Your photos, your business.

Your full-resolution originals never leave your device. Lemika makes a small, downscaled thumbnail of each photo and uploads only that to storage in the EU. An AI model reads the thumbnail, writes titles, descriptions and keywords, and the results are saved to your account. Thumbnails are automatically deleted after 7 days. We never sell your data and never train our own models on your images.

To run Lemika, we collect only what's needed to log you in, process your batches, and bill you.

• Account data. Your email address, display name, an avatar URL, a hashed password (if you signed up with a password), and the Google account identifier if you signed in with Google.
• Processing data. The thumbnails you submit, the titles, descriptions and keywords we generate, plus job metadata such as batch timestamps, file counts and per-request token/cost accounting. This powers your generation history and your plan limits.
• Billing data. Your plan, credit balance and subscription status. Card and payment details are handled directly by our payment provider (Paddle) – we never see or store your full card number.
• Technical data. When you sign in, reset a password or verify your email, we record the IP address and browser (user-agent) used for that specific security action, to protect your account against abuse. If something crashes, our error-monitoring tool captures a technical stack trace – without personal data – so we can fix it.

We do not collect your home address, your real-world location, your contacts, or your payment card details.

Lemika processes your originals locally on your device and creates a small, downscaled thumbnail of each one. Only that thumbnail is uploaded over TLS to object storage hosted in the EU, where the AI engine reads it, generates a title, description and keywords, and writes the result back to your account.

• Your full-resolution originals are never uploaded to our servers and never leave your device.
• Uploaded thumbnails are automatically deleted after 7 days, and you can delete them from your account sooner at any time.
• The generated metadata (titles, descriptions, keywords) is stored as your generation history, without needing the image, so you can re-export it at any time.
• We never use your images or generated metadata to train Lemika's models.
• We never hand your images to humans for manual review or labelling.
• We never upload to the stock platforms for you – exporting happens from your own machine using the metadata and CSV we generate.

We process your data for these reasons and these reasons only:

• To generate titles, descriptions and keywords for the files you submit.
• To show you your generation history and let you re-export your metadata and CSVs.
• To bill you for your plan and prevent abuse of free credits.
• To send you essential transactional emails – account verification, password resets, sign-in links and payment receipts. We do not send marketing emails.
• To keep your account secure and to diagnose crashes and errors.
• To meet legal obligations, such as tax and invoicing records (handled by our payment provider as the merchant of record).

We rely on a small number of carefully chosen sub-processors. As of this update:

• Cloudflare – object storage (R2) for your images in the EU, and hosting/CDN for the web app.
• EU server provider – our application, processing and database servers, located in the European Union.
• Google (Gemini API) – the AI model that generates your metadata. Under Google's paid API terms, your content is not used to train Google's models.
• Google OAuth – used only if you choose to sign in with Google.
• Paddle – payment processing, invoicing and tax, as the merchant of record. Paddle collects your billing details directly.
• Resend – delivery of our transactional emails.
• Sentry – error and crash monitoring. It's configured not to send personal data; reports contain technical stack traces only.

We'll update this page before adding any new sub-processor that handles your data.

Lemika sets a small set of first-party cookies, all strictly to keep you signed in:

• A short-lived access token and a longer-lived refresh token (both server-only) that keep your session alive.
• A lightweight session cookie that carries your basic profile (id, email, display name, avatar) so the app can show you as signed in without an extra round-trip.

For product analytics we use Plausible, self-hosted on our own EU infrastructure. It's privacy-friendly, sets no tracking cookies, and collects no personal data – just aggregate, anonymous usage like page views and a couple of product events (e.g. that a sign-up or purchase happened). We do not use Google Analytics, advertising pixels, or any third-party cross-site tracker.

Lemika is a desktop app for macOS and Windows – the website only lets you check your usage and manage your subscription. Everything that touches your photos happens in the desktop app on your own machine.

• Sign-in tokens are stored securely in your operating system's credential store (Keychain on macOS, Credential Manager on Windows) – not in plain files.
• The app checks for updates periodically against our update server and writes local diagnostic logs to your own machine. These logs stay on your device unless you choose to send them to us for support.
• The desktop app does not currently include usage analytics or telemetry. If that changes, we'll say so here first.

Wherever you are, you can ask us to:

• Export everything we hold about you.
• Correct any account information that's wrong.
• Delete your account, including your generated metadata and history.
• Stop processing your data while we look into a dispute.

Account export and deletion are available directly from your Account page. For anything else, email us at privacy@lemika.app and we'll action your request and respond within 30 days. If we ever drop the ball, you can complain to your national data-protection authority; in the EU, that's typically the one in the country where you live.

The controller of your personal data under the GDPR is:

• —
• Registered address:
• Tax ID (NIP):
• Business register no. (REGON):
• Commercial register (KRS):
• Privacy contact: privacy@lemika.app

Operated from Poland (EU). You can lodge a complaint with the Polish supervisory authority (UODO) or the data-protection authority in your country of residence.

Lemika is an independent product, currently in active development and operated from Poland (EU). Questions, requests, or a polite complaint? Email privacy@lemika.app and a real person will read it. We try hard to answer quickly.