Privacy Policy.

Who Lia Is

Lia is your AI personal assistant. You interact with Lia via Telegram (@lia_cos_bot) and WhatsApp. Lia connects to your email, calendar, and the web to handle tasks on your behalf.

This privacy policy explains what data Lia collects, how it's used, who it's shared with, and how you control it.

Contact: hello@belowthesurface.studio

What Data Lia Collects

Information you give us

When you start using Lia, she asks for:

• Your name
• Your city (to figure out your timezone)
• Your Telegram user ID or WhatsApp number (automatically provided by the messaging platform)

If you connect Google via /connect:

• OAuth tokens that let Lia access your Gmail, Google Calendar, Google Drive, and Google Contacts.
• These tokens are encrypted (AES-256-GCM) and stored in Lia's database.

If you connect Microsoft:

• OAuth tokens that let Lia access your Outlook email and Microsoft Calendar.
• Same encryption standard (AES-256-GCM).

If you connect Monday.com:

• OAuth tokens that let Lia access your Monday boards, items, and docs.
• Same encryption standard (AES-256-GCM).

If you upgrade to a paid plan:

• Payment information (handled entirely by Stripe. Lia never sees your card details).
• Stripe provides a customer ID and subscription ID to manage your account.

Information Lia accesses (but doesn't store)

When you connect your accounts and ask Lia to do something, she reads:

• Gmail / Outlook: Your emails (subject, sender, body). Read on-demand, never cached or stored.
• Google Calendar / Microsoft Calendar: Your events (title, time, attendees, location). Read when needed, not saved.
• Google Drive: Files you share or ask about. Accessed temporarily, not stored.
• Google Contacts: Your contacts list. Read to help with emails and meetings, not saved.
• Monday.com: Your boards, items, and docs. Read on-demand.

Critical: Lia reads your email and calendar when you ask her to. She does not store the content. She processes it in-memory during the conversation and then it's gone.

Information Lia stores

Information Lia does NOT store

• Raw email content (Lia reads it when you ask, then forgets it).
• Calendar event bodies or details.
• Voice audio files (Lia transcribes them with OpenAI Whisper, then deletes the audio immediately).
• Anything on third-party servers beyond what the AI providers need to process your requests.

How Lia Uses Your Data

Lia uses your data for one reason: to provide the service you signed up for.

Specifically:

• Your name and timezone help Lia greet you and schedule things correctly.
• OAuth tokens let Lia access your email, calendar, and connected services when you ask.
• Memory files help Lia remember your preferences, contacts, and patterns so she gets better over time.
• Payment info (via Stripe) manages your subscription.
• Message counts help monitor usage and maintain service quality.

Lia does not:

• Sell your data.
• Share it with advertisers.
• Use it to train AI models.
• Show it to other Lia users (your workspace is isolated).

Data Isolation

Each user gets their own isolated workspace. Your data is completely isolated:

• No other user can see your memory files, OAuth tokens, or conversation history.
• Database queries are scoped by your user ID. No cross-user access.
• Your workspace directory is separate from everyone else's.

Think of it like separate apartments in a building. You have your own space. No one else has the key.

Third-Party Services

To provide the service, Lia uses:

AI Training

Lia does not train AI models on your data.

The AI providers (Anthropic, Google, OpenAI) process your requests to generate responses, but:

• Anthropic: Does not train on API data.
• Google: Does not train on API data.
• OpenAI: Does not train on API data (Lia uses their business tier).

Your conversations with Lia stay between you and Lia. They don't become training data for future AI models.

Your Controls

You have full control over your data:

• /settings — View your account info, subscription, and usage.
• /disconnect — Remove Google or Microsoft access instantly (OAuth tokens deleted, Lia can no longer read your email/calendar).
• /delete — Delete your entire account (profile, OAuth tokens, memory files, payment records, everything).

Note: /delete is instant and irreversible. Once you delete, your data cannot be recovered.

Data Retention

• Memory files persist until you run /delete.
• OAuth tokens: Stored until you /disconnect or /delete.
• Payment info: Stripe IDs stored until you /delete (Stripe keeps their own records per their policies).

Security

Lia takes security seriously:

• OAuth tokens are encrypted with AES-256-GCM before storage.
• Database access is restricted and logged.
• API keys are stored in environment variables, not code.
• Your workspace is isolated from other users.
• All connections use HTTPS.
• 4 layers of AI threat defense: regex pre-filter, ML-powered injection detection (Lakera Guard), output validation on outbound emails, per-user rate limiting.
• Adversarial eval suite runs against every release before deploy.

Lia runs on SOC 2 Type II certified infrastructure (Supabase, Railway).

If you notice suspicious activity, reach out immediately at hello@belowthesurface.studio.

Children's Privacy

Lia is not intended for children under 13. Lia does not knowingly collect data from users under 13. If discovered, it will be deleted immediately.

Changes to This Policy

If significant changes are made to this privacy policy, you'll be notified via Telegram or WhatsApp before the changes take effect. Minor updates (clarifications, typo fixes) won't trigger a notification.

Contact

Questions about privacy? Email: hello@belowthesurface.studio