Privacy Policy

LORE STUDY B.V. ("we", "us", "our"; trading as "Lore") operates from Amsterdam, the Netherlands. We are the data controller for the personal data we process about you. Contact for privacy questions and requests: [FILL IN].

Lore is for people aged 13 and older. If you are under 16, you may only use Lore with permission from a parent or guardian, which we ask for when you create your account (GDPR Art. 8 and Article 5 of the Dutch GDPR Implementation Act). We ask for your month and year of birth to check this. If we learn that someone under 13 has an account, we delete it.

We only collect what is needed to run the service:

• Account data: email address, display name, and month and year of birth.
• Study material you upload: documents, notes, images.
• Learning activity: quiz answers, scores, streaks, progress, and in-app learning events we use to personalize your study path.
• Technical data needed to run the service: session cookies, basic server logs, device/browser info.
• Optional profile data you choose to add: bio, avatar choice, preferred study mode.

We process personal data only for these purposes and on these legal bases:

• Provide the service (lessons, Oracle, account features) — performance of a contract.
• Keep accounts secure, prevent abuse, fix bugs — legitimate interests.
• Comply with legal obligations (e.g. tax for paid plans) — legal obligation.
• Aggregate, anonymous product analytics — legitimate interests; no profiling that produces legal effects.

We do not sell your personal data and we do not share it for cross-context behavioral advertising. We do not use your uploads, answers or other content to train AI models, and our AI providers may not use it for training either; your content is only sent to them to generate your own questions and feedback.

All primary personal data, account information, uploaded study materials and the central database are stored on secure servers in the European Union (AWS region eu-west-1, Ireland). No primary user databases are hosted outside the EU. Where a sub-processor processes data transiently outside the EU (such as the AI providers behind the Lovable AI Gateway for real-time question generation), this happens under Chapter V of the GDPR on the basis of the European Commission's Standard Contractual Clauses (SCCs).

We share personal data only with the limited set of vendors needed to run Lore, each under a written data-processing agreement:

• Lovable and Supabase (cloud infrastructure and managed database, hosted in the European Union, Ireland region) — to store your account, progress and content securely.
• AI providers, reached through the Lovable AI Gateway: Google (Gemini models) and OpenAI (text embeddings) — to generate Oracle answers and quizzes and to search your materials. When you create a world from a topic only, the topic is also sent to Firecrawl to research web sources.
• Email providers — to send account emails such as sign-in links and password resets.
• Cloudflare (Turnstile bot check at sign-up) and Google (only if you choose to sign in with Google).

If you join a guild, its teacher can see your display name and your progress in the worlds shared there. We never sell, rent or trade your personal data, and we never share it for advertising. We may disclose data when required by law (e.g. a valid court order). Business and education customers can request a data processing agreement (GDPR Art. 28) through the enterprise contact form.

We keep personal data only as long as we need it:

• Account data and uploaded materials: as long as your account is active.
• Server logs: maximum 30 days, then automatically purged.
• After you delete your account: all personal data is removed within 30 days, except records we are legally required to keep (e.g. invoices for up to 7 years under Dutch tax law).
• Backups containing deleted data are overwritten on a rolling basis within 30 days.

Lore uses a small number of cookies and similar local-storage entries:

• Strictly necessary: session cookie that keeps you signed in, language preference, cookie-consent choice. These do not require consent.
• Functional: UI preferences such as sidebar state, theme, learning mode. Used only to improve your experience.
• Advertising measurement: only after you choose "Accept all" (or, outside the EEA, UK and Switzerland, unless you choose "Necessary only"), Lore loads the Google tag from Google Ireland Ltd / Google LLC. It records whether you created an account after clicking a Lore ad on Google, using a Google Ads cookie and a pseudonymous account ID. We do not use it for personalised ads or remarketing and use no other third-party analytics. How Google uses this data: https://business.safety.google/privacy/

On your first visit you can choose "Accept all" or "Necessary only". You can change or withdraw your choice at any time via "Cookie settings" at the bottom of every public page; a withdrawal stops the measurement immediately.

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data (rectification).
• Delete your account and all associated data (erasure).
• Receive your data in a portable format (data portability).
• Object to or restrict certain processing.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local supervisory authority.

You can download a copy of your data and delete your account directly from your profile settings.

If you are a California resident, you have the right to:

• Know what personal information we collect, the sources, the purposes, and the categories of recipients.
• Request a copy of the personal information we hold about you.
• Request deletion of your personal information.
• Correct inaccurate personal information.
• Limit use of sensitive personal information.
• Opt out of the "sale" or "sharing" of personal information.
• Be free from discrimination for exercising any of these rights.

Categories of personal information collected in the past 12 months: identifiers (email, account ID), customer records (display name, bio), internet activity (uploaded study material, quiz interactions), and inferences drawn from that activity to personalize learning. We collect no precise geolocation, biometric data, or sensitive identifiers.

Lore does not sell your personal information for money and does not share it for cross-context behavioral advertising. We have not done so in the past 12 months and have no plans to do so.

Even though we do not sell or share your data, you can still record a formal opt-out request. We will honor it for your account permanently.

We protect your data with TLS in transit, encryption at rest, row-level access controls in our database, and strict service-role access for administrative operations. Access to production systems is limited and logged. To protect Lore against attacks, we count requests per IP address to our AI services; these counts are deleted after one hour. IP addresses that attack Lore can be blocked; a block is kept only as long as needed (legitimate interest, GDPR Art. 6(1)(f)).

We do not make decisions that produce legal or similarly significant effects about you using only automated means.

We may update this Privacy Policy. Material changes will be communicated in the app or by email at least 14 days before they take effect.