Source: https://locli.co/privacy-policy Legal # Privacy Policy This notice explains what personal data Locli uses, why it is used, who receives it, and the choices and rights available to you. Effective August 05, 2026 · Last updated November 03, 2026 On this page [Controller and contact](https://locli.co/privacy-policy#controller) [Data we collect](https://locli.co/privacy-policy#data) [Purposes and legal bases](https://locli.co/privacy-policy#purposes) [Service providers](https://locli.co/privacy-policy#providers) [International transfers](https://locli.co/privacy-policy#transfers) [Retention](https://locli.co/privacy-policy#retention) [Cookies and browser storage](https://locli.co/privacy-policy#cookies) [Your rights](https://locli.co/privacy-policy#rights) [Security and updates](https://locli.co/privacy-policy#security) ## 1. Controller and contact **Locli** is responsible for the personal data described in this notice. Stockholm, Sweden [privacy@locli.co](mailto:privacy@locli.co) Contact us at this address for privacy questions or to exercise a data protection right. ## 2. Personal data we collect We collect only the information needed to provide, secure, and improve Locli. Depending on how you use the service, this can include: - **Account and identity data:** name, email address, authentication records, and a verified Google profile identifier, name, email, or profile image when you choose Google sign-in. Locli does not store Google access or refresh tokens. - **Contact enquiries:** the email address and message you submit through our contact form. We use these to respond to your enquiry; they pass through our mail queue and email delivery provider and are not published. - **Waitlist and invitation data:** email address and any optional name, business name, location, language, invitation status, or onboarding details you submit. - **Approximate location data:** city and country inferred from network headers supplied by our hosting or content-delivery infrastructure, where available, to prefill onboarding and determine geographic pricing. You can review and change the business location before submitting it; business-location changes do not change your account’s billing region. - **Billing data:** detected account pricing country, domain registrant details, payment-provider identifiers, subscription status and invoices. Stripe collects billing details. Stripe collects and stores payment credentials; Locli does not store full card numbers or security codes. We use detected account geography for regional pricing. Stripe calculates applicable taxes from checkout details. - **Business and website data:** business name, location, contact details, source website, services, opening hours, content instructions, generated drafts, published content, and edit history. - **Public business information:** information from official websites and other publicly accessible business sources used to understand the business and prepare a draft. - **Business identity matches:** when enabled, the business name and location you submit may be sent to Google Maps Platform to find likely business listings and official website candidates. Candidate display details are retained for no more than 24 hours; durable audit records may retain a selected Place ID and verification outcome. - **Voice and support data:** recordings you deliberately submit, their transcripts, typed requests, clarification messages, and resulting edit proposals. Successful transcription deletes the raw recording immediately; failed or abandoned recordings are scheduled for deletion after a configurable window that defaults to 24 hours. - **Provider-usage data:** the external service, operation, model, status, timing, bounded error details, usage counts, and estimated cost associated with an account, business, or project where applicable. These operational records do not contain raw prompts, provider responses, transcripts, or recordings. - **Technical and security data:** IP address, browser and device information, timestamps, session identifiers, request logs, error details, and operational usage records. Required account, authentication, and business fields are identified when collected. If you do not provide them, Locli may be unable to create an account, generate a website, or complete the requested action. Optional fields can be left blank. ## 3. How and why we use personal data ### Provide the service and take requested steps To create and secure accounts, maintain waitlist and invitation flows, understand a business, generate and edit website drafts, publish approved content, and provide support. The legal basis is performance of a contract or steps you request before entering one. ### Operate a reliable and secure product To prevent abuse, troubleshoot failures, monitor availability, measure visits and page performance, preserve draft history, and improve product quality. The legal basis is our legitimate interest in providing and improving a safe, dependable service, balanced against your rights. ### Meet legal obligations To maintain records, respond to lawful requests, establish or defend legal claims, and comply with applicable law. The legal basis is a legal obligation or our legitimate interest in protecting legal rights. ### Use optional features you choose Where the law requires consent, we ask before the processing begins. You can withdraw consent at any time, without affecting processing that was lawful before withdrawal. Locli uses AI systems to help understand business information and prepare text, images, transcripts, and edit proposals. These systems support the service; they are not used to make decisions about you that produce legal or similarly significant effects. ## 4. Who receives personal data We do not sell personal data or use it for third-party advertising. We share limited data with service providers when needed to operate Locli, including: - hosting, database, and storage providers, and Cloudflare for content delivery, security, performance measurement, and connection-failure diagnostics as described below; - email delivery and authentication providers, including Google when you choose Google sign-in; - Stripe for secure payment processing, subscriptions and tax calculation; - AI, image-generation, and transcription providers used for the action you request; - business discovery and website retrieval providers used to locate public business information; - Google Maps Platform, when enabled, to resolve likely real-world business identities. Google handles information under the [Google Privacy Policy](https://policies.google.com/privacy); - professional advisers, authorities, or counterparties when required by law or necessary to protect legal rights. Providers may process data only for the contracted service and under appropriate data-protection obligations. Publicly published website content is available to anyone who visits that website. ## 5. International transfers Some providers may process personal data outside the EU or EEA. Where required, we rely on a European Commission adequacy decision, approved Standard Contractual Clauses, or another lawful transfer mechanism, together with supplementary safeguards where appropriate. Contact us to ask about the safeguards relevant to your data. ## 6. How long we keep data We retain personal data only for as long as needed for the purpose for which it was collected, including: - account, project, generated website, and edit data while the account or project remains active, followed by a limited period needed for deletion, backups, security, or legal obligations; - contact correspondence for as long as needed to resolve your enquiry and maintain necessary support records; - waitlist data until access is granted, the request is withdrawn, or it is no longer reasonably needed to administer early access; - raw voice recordings only until successful transcription, or for the configured short failure and abandonment window; - technical, security, and provider-usage records for a bounded operational period based on troubleshooting, abuse prevention, accounting, and legal needs. - unconfirmed Google Maps business-candidate display content for no more than 24 hours, including while owner confirmation is pending. When data is no longer needed, it is deleted or anonymised. Backup copies may remain until they rotate out under normal backup schedules. ## 7. Cookies and browser storage Locli uses first-party cookies for authentication and requested account flows, and browser storage for interface preferences and progress. Locli does not currently use advertising cookies. ### Sign-in and requested account flows - **Session cookie:** _instant_site_mvp_session maintains your sign-in session, protects forms, and carries short-lived onboarding or invitation context. It has no fixed expiry date and is normally kept for the browser session; browser session-restore settings may retain it longer. Pending website-generation details are accepted for one hour. - **Remember me:** if you select this option at sign-in, remember_user_token keeps you signed in for up to 14 days. The equivalent administrator cookie is remember_admin_user_token. Signing out invalidates remembered sign-in. ### Interface preferences and progress - **Persistent layout preferences:** your sidebar and voice-editor panel choices use local storage named locli.sidebar.collapsed, locli.voice-editor.panel-collapsed, and locli.voice-editor.panel-width. These are convenience preferences. They have no automatic expiry and remain until replaced or cleared, including after signing out. - **Tab-session state:** generation-progress indicators and the voice-editor conversation scroll position use session storage, with keys beginning locli-generation- and locli.voice-editor.conversation.. This storage follows the browser tab's session; browser restore features may preserve it. These values hold progress or scroll position, not conversation text or recordings. ### Cloudflare measurement and diagnostics Cloudflare Web Analytics measures visits and page performance, including page paths, referrers, approximate country, browser, and device categories. It does not use cookies or local storage for this measurement. On locli.co and locli.online, automatic analytics is configured to exclude visitors in the European Union, so Cloudflare does not inject its analytics script for those visitors. Visitors outside the EU may still be measured. Separately, Cloudflare can ask supported browsers to report connection failures using Network Error Logging. Reports can contain the requested URL, protocol, connection timings, and error details. Cloudflare receives the reporting request's IP address; it states that this address is used during processing to derive network and approximate location information and is not retained in its Network Error Logging pipeline. The browser's reporting instruction lasts up to seven days and can be renewed on a later visit; this is not a report-retention period. Read Cloudflare's [Web Analytics information](https://developers.cloudflare.com/web-analytics/) and [Network Error Logging information](https://developers.cloudflare.com/network-error-logging/) for details about these services. ### Your browser controls You can remove cookies and browser storage through your browser's site-data settings. This may sign you out and reset preferences or progress. Blocking the session cookie may prevent sign-in and protected forms from working. Browser privacy settings and extensions may also limit analytics or diagnostic reporting. ## 8. Your data protection rights Subject to applicable law, you may ask us to: - provide access to and a copy of your personal data; - correct inaccurate or incomplete data; - delete data or restrict how it is used; - provide data you supplied in a portable format; - stop processing based on consent, or object to processing based on legitimate interests. Some rights have legal exceptions. We may need to verify your identity before acting on a request. You may also lodge a complaint with the data protection authority where you live or work. In Sweden, the supervisory authority is Integritetsskyddsmyndigheten (IMY). The European Data Protection Board maintains a [list of EU and EEA supervisory authorities](https://www.edpb.europa.eu/about-edpb/about-edpb/members_en). ## 9. Security, children, and policy updates We use organisational and technical safeguards designed to protect personal data. No online service can guarantee absolute security, so please use a strong password and contact us if you suspect unauthorised account access. Locli is a business service and is not directed to children. You must be legally able to use the service on your own behalf or for the business you represent. We may update this notice when the service or applicable law changes. The last-updated date at the top identifies the current version. Material changes will be communicated through an appropriate channel. Questions or requests can be sent to [privacy@locli.co](mailto:privacy@locli.co).