Privacy Policy

1. Introduction

Lemon Supercomputer (“Lemon Supercomputer,” the “Service,” or the “App”) is provided and operated by Hey Lemon Computing, Inc., a Delaware corporation (“Hey Lemon Computing,” “we,” “our,” or “us”).

This Privacy Policy describes how we collect, use, disclose, store, and protect information about individuals who use Lemon Supercomputer.

For the purposes of this Privacy Policy, “you” and “your” means you as the user of the Service.

Please read this Privacy Policy carefully. By using the Service, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree, please do not use or access the Service.

2. Changes to This Privacy Policy

We may modify this Privacy Policy from time to time, in which case we will update the “Effective Date” at the top of this page. If we make material changes to the way in which we use or disclose information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us or by posting notice within the application) and will take additional steps as required by applicable law. If you do not agree to any updates to this Privacy Policy, please do not continue using the Service.

3. Collection and Use of Your Information

When you use the Service, we collect certain categories of information about you from a variety of sources.

Information You Provide to Us

Some features of the Service require you to directly provide us with certain information. You may elect not to provide this information, but doing so may prevent you from using or accessing these features.

Account information, such as your email address and password (“Account Information”). We use this information where necessary to perform our contract with you to provide the Service and to maintain and secure your account. If you believe your account has been compromised, please contact us immediately.

Payment information, such as credit or debit card information and billing address, which we collect using a third-party payment processor, Stripe (“Payment Information”). We use this information where necessary to perform our contract with you to process payments and provide the Service. We do not store your full card details, those are held by Stripe.

Conversation content, including the messages you send to the agent and the responses generated by the agent, as well as session titles and organizational metadata (“Conversation Data”). We use this information where necessary to perform our contract with you to provide and personalize the Service, to persist your conversation history across sessions and devices, and to enable the agent to carry context across interactions.

Agent memory, meaning facts that the agent saves about you during the course of using the Service, such as your preferences, routines, or working context, in order to give you more relevant responses over time (“Memory Data”). We use this information where necessary to perform our contract with you. You may view, edit, or delete any saved memory at any time within the application.

Integration credentials, such as OAuth tokens for third-party services you choose to connect to the agent (for example, Gmail, Google Calendar, Slack, or others) (“Integration Credentials”). We use this information where necessary to perform our contract with you to execute actions on your behalf through those services. Integration Credentials are encrypted at rest using AES-256-GCM encryption before being stored in our database.

Notwithstanding anything else in this Privacy Policy, we only use and disclose Integration Credentials to provide the Service or as otherwise required by applicable law. If you connect a Google account to the Service, we only use and disclose information from your Google account in accordance with the Google API Services User Data Policy, including the Limited Use requirements.

Configuration and preference data, including your enabled and hidden skills, workspace settings, scheduled tasks, channel connection settings, and model preferences (“Configuration Data”). We use this information where necessary to perform our contract with you to sync your setup and personalize your experience.

Information Collected Automatically

Usage metadata. When you use the Service and the agent makes AI requests, we automatically collect metadata for billing, monitoring, and service improvement purposes, including the AI provider and model used, input and output token counts, request latency, and success status (“Usage Metadata”). This log does not contain the text content of your messages, prompts, or AI responses. We use Usage Metadata in our legitimate interest to operate, maintain, and improve the Service and to enforce billing and usage limits.

Account activity. We may collect information about your interactions with the Service, such as feature usage, timestamps, and error events, in our legitimate interest to improve the Service and ensure its security and reliability.

Information Processed But Not Retained

Screen context from screenshots. When you invoke the agent with a screenshot, the image is transmitted to our backend and sent to an AI model (Google Gemini / Vertex AI) for in-memory processing only. The AI extracts structured context from the image, such as the active application, current activity, and visible names or entities, and returns only that text summary. The raw screenshot image is never written to disk, never stored in our database, and is discarded immediately after processing. We process screenshots in this manner where necessary to perform our contract with you to provide contextual assistance.

Voice audio. When you use voice input, audio captured on your device is transmitted to a cloud speech-to-text service (Baseten) solely to produce a text transcription. The resulting transcription is treated as Conversation Data (see above). Raw audio recordings are not stored by us. For messages received via connected channels such as WhatsApp or Slack, transcription is performed entirely on-device using Apple’s on-device models, audio from these sources is never transmitted to any external transcription service. We process voice audio in this manner where necessary to perform our contract with you.

How We Use Your Information

In addition to the specific uses described above, we may use your information to:

• Provide, operate, and improve the Service
• Enforce applicable terms of service and usage limits
• Respond to your support requests and communications
• Monitor for abuse, errors, and security threats
• Comply with applicable legal obligations

We do not use Conversation Data, Memory Data, Google user data, third-party integration data, or integration credentials to train AI models.

We do not sell personal information and do not use personal information for advertising purposes.

4. Use of Google User Data

When you connect Google services to the Service, Lemon Supercomputer may access Google user data solely to provide user-facing functionality that you explicitly request.

Depending on the features you choose to use, this may include access to Gmail data, Google Calendar data, Google Drive metadata or file content, and Google Contacts data.

We use Google user data only to:

• Perform actions and retrieve information that you request through the Service;
• Enable user-facing agent functionality;
• Improve the relevance and usability of requested agent responses and actions.

We do not:

• Use Google user data for advertising, marketing, profiling, or personalization unrelated to the requested functionality;
• Sell Google user data;
• Use Google user data to train AI models;
• Perform background, automated, or scheduled processing of Google user data beyond what is necessary to provide the functionality you request.

Any use of Google user data is subject to the Google API Services User Data Policy, including the Limited Use requirements.

5. Google API Limited Use Disclosure

The Service requests access only to the Google OAuth scopes necessary to provide implemented features.

We use Google user data only to provide user-facing functionality that is visible and prominent within the Service.

We do not transfer Google user data to third parties except:

• As necessary to provide or improve user-facing features requested by you;
• To comply with applicable law;
• To protect the security and integrity of the Service; or
• With your explicit consent.

All use and transfer of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

6. Disclosure of Your Information

We may disclose your information to the following categories of third parties, subject to this Privacy Policy:

Company group. Our affiliates or others within our corporate group, for internal administration or support purposes, in our legitimate interest to run a successful business and to provide the Service.

Service providers. Vendors and service providers who help us provide the Service, including for cloud database hosting, authentication, AI model inference, voice transcription, third-party tool execution, payment processing, and analytics. These providers are contractually obligated to handle your information only as directed by us.

AI providers. All AI requests are routed through our backend proxy, which substitutes provider API keys server-side. Your message content is forwarded to the relevant AI provider (Anthropic, OpenAI, Google, or Moonshot) only as needed to generate a response. Provider API keys are never transmitted to your device.

Integration execution partner. When you direct the agent to take actions using your connected third-party apps (such as sending an email or creating a calendar event), those actions are executed via Composio. The relevant action parameters are forwarded to Composio for execution. We disclose this information as necessary to perform our contract with you and to execute the actions you request.

Professional advisors. As necessary, we may share your information with auditors, lawyers, or accountants.

Business transactions. We may share your information with a prospective buyer, seller, or other relevant third party in connection with a merger, acquisition, asset sale, bankruptcy, or other business transaction, in our legitimate interest to run a successful business and as required by applicable law.

We may also disclose your information as needed to comply with applicable law, respond to lawful requests from public authorities, enforce our terms of service, and protect the safety and security of our business, employees, and users.

7. Human Access to User Data

Access to user data by employees, contractors, or agents of Hey Lemon Computing is restricted to authorized personnel with a legitimate operational need.

Human access to user data is permitted only:

• With your explicit consent;
• To investigate security incidents, fraud, abuse, or misuse of the Service;
• To provide requested support or troubleshoot reported issues; or
• When required by applicable law.

Any permitted access is subject to appropriate access controls, logging, and security safeguards.

8. Third Party Services and Links

The Service integrates with or links to third-party services (such as Gmail, Google Calendar, Slack, and others) that you may choose to connect. We are not responsible for the privacy or security practices of those third-party services. If you connect a third-party service, you should review its applicable privacy policy. Your use of third-party services is governed by those services’ own terms and policies.

9. Children’s Privacy

The Service is not intended for use by individuals under the age of 13, and we do not seek or knowingly collect personal information about children under 13 years of age (or the relevant minimum age in your jurisdiction). If we become aware that we have unknowingly collected information about a child under the relevant minimum age, we will make commercially reasonable efforts to delete such information. If you are the parent or guardian of a child who has provided us with their personal information, please contact us using the information below to request that it be deleted.

10. Data Security and Retention

We implement commercially reasonable security measures to protect your information, including TLS encryption for all data in transit, AES-256-GCM encryption at rest for Integration Credentials, and backend-mediated database access (no direct client access to the database is permitted). Despite these measures, no security measures are perfect, and we cannot guarantee the absolute security of your information.

We retain your information for as long as is reasonably necessary for the purposes described in this Privacy Policy. When determining how long to retain your information, we consider whether we need the information to continue providing the Service, resolve disputes, enforce our agreements, prevent harm, and comply with applicable law.

Third-party integration content, including emails, calendar events, files, contacts, messages, and other data retrieved from connected services, is processed only as necessary to provide requested functionality. Except where such information becomes part of user-visible outputs or stored conversation history, we do not retain third-party integration content as source data.

If you delete your account, we will delete your personal information from our servers within 30 days. Some aggregated or anonymized usage data may be retained for service monitoring purposes.

11. Data Transfers

The personal information we collect may be transferred to, stored in, or processed in countries other than the country in which you reside, including the United States, where our servers are located. By using the Service, you acknowledge and consent (where required by applicable law) to this transfer.

For users in the European Economic Area (EEA) or United Kingdom: where we transfer personal information to countries that have not been determined by the European Commission or relevant UK authorities to provide an adequate level of protection, we will implement appropriate safeguards, such as the European Commission’s Standard Contractual Clauses or equivalent mechanisms recognized under applicable law. Please contact us at the address below if you wish to obtain information about the specific safeguards we use.

12. U.S. Residents

This section supplements the rest of this Privacy Policy and applies to residents of California and other U.S. states that have enacted consumer privacy laws similar to the CCPA.

Categories of Personal Information Collected and Disclosed

In the preceding 12 months, we have collected and disclosed for a business purpose the following categories of personal information:

Sensitive Information

We may collect the following categories of sensitive personal information:

• Your account login credentials when you create or log in to your account.
• If you choose to include sensitive content in your messages to the agent, we will receive that content as part of your Conversation Data.

We do not use sensitive personal information for purposes other than those necessary to provide the Service.

Sale or Sharing of Personal Information

We do not “sell” (as defined under the CCPA) personal information, nor have we done so in the preceding 12 months. We do not have actual knowledge that we sell or share the personal information of users under 16 years of age.

13. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights with respect to your personal information. These rights are not absolute, and in certain cases we may decline your request as permitted by law.

• Right to Access / Know. You may request access to the personal information we hold about you, including the categories of information collected and how it is used.
• Right to Delete. You may request that we delete personal information we maintain about you. You may also delete your account, conversation history, and agent memory directly within the application.
• Right to Correct. You may request that we correct inaccurate personal information we hold about you.
• Right of Portability. You may request a copy of your personal information in a portable format.
• Right to Restrict or Object. You may have the right to ask us to stop or restrict our processing of personal information, or to object to certain types of processing.
• Withdrawal of Consent. Where we rely on consent to process your information, you may withdraw that consent at any time by contacting us. Withdrawal of consent does not affect the lawfulness of processing that occurred before the withdrawal.

To exercise any of these rights, contact us using the information in the section below. We will not discriminate against you for exercising any of these rights. We may need to verify your identity before responding to your request. You may designate an authorized agent to make requests on your behalf; we will require proof of authorization before acting on such requests. If we deny your request, you may appeal our decision by contacting us.

14. Complaints

If you have complaints about how we process your personal information, please contact us at the address below and we will respond as soon as possible.

If you believe we have infringed applicable data protection law, you may file a complaint with the data protection supervisory authority in the country in which you live or work, or the authority where you believe the infringement occurred.

15. How to Contact Us

If you have questions about our privacy practices or this Privacy Policy, please contact us: