Privacy Policy

Effective Date: 19.10.2026 | Last Revised: 19.10.2026

This Privacy Policy explains how MERAKI HR SRL collects, uses, stores, and protects personal data when you access or use the LIMEN website, applications, and services. For the purposes of this Privacy Policy, "LIMEN" or the "Platform" refers to the LIMEN brand and its products, including LIMEN Energy, LIMEN Align, LIMEN Threshold (Before Commitment, Before Parenthood, Before Separation), and related tools operated by MERAKI HR SRL.

1. Data Controller Information

MERAKI HR SRL — Bucharest, District 6, Romania Trade Register: J2024005188408 CUI: 49743547 | VAT: RO49743547 | EUID: ROONRC.J40/5188/2024 Email: limen@merakihr.ro

For all data protection inquiries, please contact: limen@merakihr.ro

Supervisory authority: ANSPDCP — Autoritatea Nationala de Supraveghere a Prelucrarii Datelor cu Caracter Personal (dataprotection.ro).

2. Scope of This Policy

This Policy applies to the LIMEN websites and apps operated by MERAKI HR SRL: limen.systems (information and policies), limenenergy.com (LIMEN Energy), limenalign.com (LIMEN Align), limenthreshold.eu (LIMEN Threshold), and related tools. It applies to users anywhere in the world. We apply the same baseline protections to everyone, and where the law of your country gives you more, you keep it.

3. What Data We Collect

We collect only data necessary to operate the Platform.

3.1 Website Data

When you visit our website, we may collect IP address, browser type, device information, pages visited, cookies and usage analytics.

3.2 Account Information

If you create an account: email address, password (encrypted), first name, age range (selected during onboarding), gender (optional, selected during onboarding), subscription plan and status, billing information (processed by payment provider — see Section 8). We do not store full payment card details.

3.3 LIMEN Threshold

LIMEN Threshold presents structured reflective questions only. It does not collect, store, or process personal relational responses.

3.4 LIMEN Energy & LIMEN Align

If you use these tools, we process what you choose to write and tag: Circles (the connections you name), Moments (experiences with those connections and how they felt) and Inner Voice lines (sentences you say to yourself, grouped into five modes). We also process readings derived from them by the Pattern and Foundations modules (Section 15) and records of your consent choices.

This information describes emotions and relationships and can reveal more than you intend, so we protect it as sensitive: it is private to you, never used for advertising or training, and analysed by AI only after your explicit consent (Section 4). We do not ask for health, sexual or other special-category information; if you choose to write it, it stays private to you.

Important: LIMEN does not ask for medical diagnoses, clinical records or legal records, and you should not enter them. Please avoid full names, contact details and other identifying information about other people; use a first name, nickname or role instead.

3.5 Technical & Security Data

Collected for security and service improvement: login activity, device type, session data, error logs.

4. Legal Basis for Processing (EU Users)

For users in the EU, EEA and UK we rely on:

• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) for each AI module (Pattern and Foundations). You give each consent separately, on a screen shown before you pay for a plan or upgrade that includes the module, or before first use if the plan was given to you or no consent is recorded. You can withdraw it at any time in Settings > Privacy. Withdrawing stops the processing and does not affect what happened before. We keep a record of your choice: which consent, which wording version, and when. Without consent the module stays locked, and the rest of your account, including logging Moments and Inner Voice lines, works as before. Free accounts include no AI modules.
• Contract (Art. 6(1)(b)) to run your account and subscription, and to store and show you the Circles, Moments and Inner Voice lines you choose to log.
• Legitimate interests (Art. 6(1)(f)) for security and fraud prevention.
• Legal obligation (Art. 6(1)(c)) for tax and accounting records.
• Consent (Art. 6(1)(a)) for non-essential cookies and marketing.

5. Purpose of Processing

We use personal data to provide the features you have switched on; to produce readings from your own entries when you have consented to the relevant AI module; to manage accounts and subscriptions; to secure the platform; to send service messages; and, only with your consent, to send product updates.

We do not sell personal data, use your entries for advertising or to train AI models, or make decisions about you with legal or similarly significant effects.

6. Marketing Communications

If you choose to subscribe to updates, waiting lists, or early access notifications related to LIMEN products, we may use your email address to send product updates, early access invitations, feature announcements, research participation invitations, and limited promotional communications related to LIMEN products and services.

Marketing communications are sent only where the user has provided consent or where otherwise permitted by applicable law. You may withdraw your consent and unsubscribe at any time by clicking the unsubscribe link in our emails or by contacting limen@merakihr.ro.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected:

• Email and marketing contact data: retained until unsubscribe or withdrawal of consent
• Research participation data: duration of the relevant study plus 24 months
• Purchase and transaction records: retained for 10 years in accordance with Romanian fiscal law
• Technical logs and security data: retained for up to 12 months
• Account data: retained while the account is active, or until the user requests deletion

From 1 December 2026, we delete inactive accounts as follows. An account whose email is not confirmed is deleted after 14 days. A confirmed account with no Moment or Inner Voice line stored is deleted after 90 days without activity, after reminder emails 30, 14 and 3 days before. An account with entries becomes dormant after 12 months without activity (your entries stay stored but are not analysed, and we tell you by email) and is deleted after 24 months without activity, after reminder emails 60, 21, 7 and 1 day before. Activity means signing in or any action in your account; opening an email does not count. Accounts with an active paid subscription or a lifetime membership are not deleted this way.

Users may request deletion at any time by contacting limen@merakihr.ro. Upon verified request, personal data will be deleted or anonymized within 30 days, subject to any overriding legal retention obligations.

8. Data Sharing and Third-Party Processors

We share personal data only with service providers acting as data processors on our behalf, strictly for the purposes described in this Policy. All processors are contractually bound by data processing agreements consistent with GDPR Article 28. We do not sell personal data. We do not share the personal data in your account with advertisers or data brokers.

Processor Register

Processor	Role	Location	Safeguard	DPA Status
Lovable Labs Incorporated	Platform, database hosting, AI Gateway	US company; our databases are in the EU	EU Standard Contractual Clauses (Module Two) in its Data Processing Agreement	DPA
Google (Gemini models, through the Lovable AI Gateway)	AI model provider for the Pattern and Foundations modules	Global infrastructure, which may include servers outside the EEA	EU–US Data Privacy Framework (Google LLC is a certified participant), and Standard Contractual Clauses where the framework does not apply; obligations are passed on by contract under the Lovable agreement	Via Lovable agreement
HubSpot Inc.	CRM and email	US	Standard Contractual Clauses	DPA
Anthropic, Inc.	AI processing (Claude)	US	SCCs per EU Decision 2021/914	DPA
Stripe Payments Europe Ltd.	Payments	Ireland	EU processing	DPA
Microsoft OneDrive	Cloud storage	IE (EU)	EU-based processing	DPA: microsoft.com/licensing
Google Drive / Analytics	Cloud storage & analytics	IE (EU)	EU-based processing	DPA
Supabase	Database hosting	EU	EU operations via AWS Frankfurt	Privacy
i-Tom Solutions SRL (FGO)	Fiscal invoicing	EEA	Romanian fiscal retention	—

Google Analytics, Google Tag Manager and the Meta Pixel are not listed as processors: they are consent-based tags operated by Google and Meta as their own controllers (see 8.4 and 8.5).

8.2 AI Processing

The Pattern module and the Foundations module use Google Gemini models, reached through the Lovable AI Gateway, to produce readings from the entries you have consented to share with them. Entries are not used to train AI models. We also use an AI assistant (Claude, from Anthropic) for our own CRM work, such as drafting replies to form submissions. No entries from LIMEN Energy are sent to it.

8.3 Payments & Billing

If you make a purchase, payment data is processed by Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. MERAKI HR SRL does not store payment card details. Romanian fiscal law requires 10-year retention of invoice records, for that, MERAKI HR SRL uses i-Tom Solutions SRL (FGO) (ISO 27001, ISO 9001; registered personal data operator no. 18584). Invoice data is retained for the legally required fiscal period (minimum 10 years under Romanian accounting law) and cannot be deleted upon user request, as retention is a statutory obligation.

8.4 Analytics

Google Analytics and Google Tag Manager are consent-based tags operated by Google as its own controller, not as our processor. They are operated by Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland (EU/EEA processing). Google Tag Manager manages the deployment and firing of all tracking scripts on the Platform, including analytics and advertising tags. Google Analytics collects anonymized interaction data including pages visited, session duration, device type, and approximate geographic location. IP anonymization is enabled. For EU users, all tags are activated only after explicit consent is obtained via the cookie consent mechanism. No tracking scripts fire before consent.

8.5 Advertising and Remarketing

The Meta Pixel is a consent-based tag operated by Meta Platforms Ireland Ltd. as its own controller, not as our processor. It is loaded only after the user grants marketing consent through the in-page cookie banner. Consent is required before any pixel events fire. Users may withdraw consent at any time via the "Cookie settings" link in the site footer.

8.8 General Obligations

All third-party processors are contractually bound to process personal data only on our documented instructions, required to implement appropriate technical and organizational security measures, prohibited from using personal data for their own independent purposes unless required by law, and subject to confidentiality obligations.

We do not sell personal data to any third party under any circumstances.

9. International Data Transfers

Our databases are in the EU. Some processing takes place outside the EEA: Lovable is a US company, and the AI models behind the Pattern and Foundations modules run on Google infrastructure that may include servers outside the EEA. We protect these transfers with EU Standard Contractual Clauses and equivalent contractual obligations on sub-processors. You can ask us for a copy of the safeguards.

10. Security Measures

We implement appropriate technical and organizational measures including SSL encryption, restricted access controls, secure hosting infrastructure, data minimization principles, and error telemetry handled via Lovable's platform infrastructure with a PII scrubber applied to all error payloads. No system can guarantee absolute security.

11. Your Rights — EU Users (GDPR)

If you are located in the EU/EEA, you have the right to:

• Access your data
• Rectify inaccurate data
• Request erasure ("right to be forgotten")
• Restrict processing
• Object to processing based on legitimate interests
• Data portability
• Withdraw consent at any time
• Lodge a complaint with ANSPDCP (dataprotection.ro)

To exercise any of these rights, contact limen@merakihr.ro. We will respond within 30 days.

12. US Privacy Rights

If you are a US resident, including California residents, you may have the right to request access, deletion, or correction of personal information collected, to know whether personal data is sold or shared, to opt out of the sale or sharing of personal information, and to limit use of sensitive personal information (California — CPRA). LIMEN does not sell personal information. To exercise rights, contact limen@merakihr.ro.

13. Cookies & Tracking

We use cookies and similar technologies. Details are provided in our separate Cookie Policy. Users may withdraw consent for non-essential cookies at any time from the footer "Cookie settings" link.

14. Children's Privacy

The Platform is not intended for individuals under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that data from a minor has been collected, we will delete it promptly.

15. Automated Processing & AI

LIMEN Energy has two optional AI modules. The Pattern module (Pattern Summary and Tendencies) works from the Moments you have logged. The Foundations module (the Relational Signature) works from your Moments and from the tags on your Inner Voice lines. Each runs only if you have consented to it. The Pattern module is included in Premium and both modules in Premium Plus; free accounts include no AI.

They produce descriptions of patterns in what you wrote, which is a form of profiling. They do not give advice, make decisions about you, or have legal or similarly significant effects. Information drawn from your entries, such as feelings, qualities, trends, scores and tags calculated from your Moments and your Inner Voice lines, is sent to an AI model provider (Section 8) to produce the reading. Today we do not send your notes, the sentences you type in Inner Voice, names or contact details, and we would ask for your consent again before sending anything more detailed. We do not use your entries to train AI models, and our platform provider's agreement says it does not either. You can switch a module off at any time in Settings > Privacy. See our AI Transparency Statement.

16. Data Breach Notification

In the event of a personal data breach likely to result in high risk to the rights and freedoms of users, MERAKI HR SRL will notify affected users without undue delay in accordance with GDPR Article 34, and will notify ANSPDCP within 72 hours in accordance with GDPR Article 33.

17. Changes to This Policy

Where changes materially affect your rights, we will give you at least 14 days' notice by email before they take effect. Where a change needs your consent, we will ask for it; continuing to use the Platform is not consent.