Privacy Policy

1. Overview

Version of this privacy policy: October 2026

This policy explains which personal data we process when you visit www.lio.ai, request a demo or contact us. It also explains why we process it and what rights you have. “Personal data” means any information that can identify you. We review this policy at least once a year and whenever our services, our service providers or the law change. The current version is always on this page.

2. Hosting and website infrastructure

2.1 Framer

We build and host this website with Framer. The provider is Framer B.V., Rozengracht 207B, 1016 LZ Amsterdam, Netherlands (“Framer”). Each time you visit the site, Framer processes server log data on our behalf: your IP address, the date and time, the pages you open, the referrer URL, your browser and your operating system. Framer needs this data to deliver the site and keep it secure. Images, videos and fonts are also served through Framer’s network (framerusercontent.com).

Framer also gives us basic usage statistics for the website (events.framer.com). These statistics don’t use cookies and don’t identify individual visitors.

The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). Some of Framer’s sub-processors, such as cloud hosting and content delivery providers, may process data in the USA. Those transfers rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. We have a data processing agreement with Framer under Art. 28 GDPR. Framer’s privacy policy is at https://www.framer.com/legal/privacy-statement/.

2.2 Unicorn Studio

Some animated graphics on this site come from Unicorn Studio (assets.unicorn.studio; files may also load from Google Cloud Storage). When the animation loads, your browser connects to these servers and they receive your IP address. The legal basis is our legitimate interest in presenting the site in an appealing way (Art. 6(1)(f) GDPR).

2.3 jsDelivr

We load some scripts from the jsDelivr content delivery network (cdn.jsdelivr.net), operated by Prospect One sp. z o.o., Poland. jsDelivr uses CDN partners such as Cloudflare and Fastly, which may process your IP address outside the EU. We use jsDelivr because it delivers code quickly and reliably (Art. 6(1)(f) GDPR). Details: https://www.jsdelivr.com/terms/privacy-policy-jsdelivr-net.

2.4 SSL/TLS encryption

This website uses TLS encryption, for example for the demo request form. You can tell a connection is encrypted when the address starts with “https://“ and your browser shows a lock icon.

3. General information

3.1 Legal bases

We process personal data on these bases:

• Your consent: Art. 6(1)(a) GDPR. For cookies and access to your device, also §25(1) TDDDG

• A contract with you, or steps you ask for before a contract: Art. 6(1)(b) GDPR

• A legal obligation, such as tax retention: Art. 6(1)(c) GDPR

• Our legitimate interests: Art. 6(1)(f) GDPR. Technically necessary access to your device is covered by §25(2) TDDDG

Each section below names the legal basis that applies.

3.2 Storage duration

We keep personal data only as long as we need it for the purpose we collected it for. After that, or if you withdraw consent or ask for erasure, we delete it, unless the law requires us to keep it. Commercial and tax law, for example, set retention periods of 6 to 10 years. In that case we restrict processing until the period ends.

3.3 Recipients and transfers outside the EU

We share personal data only with processors who work on our behalf under a data processing agreement (Art. 28 GDPR), when the law requires it, or when another legal basis allows it. Some providers named in this policy are based in the USA or use sub-processors there. Transfers to the USA rely on the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) when the provider is certified. Otherwise they rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Our US office receives data only when it needs to, for example to handle a demo request from North America, and under an intra-group agreement based on the Standard Contractual Clauses.

3.4 Data from other sources

We sometimes receive business contact data from other sources rather than from you. These include public sources (company websites, commercial registers, LinkedIn), business contact data providers, and partners or customers who refer you to us. The data is usually your name, job title, employer, business email and phone number. The legal basis is our legitimate interest in contacting potential business partners (Art. 6(1)(f) GDPR). We tell you about this within one month, and no later than our first contact with you (Art. 14 GDPR). If you ask, we tell you where your data came from. You can object at any time, and we will then stop contacting you.

3.5 Your rights

You have the right to:

• Access your data (Art. 15 GDPR)

• Have it corrected (Art. 16)

• Have it erased (Art. 17)

• Have its processing restricted (Art. 18)

• Receive it in a portable format (Art. 20)

• Withdraw your consent at any time with effect for the future (Art. 7(3))

Send your request to privacy@lio.ai. We answer within one month. For complex requests this can be extended by two more months, and we will tell you if it is. We may check your identity first (Art. 12(6) GDPR). If we correct, erase or restrict data, we tell everyone we shared it with (Art. 19 GDPR).

Right to object (Art. 21 GDPR). If we process your data based on legitimate interests, you can object at any time for reasons arising from your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims. You can object to direct marketing at any time without giving a reason.

Right to complain. You can complain to a data protection authority. Ours is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

3.6 No automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR).

3.7 Children

This website is aimed at businesses. It is not directed at anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

3.8 Security

We use appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include encryption in transit, access controls and data processing agreements with our providers. No transmission over the internet is completely secure.

4. Data we collect on this website

4.1 Cookies and similar technologies

Cookies are small files stored on your device. We use two types:

• Necessary: needed for the site to work, for example to remember your cookie choice. These are always on (§25(2) TDDDG, Art. 6(1)(f) GDPR)

• Analytics: help us understand how the site is used (section 5). These are set only with your consent (§25(1) TDDDG, Art. 6(1)(a) GDPR)

4.2 Consent banner

We use Framer’s built-in consent banner, combined with Google Consent Mode. The first time you visit, the banner asks what you want to allow, using the categories necessary, preferences, analytics and marketing. Everything except “necessary” is off by default. You can accept all, reject all, or choose by category. Your choice is stored in your browser’s local storage. To change it later, use the “Cookie settings” link in the footer, or delete this site’s stored data in your browser and the banner will appear again.

4.3 Demo request form

When you request a demo at www.lio.ai/demo, we collect your name, company, work email, phone number and your message (“How can we help?”). We use this data to answer you, schedule a demo and prepare a possible contract. The form is processed by Framer (section 2.1). Your entries are then transferred to our customer relationship management system, Attio. The provider is Attio Ltd., United Kingdom (“Attio”). Attio stores and manages contact and sales data on our behalf under a data processing agreement (Art. 28 GDPR). Data is transferred to the United Kingdom based on the European Commission’s adequacy decision (Art. 45 GDPR). Where Attio uses sub-processors in the USA, transfers rely on the Standard Contractual Clauses. Attio’s privacy policy: https://attio.com/legal/privacy.

Work email and phone number are required to answer your request. Name, company and message are optional. If you don’t provide the required fields, we can’t process your request.

The legal basis is Art. 6(1)(b) GDPR for steps before a contract. Otherwise it is our legitimate interest in handling enquiries and managing business contacts (Art. 6(1)(f) GDPR). If no business relationship follows, we delete your enquiry data no later than 24 months after our last contact, unless the law requires us to keep it.

4.4 News and insights

If you tick “Keep me updated with news and insights”, we send you occasional emails about Lio, our products and events, based on your consent (Art. 6(1)(a) GDPR). Your email address and the time of your consent are stored in Attio (section 4.3), so we can prove your consent. You can unsubscribe at any time through the link in every email or by writing to privacy@lio.ai. After you unsubscribe, we keep your address on a suppression list so we don’t email you again (Art. 6(1)(f) GDPR).

4.5 Email and phone

If you contact us by email or phone, we process your message and contact details to answer you. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract, and Art. 6(1)(f) GDPR in all other cases. Section 3.2 sets out how long we keep it.

4.6 Google Maps

Our demo page shows our office locations on embedded Google Maps, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the map loads, Google receives your IP address and may set cookies. Data may be transferred to Google LLC in the USA under the EU-US Data Privacy Framework. The legal basis is our legitimate interest in helping you find our offices (Art. 6(1)(f) GDPR). Where we have asked for your consent, the legal basis is your consent (§25(1) TDDDG, Art. 6(1)(a) GDPR). Google’s privacy policy: https://policies.google.com/privacy.

4.7 Job applications (Ashby)

The open roles on our careers page come from Ashby, our applicant tracking system. The provider is Ashby, Inc., 548 Market St PMB 397006, San Francisco, CA 94104, USA (“Ashby”). If you apply, Ashby stores your application data on our behalf under a data processing agreement. We use this data to decide on your application (Art. 6(1)(b) GDPR). Ashby is certified under the EU-US Data Privacy Framework. If you are not hired, we delete your application 6 months after the process ends, unless you agree to us keeping it longer. Ashby’s privacy policy: https://www.ashbyhq.com/privacy.

4.8 YouTube videos

Some pages, such as Careers and Events, embed YouTube videos. The provider is Google Ireland Limited (address above). When a page with a video loads or you play a video, YouTube receives your IP address and the page you are on, and may set cookies or use similar technologies. If you are signed in to YouTube, Google can link the visit to your account. The legal basis is our legitimate interest in presenting our content in an appealing way (Art. 6(1)(f) GDPR). Where we have asked for your consent, the legal basis is your consent (§25(1) TDDDG, Art. 6(1)(a) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework.

4.9 Links to social networks

We link to our LinkedIn page. The link is a plain hyperlink: no data goes to LinkedIn until you click it. After that, LinkedIn’s privacy policy applies: https://www.linkedin.com/legal/privacy-policy. The same applies to the “Explore Lio” links to ChatGPT, Claude, Google and Perplexity.

5. Analytics

5.1 Google Tag Manager

We use Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager lets us manage tracking tools on our site. It doesn’t create user profiles or set cookies itself, but when it loads, Google receives your IP address, which may be transferred to Google LLC in the USA. The legal basis is our legitimate interest in managing our website efficiently (Art. 6(1)(f) GDPR).

5.2 Google Analytics 4

We use Google Analytics 4 to understand how visitors use our site, so we can improve it. The provider is Google Ireland Limited (address above). Google Analytics uses cookies and similar technologies. It may process:

• Pages viewed, time on site and where you came from

• Your approximate location (country or city), browser, device type and operating system

• Interactions such as clicks, scrolling and form submissions

Google Analytics 4 doesn’t log or store full IP addresses. Data is kept for a maximum of 14 months. We have signed Google’s data processing terms. Data may be transferred to Google LLC in the USA under the EU-US Data Privacy Framework, for which Google is certified.

Google Consent Mode. Google Analytics sets cookies and reads information from your device only if you consent to the “analytics” category (§25(1) TDDDG, Art. 6(1)(a) GDPR). If you decline, Google Analytics still sends limited cookieless signals to Google, such as the page viewed, time, browser type and a shortened IP address. These signals contain no identifiers that would let you be recognised across visits. Google uses them in aggregated form to model visitor statistics. The legal basis for these signals is our legitimate interest in understanding how our website is used overall (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR), for example by using a browser add-on that blocks Google Analytics.

You can withdraw consent at any time in the cookie settings (section 4.2). More information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245.

6. Video conferences

We hold demos and customer meetings on Microsoft Teams. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. When you join, we and Microsoft process your name, email address, the meeting time and length, and technical data such as your IP address and device information. If you turn them on, we also process your audio, video, chat messages and shared screen. We record meetings only with the consent of everyone attending.

The legal basis is Art. 6(1)(b) GDPR for contract-related meetings, and otherwise our legitimate interest in communicating efficiently (Art. 6(1)(f) GDPR). Transfers to the USA rely on the EU-US Data Privacy Framework. Microsoft’s privacy statement: https://privacy.microsoft.com/en-us/privacystatement.

7. Additional information for US residents

This section applies to residents of US states with comprehensive privacy laws, such as California, Colorado, Connecticut, Virginia and Texas. It supplements the rest of this policy.

What we collect and why. We collect the categories of personal information described in sections 2 to 6: identifiers and contact details (name, work email, phone number, IP address), professional information (company, job title), internet activity on this website (pages viewed, browser, device, approximate location), and audio and video data from meetings you join. We use them for the purposes described in those sections and keep them for the periods stated there. We do not collect sensitive personal information.

No sale of personal information. We do not sell personal information. We do not share it for cross-context behavioral advertising or use it for targeted advertising. We do not knowingly collect personal information from anyone under 16.

Global Privacy Control. We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of any sale, sharing or targeted advertising.

Your rights. Depending on your state, you have the right to know what personal information we hold about you and to get a copy of it, to have it corrected or deleted, and to opt out of sale, sharing, targeted advertising and profiling. We will not discriminate against you for using these rights.

How to make a request. Email privacy@lio.ai or call +1 (646) 776-4657. We will verify your identity before acting on your request and respond within 45 days. If we need more time, we will tell you, and we can extend by up to 45 more days. You can let an authorised agent make a request for you. If we decline your request, you can appeal by emailing privacy@lio.ai with the subject “Privacy appeal”.

8. Changes to this policy

We update this policy when our website, our service providers or the law change. If we want to use data we already hold for a new purpose, we tell you before we start (Art. 13(3) GDPR). If the original processing was based on consent, we ask for your consent again.

9. Who we are and how to contact us

This website is operated by Lio Technologies Holding Inc. and its operating subsidiaries Lio Technologies, Inc. and Lio Technologies GmbH (“Lio”, “we”, “us”).

Lio Technologies, Inc.

524 Broadway, New York, NY 10012, USA

Lio Technologies GmbH

Karlstraße 64-68 / Seidlstraße 21-23, 80335 München, Germany

Postal address: Seidlstraße 23, 80335 München, Germany

Register court Munich, HRB 286659

Managing directors: Lukas Heinzmann and Vladimir Keil

For visitors in the EU and EEA, Lio Technologies GmbH is the controller under the GDPR. For US residents, Lio Technologies, Inc. is the responsible business under US state privacy laws.

Contact: privacy@lio.ai, +49 15888 633603 (EU), +1 (646) 776-4657 (US)

Data protection officer: ePrivacy GmbH, represented by Prof. Dr. Christoph Bauer and Stefanie Bauer, Bei den Mühren 5, 20457 Hamburg, Germany, dpo@eprivacy.eu