Privacy Policy
This policy says what personal data Limma Innovation Inc. ("Limma", "we") collects through
the hosted Limma service at api.limma.ai, its documentation at docs.limma.ai and the
purchase of a subscription, why, how long it is kept, and who else processes it. Limma's
software installed inside your own network sends Limma no content; its licence terms say
what it reports.
1. What we collect, and why
| what | why |
|---|---|
| Account information — the e-mail address you give at checkout, and your organization's name if you give one | to create and run your account, and to send you notices about it |
| Billing information — collected by Stripe on its own checkout page; Limma receives the identifiers of your Stripe customer and subscription, your plan, and whether a payment succeeded, never your card number | to charge for the Service and to apply your plan |
| Customer content — the documents, files, records, questions and searches you or your agents send, and what the Service derives from them (facts, search vectors) | only to provide the Service to you, as the Terms set out; never to train a model, never sold |
| Keys — stored only as SHA-256 hashes, and named by an id made from the hash | to recognize your calls |
| The record of each call — the key's id, the verb, the workspace, the time, the result and, for a question or a search, its text and the facts returned | to show you your own calls, to bill and enforce plan limits, and to keep the Service secure |
| Usage counts — calls, errors, documents held and pages read or loaded | to apply your plan's limits and to bill |
| Network data — the IP address a request comes from, and its method, path and status | to deliver the Service, limit request rates and protect it from abuse |
| What you write to us | to answer you |
We process this data to perform our contract with you, for our legitimate interests in running, securing and improving the Service, and where the law requires it. We do not sell personal data, and we do not use it for advertising.
2. Cookies
docs.limma.aisets no cookie, runs no analytics and loads nothing from another site, and Limma keeps no log of who reads it.api.limma.aisets two kinds:session_id— only when a person signs in to an account through the API's sign-in routes, to keep them signed in (HttpOnly, Secure, 30 days). An agent calling with a key never receives it.AWSALBandAWSALBCORS— set by the load balancer in front of the API so that a client's requests reach the same server. They expire after one hour and identify no one.
- Stripe's checkout page and customer portal, on Stripe's own site, set Stripe's cookies, under Stripe's privacy policy.
3. Who else processes it
Amazon Web Services hosts the Service and everything in it, and Stripe processes payments: the sub-processors page lists each, with what it does. We share personal data with no one else, except when the law requires it.
4. Where it is
In the United States: the Service runs in AWS's US East (N. Virginia) region. If you are outside the United States, your data is transferred to and processed there.
5. How long it is kept
| what | kept |
|---|---|
| Customer content | until you delete it, and at most thirty (30) days after your subscription ends (Terms); backups keep copies for longer, as below; the audit archive keeps none |
| Database backups | 7 days |
| Queue snapshots | 3 days |
| The record of each call, in the database | while the workspace exists; deleting the workspace erases what each call said and keeps who called which verb and when |
| The record of each call, in the audit archive | seven years: who called which verb, when, and the result — never the text of questions or searches, the names of documents, or the users a call was made for; a deletion does not remove it |
| Request logs | 30 days |
| Account and billing records | as long as the law requires |
How deletion works, and what it reaches: security.
6. Your rights
You may ask to see, correct, export or delete the personal data we hold about you, or object to how we use it: write to contact@limma.ai. We answer within 30 days.
Personal data inside a customer's workspaces is that customer's: Limma processes it on the customer's behalf. If your data is in a customer's workspace, ask that customer — Limma helps them answer.
7. Security
How the Service protects data — encryption, the separation of organizations, keys and logs: security.
8. Children
The Service is for organizations, and not for anyone under 16.
9. Changes
We post every change here, with its date. A material change is also announced by e-mail to the address of each account, before it takes effect.
10. Contact
Limma Innovation Inc. — contact@limma.ai.