (art. 18), you may at any time request:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability: your knowledge is kept in an open format (text and Markdown) and can be exported;
• deletion of data processed based on consent;
• information about whom we share your data with;
• withdrawal of consent, where consent is the legal basis;
• objection to processing based on legitimate interest, where the law is not being followed.

You can do many of these things directly in Lore, such as forgetting items and revoking access. For anything else, write to dpo@getleeway.co. We may ask you to confirm your identity. We reply within 15 days. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD) or with the data protection authority where you live.

11. Security

• All communication is encrypted (TLS). Databases, disks, backups and keys are encrypted with managed keys.
• Each brain's content is isolated; one user cannot access another user's brain.
• Tokens are stored only as hashes, and you can revoke any AI assistant's access.
• Leeway staff access to data is limited to what is needed to run and support the service.

No system is completely immune to failure. If a security incident may pose a relevant risk to you, we will notify you and the ANPD as required by the LGPD.

12. Minors

Lore is intended for people aged 18 or over. We do not knowingly collect data from minors. If we learn that an account belongs to a minor, we will close it.

13. Cookies

We use only essential cookies that keep you signed in. We do not use analytics, tracking or advertising cookies. Blocking these cookies in your browser prevents sign-in.

14. Changes to this policy

We may update this policy. Each version shows its effective date at the top. We will give advance notice of significant changes by email or in Lore.

Questions: dpo@getleeway.co.