Privacy Policy

1. Who We Are

Neolemon (“we,” “us,” or “our”) provides an AI-powered SaaS platform for creating images and related content. For the purposes of the General Data Protection Regulation (GDPR), we act as the data controller of your personal data. The Service is operated by Sachin Kamath, registered in Portugal under NIF 318052067.

You can contact us regarding any privacy matters at support@neolemon.com

If you wish to lodge a complaint, you may contact the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese Data Protection Authority, via their website at www.cnpd.pt.

2. Personal Data We Collect

We collect personal data that is necessary to provide and improve our Service.

This includes information you provide directly, such as your display name, subscription details, email address, password, or login through Google. We also collect prompts, images, and other content you create, as well as billing details, which are processed securely by Stripe.

In addition, we collect certain information automatically when you use the Service, including your IP address, browser type, operating system, access logs, usage activity, and error reports. Cookies and similar technologies are also used to remember your preferences, support analytics, and deliver advertising, as explained in the Cookies and Tracking section below.

We may also receive data from third parties. This includes Google when you choose to log in with your Google account, Stripe when processing payments and for fraud prevention, and analytics providers who supply aggregated usage insights.

3. How We Use Personal Data

We use personal data only where we have a valid legal basis under the GDPR.

This includes processing your information to create and manage your account, provide image generation and related services, and handle payments. We also retain invoice data as required by Portuguese tax law. For customer support and to maintain the security and proper functioning of our platform, we rely on our legitimate interests, which include responding to user requests and preventing abuse. We use data for analytics, performance monitoring, and advertising through cookies as described in the Cookies and Tracking section below. Where you have given consent, we may also send you marketing communications, and you may withdraw that consent at any time.

4. Sharing of Personal Data

We do not sell your personal data. We share it with trusted service providers where necessary to deliver our Service. This includes Amazon Web Services (hosting), Microsoft Azure (support email delivery), Stripe (payments), Google (login and analytics), and CookieYes (cookie consent management). We also share invoice data with our accountant in Portugal to comply with tax law, and we may disclose information to legal authorities where required by law. Some of these providers may process data outside the European Union, in which case transfers are protected by Standard Contractual Clauses (SCCs) or other safeguards recognised under the GDPR. We also share data with OpenAI for advertising, as described in the Cookies and Tracking section.

5. International Data Transfers

Your personal data is stored primarily within the European Union. However, some of our service providers, including Stripe, Google, Amazon Web Services, Microsoft, and OpenAI, may process data outside the EU. When this occurs, we apply appropriate safeguards to protect your information, such as the use of Standard Contractual Clauses (SCCs) approved by the European Commission or reliance on adequacy decisions where applicable.

6. Data Retention

We retain personal data only for as long as necessary to provide our Service and to comply with legal obligations. Account information is deleted when you close your account, and any prompts or images you create are removed when you delete them or when your account is deleted. Payment data is handled and retained by our payment provider, Stripe, in accordance with their policies. Invoice records must be kept for 10 years to comply with Portuguese tax law. Technical logs are kept for up to 90 days to ensure security and proper functioning of the platform. Cookies are stored based on your preferences, as set out in the Cookies and Tracking section below.

7. Your Rights under GDPR

You have a number of rights under the GDPR. These include the right to access the personal data we hold about you, to request corrections to inaccurate information, and to request the deletion of your data, except where we are required to retain it by law, such as for invoices.

You may also request that we restrict the processing of your data, obtain a copy of your data, or object to certain processing carried out on the basis of our legitimate interests. Where we rely on your consent, such as for cookies, analytics, or marketing, you may withdraw that consent at any time. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese Data Protection Authority. Requests to exercise these rights can be made by contacting us at support@neolemon.com, we will respond within 30 days.

8. Cookies and Tracking

We use cookies and similar technologies to operate our Service, measure performance, support analytics, and deliver advertising. Essential cookies are always active as they are necessary for the Service to function. If you visit from the European Union or the United Kingdom, analytics, performance, and advertising cookies are optional and only used if you give your consent through the cookie banner provided by CookieYes, where you can also change your preferences at any time. If you visit from anywhere else, these cookies are active by default and you can control them through your browser settings.

When advertising cookies are active, we use the OpenAI Pixel and Conversions API on our website for all visitors, not only those who arrive from an advertisement. OpenAI receives information about your visit, sign-ups, checkouts, and purchases, together with a browser reference. This can include the click reference of the advertisement and hashed identifiers such as your email address and account ID. OpenAI is not our service provider for this. It acts as an independent data controller and may use this data under its own terms to measure and optimise advertising, create custom audiences, and develop and improve its products and services. Data already shared with OpenAI is not deleted automatically when you close your account. These tools set the cookies nl_oppref, __oppref, and __oaiq_consent (30 days) and __obref (1 year).

9. Data Security

We use industry-standard measures such as encryption, access controls, and secure hosting through Amazon Web Services to protect personal data from unauthorised access, disclosure, or alteration. While we take these measures seriously, no system can be guaranteed to be completely secure, and we encourage you to take care in safeguarding your own account credentials.

10. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from individuals under 18 years of age. If we become aware that we have collected such data, we will delete it without delay.

11. Changes to this Policy

We may update this Privacy Policy from time to time. When we make changes, we will post the updated version on this page and revise the “Last revised” date at the top. If the changes are material, we will also notify you directly, for example by email or through the Service.

12. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, you can contact us at: support@neolemon.com