Privacy Policy

Last updated: July 3, 2026

This policy explains what personal data is processed when you use the Litux website and the Litux application (together, the "Service"), on what legal basis, and what rights you have. It is written to meet Art. 13 GDPR (Datenschutz-Grundverordnung).

1. Controller

Franco Medero
[Straße und Hausnummer], [PLZ] München, Germany
Email: mederofranco21@gmail.com

2. The short version

3. Data we process, and why

3.1 Hosting and server logs

The website and app are hosted on Vercel (Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA). When you visit, Vercel technically processes your IP address, browser type, and request metadata in server logs to deliver the pages and keep the service secure. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a secure website). Logs are retained only for a short period.

3.2 Desktop waitlist

If you join the desktop-app waitlist, we store the email address you enter in our database (Supabase) for the sole purpose of notifying you when the desktop app ships. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw at any time by emailing us; the address is then deleted.

3.3 Account (optional)

You can use Litux as a guest without an account. If you create an account, we process your email address and authentication data through Supabase (Supabase, Inc., USA), plus an internal usage-credit balance that meters AI requests. Legal basis: Art. 6(1)(b) GDPR (performance of the user agreement). Account data is kept until you delete your account.

3.4 Your datasets and projects (local by default)

Datasets you load, cleaning pipelines, models, and plots are stored locally in your browser (IndexedDB) and processed on your device. They are not transmitted to us. We are not a controller for this local data.

3.5 Cloud sync and project sharing (opt-in, end-to-end encrypted)

If you turn on cloud sync, your project is encrypted in your browser before upload and stored as an encrypted blob on Supabase. We cannot read the contents — only you (and people you deliberately share a project with) hold the key. We store sync metadata (project name, timestamps, account ID) to make sync work. Legal basis: Art. 6(1)(b) GDPR. Synced data is deleted when you delete the project or your account.

3.6 AI features (opt-in) — Anthropic Claude

Litux's optional AI features (AI command bar, research coach, AI narratives) are powered by the Claude API of Anthropic, PBC (San Francisco, USA). AI features are off by default. When you use them, the following is sent to Anthropic through our server proxy:

• your question or instruction,
• column names and PII-filtered sample values from the active dataset (never the full dataset),
• model results or plots you ask about, and
• any images or files you yourself attach to the chat.

Per Anthropic's commercial API terms, API inputs and outputs are not used to train Anthropic's models by default and are retained by Anthropic only for a limited period for abuse and safety monitoring. Our proxy does not store your prompts or the AI's responses; it records only the credit deduction on your account. Legal basis: Art. 6(1)(b) GDPR and, for content you choose to attach, Art. 6(1)(a) GDPR (consent expressed by attaching it). Please do not attach images or documents containing other people's personal data or confidential material — see the Terms of Use.

3.7 Feedback

If you submit feedback in the app, we store the message you write (and your account ID, if signed in) to improve the Service. Legal basis: Art. 6(1)(f) GDPR. Feedback is deleted once processed or on request.

4. Cookies and local storage

We use no tracking cookies, no analytics, and no advertising technology. The app stores a session token and app settings in your browser's local storage; this is strictly necessary to provide the service you request and is therefore exempt from consent under § 25(2) TDDDG. Fonts are self-hosted — no requests go to third-party font CDNs.

5. Recipients and international transfers

We use the following processors: Vercel Inc. (hosting, USA), Supabase, Inc. (database, authentication and storage, USA), and Anthropic, PBC (AI model provider, USA — only when you use AI features). Where data is transferred to the USA, the transfer is safeguarded by the EU–U.S. Data Privacy Framework and/or EU Standard Contractual Clauses (Art. 45, 46 GDPR) under data processing agreements with each provider. We do not sell personal data and do not share it with anyone else, except where legally required.

6. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15),
• rectification (Art. 16) and erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interest (Art. 21), and
• withdraw any consent at any time with effect for the future (Art. 7(3)).

To exercise any of these, email mederofranco21@gmail.com. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — for us, the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany.

7. No automated decision-making

We do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR. AI features only run when you invoke them and produce suggestions you review yourself.

8. Changes

We will update this policy when the Service changes (for example, new providers or features). The current version always lives at this address; the date above tells you when it last changed.