Privacy policy

Draft — not yet reviewed. Last updated 14 October 2026.

Who is responsible

The controller of your personal data in lexmem is [legal name], a sole trader (autónomo) registered in Spain, NIF [number], [postal address]. For anything in this policy, write to privacy@lexmem.tech. Each app you connect is a separate controller of what it keeps itself, under its own privacy policy.

What is stored

Your account, in the sign-in database: your email address, your name, your password (hashed), your sign-in sessions with the browser and IP address each came from, and the apps you connected and the access you gave them.

Your record, in a separate database linked to your account only by an opaque id: the languages you enrolled in, your four learning thresholds, the words and grammar points apps recorded for you with their state and counters, any words you asked to be remembered with the gloss you gave, and the history of events that produced them — each event with the app that recorded it. No text from your conversations is stored.

Why, and on what basis

To provide the service you signed up for (Article 6(1)(b) GDPR): to sign you in, keep your record, and share it with the apps you connect. Session IP addresses and browsers are kept to protect your account (Article 6(1)(f), our legitimate interest in its security). Email is used for account messages only. There is no advertising and no profiling, and nothing is sold.

Where it lives

The service runs on Google Cloud in the EU (europe-west1, Belgium); both databases are hosted by Neon on AWS in the EU (eu-central-1, Frankfurt). Resend sends the confirmation and password-reset emails and so receives your email address; where it is processed outside the EU, the transfer relies on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

How long it is kept

Until your account is deleted. After deletion, data may remain in the database provider's restore history for up to 30 days.

Export and delete

Every app connected to lexmem can offer you a complete export of your record as one JSON document, and the deletion of your account, which removes your record and then your sign-in account. You can also ask for access, export, correction, deletion, restriction or object by writing to privacy@lexmem.tech from the address on your account. You can complain to the Agencia Española de Protección de Datos (AEPD) or the authority where you live.

Cookies

One cookie: the sign-in session, needed to sign in and authorize apps. No analytics, no tracking.

Changes

If this policy changes in a way that matters, we will email you before the change takes effect.