GDPR & privacy rights

This supplements the Privacy Policy where EU GDPR applies. Other applicable privacy laws, including UK and Swiss protections, remain unaffected.

COCO & TAMY, operated by Kim Jaehyeon in South Korea, is responsible for account administration, service security and support. Privacy contact: l@liloi.ai. Processing on behalf of an organization requires a separate data processing agreement (DPA) defining roles and instructions.

Necessary account and requested service processing relies on contract necessity; required tax and transaction records on applicable legal obligations; proportionate security and fraud prevention on legitimate interests, balanced against your rights; optional processing on consent where required. Accepting terms is not consent to unrelated processing, model training or marketing.

AI starts only after signup and verification, scope selection and separate processing consent. Connecting a provider does not authorize collecting all its materials. You must have authority to supply materials containing third-party personal data.

Where applicable, you may request access and a copy, correction, erasure, restriction, portability, objection, or withdrawal of consent at l@liloi.ai. Portability applies to eligible data you provided, processed automatically on consent or contract grounds; it is not a promise that every inferred output qualifies. Statutory rights are not limited to Pro subscribers or conditional on purchasing an export feature.

Requests are normally free. Where GDPR applies, the response deadline is one month from receipt. A permitted extension of up to two further months requires notice within the first month explaining the reason. We may request proportionate identity verification; do not email a password or payment-card details. Any lawful refusal or charge for a manifestly unfounded or excessive request must be explained.

Processing completion automatically removes uploaded originals, full extracted text and temporary classification drafts without another approval; failed deletions are retried. Organized records and supporting excerpts remain until deletion. Account deletion, backups, legal holds and external-provider retention are separate; immediate erasure from every provider or backup is not promised. See the Privacy Policy for category-specific retention and contact l@liloi.ai for requests.

The Privacy Policy identifies Supabase, Vercel, OpenAI, selected connected tools and browser push providers, with their purposes and retention rules. Creem is Merchant of Record and may act as a separate controller for transaction obligations. Data may be processed outside the EEA, including in South Korea and the United States.

Where required, transfers need an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses (SCCs) with the required assessments and measures. Contact l@liloi.ai for information about the applicable recipients and safeguards. OpenAI response storage is disabled; abuse-monitoring retention may still apply.

AI proposes work records; you review them before approval. Liloi does not make employment decisions and drafts are not verified achievements. You may complain to the competent data protection authority without buying a subscription or first exhausting Liloi support.