Privacy Policy

1. Introduction

Lemon (“Lemon,” the “App,” or the “Service”) is provided and operated by Hey Lemon Computing, Inc., a Delaware corporation (“Hey Lemon Computing,” “we,” “our,” or “us”). This Privacy Policy explains how we collect, use, store, share, and protect information when you use Lemon. By accessing or using Lemon, you agree to the practices described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Voice Input & Transcription

When you use Lemon’s voice features, audio is streamed in real time to generate text or perform user-requested actions.

• Audio recordings are stored as described in Section 2.8 (Stored Audio & Screenshots; Product Improvement).
• Transcribed text may be processed to fulfill a request and may also be stored as part of user-visible outputs (such as assistant responses, drafts, or task history), depending on the feature used.

2.1.1 Diagnostic Audio Collection

Where a user reports transcription, dictation, or audio-processing issues, Lemon may additionally retain audio recordings associated with the reported issue for support purposes.

Diagnostic audio collection:

• Is used solely for support, debugging, quality assurance, and issue resolution
• Is accessible only to authorized personnel involved in investigating the reported issue
• Is not used for advertising, marketing, or profiling
• Is discontinued once the issue is resolved or the support investigation concludes

Diagnostic copies of audio recordings are retained in accordance with Section 9 (Data Retention).

2.2 Assistant Content, Task History & Background Outputs

When you use Lemon’s assistant or background features, we may store user-visible content generated within the App, including:

• Assistant responses
• Generated text or images
• Task results, summaries, or conversation threads

This information is stored so you can revisit past work, continue conversations, and manage your content. Content is retained in accordance with Section 9 (Data Retention).

2.3 Screen Visibility & Screenshot Processing

When explicitly activated by the user, Lemon may capture screenshots or screen regions to understand context and perform requested actions.

Screenshots:

• Are captured and transmitted securely, and only in response to explicit user actions
• Are stored as described in Section 2.8 (Stored Audio & Screenshots; Product Improvement)

Lemon processes only the minimum screen data required and does not use screenshots to infer or reconstruct private third-party content.

2.3.1 Diagnostic Screenshot Collection

Where a user reports a technical issue that Hey Lemon Computing is unable to reproduce or diagnose through standard troubleshooting methods, Lemon may additionally retain screenshots associated with the reported issue for support purposes.

Diagnostic screenshot collection:

• Is used solely for support, debugging, and issue resolution
• Is accessible only to authorized personnel involved in investigating the reported issue
• Is not used for advertising, marketing, or profiling
• Is discontinued once the issue is resolved or the support investigation concludes

Diagnostic copies of screenshots are retained in accordance with Section 9 (Data Retention).

2.4 Third-Party Integrations (OAuth)

Lemon supports optional integrations with third-party services via OAuth.

Authorization

• Access is granted only through explicit user consent
• Users may revoke access at any time
• Lemon cannot access data outside the authorized OAuth scopes

Data Access

Depending on the integration and the user’s request, Lemon may temporarily access:

• Messages or emails
• Calendar events
• Contacts data
• File metadata or file content
• Social or workspace content

Raw third-party content is accessed only to perform user-requested or clearly user-visible actions and is not retained as source data.

2.5 Authentication & Account Data

Lemon uses a third-party authentication provider to manage user accounts and login sessions.

We collect and process:

• Account identifiers (such as email address)
• Authentication tokens
• Session and access metadata

This information is used solely for account management, security, and access control.

2.6 Web Search & On-Device Actions

When requested by the user, Lemon may:

• Process web search queries to retrieve external information
• Execute user-initiated system actions (such as opening applications or URLs using operating system mechanisms)

Lemon does not perform autonomous actions and acts only on explicit user instructions.

2.7 Logs & Diagnostics

We collect limited diagnostic and operational data, including:

• Feature usage statistics
• Error and crash logs
• Device and application metadata
• Performance metrics

Logs do not include the contents of emails, messages, documents, contacts, or private communications.

2.8 Stored Audio & Screenshots; Product Improvement

Lemon stores voice audio recordings and screenshots captured during your use of the App so that the Service can function and so you can benefit from improvements to it.

Storage & retention. Stored audio recordings and screenshots are retained until you opt out of data retention or request account deletion, both by emailing us at support@heylemon.ai (see Section 9).

Consent. By creating a Lemon account and agreeing to this Privacy Policy and the Terms of Use, you consent to this storage and use.

Product improvement & model training — opting out. Your stored audio recordings and screenshots may be used to analyze, develop, and improve Lemon’s products, services, and features, including training Lemon’s AI models. You may opt out of these improvement and training uses at any time, while continuing to use Lemon, by emailing us at support@heylemon.ai. After a verified opt-out, your stored audio and screenshots are used only to provide the Services to you and are excluded from future improvement and training uses.

Access. Stored audio and screenshots are accessible only to authorized personnel with a legitimate operational need, and access is logged and audited (see Section 8).

No advertising. Stored audio and screenshots are not used for advertising, marketing to third parties, or sale to third parties.

Google user data excluded. Data obtained from Google services through Google APIs is never stored as source data and is never included in any product improvement or model training use (see Sections 5 and 6). This exclusion also applies to source data obtained from other third-party integrations via OAuth (see Section 4).

3. Use of Information

We use information to:

• Provide Lemon’s features and functionality
• Perform user-requested or user-visible actions
• Analyze, develop, and improve Lemon’s products, services, and features, unless you have opted out (see Section 2.8)
• Maintain reliability, performance, and security
• Prevent abuse and misuse
• Comply with legal obligations

Lemon does not sell user data and does not use user data for advertising.

Lawful basis. Where the GDPR or similar laws apply, our lawful basis for processing depends on the information and context: we process information to perform our contract with you (providing the Services), for our legitimate interests (such as securing and improving the Services, where your rights do not override those interests), with your consent (which you may withdraw at any time), or to comply with legal obligations.

4. Use of Third-Party Integration Data

Lemon accesses third-party integration data only when explicitly authorized by the user and only to provide user-facing functionality within the App.

Lemon:

• Processes third-party integration data transiently
• Does not store third-party source data (such as emails, messages, calendar entries, files, or contacts) as raw records
• Uses integration data solely to fulfill user-requested or clearly user-visible actions
• Does not use integration data for advertising, profiling, or marketing
• Does not use integration data to train AI models
• Does not perform background, automated, or scheduled processing of integration data

User-visible outputs generated at the user’s request (such as drafts, summaries, or assistant responses) may be stored as part of the user’s Lemon content.

5. Use of Google User Data

When users connect Google integrations, Lemon may access Google user data only to provide user-facing features explicitly requested by the user and visible within the App.

Depending on the feature and user instruction, and pursuant to the OAuth scopes you grant, this may include access to:

• Gmail data: Email metadata and email content necessary to perform the specific action you request, such as retrieving a message or drafting a reply
• Google Calendar data: Event titles, times, attendees, and related metadata necessary to answer scheduling requests
• Google Drive data: File metadata or file content necessary to fulfill the specific request
• Google Contacts data: Contact names and email addresses used to identify a recipient or attendee you reference

Lemon reads only the fields necessary for the requested action and does not build, sync, or retain a copy or database of your mailbox, calendar, files, or contacts.

Lemon processes Google user data solely to:

• Perform user-requested actions (such as drafting content, retrieving information, or checking availability), and
• Improve the relevance and usability of user-facing features within the App when applicable (for example, recognizing names or contextual relationships).

Lemon:

• Processes all Google user data transiently
• Does not store Gmail messages, Calendar events, Drive files, or Contacts as source data
• Does not use Google user data for advertising, analytics, profiling, or marketing
• Does not share Google user data with third parties
• Does not use Google user data to train AI models
• Does not use Google user data for general product improvement
• Does not perform background, automated, or scheduled processing of Google user data

User-visible outputs generated at the user’s request (such as drafts, summaries, or assistant responses) may be stored as part of the user’s Lemon content.

Revocation.If you disconnect your Google account from Lemon or revoke Lemon’s access through your Google account settings, Lemon’s access to your Google user data ceases immediately. Because Lemon does not store Google source data, no Google user data persists after revocation.

All access to and use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

6. Google API Limited Use Disclosure

Lemon:

• Requests only the minimum OAuth scopes necessary for implemented features
• Uses Google user data only to provide user-facing functionality that is visible and prominent within the App
• Does not transfer Google user data except to fulfill user-initiated actions, comply with applicable law, or with explicit user consent

7. Sharing With Others

This section describes when we may disclose information:

Service providers.We share information with vendors who process it on our behalf and at our direction, such as cloud hosting providers, our authentication provider, and third-party AI and large language model providers used to power Lemon’s features. These providers are contractually restricted from using your information for any purpose other than providing services to us. Content sent to third-party AI providers is used solely to generate the requested output, is not used to train those providers’ models, and is not retained by those providers. Google user data shared with such providers to fulfill your request is never used to train their models.

Legal requirements. We may disclose information if we believe it is reasonably necessary to comply with applicable law, regulation, legal process, or a governmental request, or to protect the rights, property, or safety of Hey Lemon Computing, our users, or the public.

Business transfers.We may disclose information in connection with a merger, acquisition, financing, or sale of all or part of our business, subject to this Privacy Policy’s commitments.

With your consent. We may share information with other third parties when you expressly direct or consent to it.

We do not sell user data, and we do not share user data with third parties for advertising.

8. Human Access to User Data

Human access to user data is prohibited except:

• With explicit user consent
• For authorized personnel with a legitimate operational need, in connection with the uses described in this Privacy Policy (including Section 2.8)
• When necessary for security or abuse investigations
• When required by applicable law

Any permitted access is limited, logged, and audited.

9. Data Retention

All data stored by Lemon, including voice audio recordings, screenshots (including diagnostic copies), assistant content, task history, generated outputs, and diagnostic logs, is retained until:

• You opt out of data retention, or
• You request account deletion.

Both requests are made by emailing us at support@heylemon.ai. Upon a verified opt-out or account deletion request, the corresponding stored data is deleted.

Third-party integration source data (including Google user data) is never retained — it is processed transiently and is not stored, so no retention period applies.

If we anonymize, aggregate, or de-identify data, we may use it for lawful business purposes. We may retain limited information where required to comply with legal obligations, resolve disputes, or enforce our agreements.

10. International Data Transfers

Hey Lemon Computing is based in the United States, and your information is processed and stored in the United States, where data protection laws may differ from those in your jurisdiction. Where required, we rely on appropriate safeguards for such transfers, and we take steps reasonably designed to ensure your information is treated securely and in accordance with this Privacy Policy.

11. Security

We use industry-standard safeguards to protect information, including:

• Encryption in transit and at rest
• Secure cloud infrastructure
• Access controls and monitoring
• Abuse prevention mechanisms

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. User Rights

Depending on your jurisdiction (including under the GDPR if you are in the EU/EEA or UK), you may have rights to:

• Access your data
• Correct your data
• Request deletion
• Object to or restrict processing
• Request data portability
• Withdraw consent at any time where processing is based on consent

To exercise any of these rights, including opting out of data retention or requesting deletion of stored audio recordings, screenshots, and other content, email us at support@heylemon.ai. Account deletion requests are handled the same way. We may ask you to verify your identity before responding. You also have the right to lodge a complaint with your local data protection authority.

13. Privacy Notice for California Residents

If you are a California resident, the CCPA/CPRA gives you rights to know, access, correct, and delete personal information we hold about you, and to opt out of the sale or sharing of personal information. We do not sell your personal information and do not share it for cross-context behavioral advertising. To exercise your rights, email us at support@heylemon.ai. We will not discriminate against you for exercising your rights.

14. Children’s Privacy

Lemon is not intended for children under the applicable age of digital consent. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us at support@heylemon.ai.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected by updating the “Last Updated” date above. If a change materially affects how we collect or use your information or meaningfully reduces your rights, we will provide notice within the App or by email, and the notice may designate a reasonable period after which the change takes effect. Changes will not apply retroactively.

16. Contact Us