Privacy Policy
Last updated: 28 October 2026
This policy explains how personal data is processed when you visit our website, request beta access or use the Liza application ("Liza", "we"). It is written to meet the EU General Data Protection Regulation (GDPR) and Hungarian Act CXII of 2011 (Infotv.).
1. Who is responsible
Liza is currently a private, non-incorporated beta project. The data controller is Kristóf Éger, a private individual based in Hungary. Contact for all privacy matters: kristof.eger@lizaos.ai. We have not appointed a Data Protection Officer because we are not required to; Kristóf Éger is the privacy contact.
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name and email in a beta request | Reviewing and answering your request | Steps before a contract / legitimate interest (Art. 6(1)(b), (f)) |
| Account data (name, email, Google profile when you use Google sign-in) | Creating and securing your account | Contract (Art. 6(1)(b)) |
| Content from tools you connect (e.g. email, calendar, files, messages, meeting notes) | Preparing your work, answering your questions and building your private Brain | Contract (Art. 6(1)(b)), only after you connect the tool |
| Chats, files you upload, decisions, notes and team content | Providing the service to you and your team | Contract (Art. 6(1)(b)) |
| Technical logs (IP address, device, error and security logs) | Security, abuse prevention, fixing faults | Legitimate interest (Art. 6(1)(f)) |
| Service emails (e.g. invitations, morning brief if you turn it on) | Delivering features you asked for | Contract (Art. 6(1)(b)) |
Personal sources you connect stay private to you. Nothing from them is shared with your team or company unless you choose to share it. We do not sell personal data, do not use it for advertising, and do not use your content to train AI models.
3. AI processing
Liza uses AI models to summarise, draft and answer. The relevant content is sent to AI providers only to produce the answer you requested, under terms that forbid training on it. AI output can be wrong; Liza asks for your confirmation before sending messages or changing data in your tools. Liza does not make decisions with legal or similarly significant effects about you solely by automated means.
4. Who processes data on our behalf
- Lovable Labs Incorporated (application platform, database and authentication) — United States; your account and workspace content is stored in the EU (Google Cloud, Netherlands; Supabase on AWS eu-west-1, Ireland)
- Cloudflare (page delivery, DNS and network security) — global
- AI model providers such as Google, OpenAI and Anthropic, accessed through Lovable's AI gateway — United States
- Pipedream (secure connections to third-party tools you choose to connect) — United States
- Document and web-research services (e.g. LlamaParse, Firecrawl) when you use those features — United States
- Email delivery provider for service emails
- The tools you connect yourself (e.g. Google, Microsoft, WhatsApp, LinkedIn), under their own policies
Your account content stays in the European Union. Serving you a page, and asking an AI model a question, can involve servers outside the EU. Where data leaves the European Economic Area we rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses. Lovable publishes its current list of sub-processors and their locations at trust.lovable.dev/subprocessors.
5. How long we keep data
- Beta requests: up to 12 months after the decision.
- Account and workspace content: while your account exists; removed within 30 days after deletion, except backups which expire on their normal cycle.
- Disconnecting a tool stops new reads from it; you can ask us to remove what was learned from it.
- Security logs: generally up to 90 days.
6. Your rights
You can ask for access, correction, deletion, restriction, data portability, and object to processing based on legitimate interest. You can withdraw consent at any time. Write to kristof.eger@lizaos.ai; we answer within one month. You may also complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH, 1055 Budapest, Falk Miksa utca 9–11, naih.hu) or go to court.
7. Security
Data is encrypted in transit, access is limited by organisation and person, and credentials for connected tools are held by the connection provider rather than in the browser. No system is perfectly secure; we will notify affected people and the authority of a serious breach as the law requires.
8. Children
Liza is a work tool and is not intended for anyone under 16.
9. Changes
We will update this page when processing changes and tell account holders about significant changes. See also our Cookie Notice.