Privacy Policy

1. Introduction

Lolli ("we," "our," or "the platform") is an AI agent platform that enables users to interact with large language models and connect external services. This Privacy Policy explains how we collect, use, store, and protect your information when you use Lolli at lollistudio.com.

2. Information We Collect

Account Information

When you create an account, we collect your name, email address, and a hashed password. If you sign in via an OAuth provider, we receive your name and email from that provider.

Chat Data

We store your conversations, messages, and any files you upload to provide the chat functionality. Conversations can be deleted at any time from the chat interface.

API Keys

If you provide your own API keys for AI providers (OpenAI, Anthropic, Google), they are encrypted at rest using AES-256-GCM and are only decrypted in memory when making API calls on your behalf.

Connected Services (Connectors)

When you connect external services such as Gmail, we store OAuth tokens (access tokens and refresh tokens) encrypted at rest using AES-256-GCM. We access your connected services only when you explicitly use connector tools during a chat session. For Gmail specifically:

• We access your email data only when you ask the AI to search, read, send, or manage emails during a chat.
• Email content is passed to the AI model to generate responses and is not stored separately beyond the chat conversation.
• We do not scan, index, or analyze your emails in the background.
• You can disconnect any service at any time from the Connectors page, which immediately deletes the stored tokens.

3. How We Use Your Information

We use your information to:

• Provide and maintain the Lolli platform
• Process your messages through AI models to generate responses
• Execute tool calls on connected services when you request them
• Store your chat history and preferences
• Authenticate your identity

We do not sell, rent, or share your personal information with third parties for marketing purposes.

4. Third-Party Services

When you use Lolli, your messages may be sent to third-party AI providers (OpenAI, Anthropic, or Google) to generate responses. These providers process your messages according to their own privacy policies. We recommend reviewing:

• OpenAI Privacy Policy
• Anthropic Privacy Policy
• Google Privacy Policy

We also use Vercel for hosting and analytics, and Neon for database hosting.

5. Data Storage and Security

• All data is stored in a Neon PostgreSQL database with encryption in transit (TLS/SSL).
• Sensitive values (API keys, OAuth tokens) are encrypted at rest using AES-256-GCM with a server-side encryption key.
• Uploaded files are stored in Vercel Blob Storage with access controls.
• Passwords are hashed using bcrypt and are never stored in plaintext.

6. Data Retention

We retain your data for as long as your account is active. You can delete individual conversations, files, memories, and connected services at any time. If you wish to delete your account and all associated data, please contact us.

7. Your Rights

You have the right to:

• Access your personal data stored on the platform
• Delete your conversations, files, and connected services
• Disconnect external services and revoke access at any time
• Request deletion of your account
• Export your data

8. Google API Services User Data Policy

Lolli's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically:

• We only request access to Google user data that is necessary for the features you choose to use.
• We do not use Google user data for advertising or to serve ads.
• We do not allow humans to read your Google user data unless we have your explicit consent, it is necessary for security purposes, to comply with law, or the data is aggregated and anonymized for internal operations.
• We do not transfer Google user data to third parties except as necessary to provide the service (e.g., passing email content to the AI model you selected to generate a response at your request).

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by updating the "Last updated" date at the top of this page.

10. Contact

If you have questions about this Privacy Policy or your data, please contact us at hellolollistudio@gmail.com.