Terms of Service
Effective · Version 1.0
Plain-language summary: Loresis is an AI assistant that works with the accounts you connect. You stay in control: nothing is sent, booked or changed in your name until you approve it. You own your content, and we use it only to run the Service for you. Neither we nor our AI providers train models on it. AI can be wrong, so check what matters.
1. Who we are
The Loresis services are provided by , , registered with the Department of Registrar of Companies of the Republic of Cyprus under number , with its registered office at , VAT number (“Loresis”, “we”, “us”). Contact: .
These Terms govern your use of (together, the “Service”). Our Privacy Policy, Acceptable Use Policy and, for organisations, the Data Processing Agreement form part of these Terms.
2. Accepting these Terms
You accept these Terms by ticking the acceptance box when you create an account or first sign in, or by using the Service. We record the version you accepted and when. If you accept on behalf of an organisation, you confirm that you are authorised to bind it, and “you” includes that organisation.
3. Who can use Loresis
You must be at least years old.
The Service is for business and professional use only. By creating an account you confirm that you use it for your trade, business or profession and not as a consumer.
You may use the Service for personal or business purposes. If you are a consumer, you keep all rights that the law of your country of residence gives you and that cannot be waived by contract; nothing in these Terms limits them.
You may not use the Service if you are located in or ordinarily resident in the Russian Federation, the Republic of Belarus or the temporarily occupied territories of Ukraine, or if you are, are owned or controlled by, or act on behalf of, a person subject to sanctions imposed by the European Union, the Republic of Cyprus, the United Kingdom, the United States, the United Nations or Ukraine.
You must comply with all sanctions and export-control laws that apply to you and may not use the Service on behalf of sanctioned persons.
4. Your account
You sign in through our authentication provider. Keep your sign-in method secure and tell us at once at if you suspect unauthorised access. Each account is for one person. You are responsible for everything done through your account, including approvals given in chat or voice conversations.
5. What the Service does
Loresis is an AI assistant. With your permission it connects to accounts and systems you choose, such as email, calendars, Telegram, GitHub, video meetings, websites you are signed in to and business data systems. It reads and indexes their content, answers questions, prepares summaries, drafts, knowledge pages and dashboards, and carries out actions you approve. Features available to you may differ by plan, account or domain.
Early access. The Service is in early access. Features may change, be limited or be withdrawn, sometimes without notice, and may contain errors. We will not withdraw access to your stored content without giving you a reasonable opportunity to export it, except where section 15 allows immediate suspension.
Fair-use limits. We apply technical limits (for example on requests, assistant actions, voice sessions, uploads and browser tasks per day) to protect the Service. We may change these limits; current limits are shown in the product or available on request.
6. Connected accounts and third-party services
When you connect an account you authorise us to access it within the permissions you grant, solely to provide the Service to you. You confirm that you are entitled to connect each account and to let us process its content, including content about other people.
Connected services (for example Google, Microsoft, Telegram, GitHub, Zoom and websites you connect) are run by third parties under their own terms, which you must follow. We do not control them and are not responsible for their availability, for changes to their interfaces or for actions they take on your accounts.
Browser connections. If you use Loresis Browser Connect, you choose which website sessions to transfer. You confirm that you hold those accounts, that you may let an automated assistant use them, and that doing so is permitted by the website’s terms. Some websites restrict automated access and may ask you to verify, limit or close an account; we are not liable for such measures. Disconnecting deletes the stored sessions but does not sign you out of the website.
Browser connections. If you use Loresis Browser Connect, you choose which website sessions to transfer and confirm that you may let Loresis use those accounts.
7. Actions on your behalf
Loresis never sends, books, deletes or changes anything in a connected account without your approval. It prepares a proposal (for example an email, a calendar change, a Telegram message or a browser action) and waits. You approve by clicking approve, or by an unambiguous confirmation in a chat or voice conversation that refers to that proposal.
Once you approve, the action is yours: it is carried out from your account and in your name, and you are responsible for its content, its recipients and its consequences. Review proposals before approving them. Sent messages usually cannot be recalled.
Browser tasks that only read information may run when you ask for them without a separate approval, and pages you ask Loresis to remember are re-read daily until you remove them. Background work that does not act in your name, such as syncing mail, indexing, refreshing dashboards and preparing summaries, runs automatically.
Pre-approved actions. If you switch on automatic handling for a category of actions, you approve in advance every action in that category until you switch it off. Use it only where an unreviewed action is acceptable to you.
8. Meetings and recordings
The Loresis notetaker joins video meetings as a visible participant named after you (for example “Anna’s Loresis Notetaker”), records audio and video, and produces a transcript and summary for your workspace.
When you connect Google Calendar or Outlook, the notetaker is switched on and joins the meetings on that calendar that you haven’t declined. You can pause it, or disconnect it on Connect, at any time.
When you connect a calendar, we ask whether to turn the notetaker on. If you do, it joins the meetings on that calendar that you haven’t declined until you pause or disconnect it.
The notetaker joins only the meetings you choose.
You are responsible for recording lawfully. Before a meeting is recorded you must tell participants and obtain any consent the applicable law requires; some jurisdictions require consent from all participants. Remove the notetaker if anyone objects. Do not record where recording is prohibited. A ready-made notice is in our AI & Recording Notice.
The notetaker also posts a short recording notice in the meeting chat when it joins.
9. AI output
Loresis uses AI models to read, summarise and generate content. AI output can be wrong, incomplete or out of date, and can misread the meaning or tone of a message. Dashboards and calculations are produced by generated code over your data and should be checked before you rely on them. Output is not legal, financial, medical or other professional advice. You decide what to rely on and what to send. Results from web search come from third-party websites that we do not control.
10. Your content
“Your Content” means everything you or your connected accounts provide to the Service, together with the output generated for you. As between you and us, you own Your Content. You grant us a limited, worldwide licence to host, copy, process, transmit and display Your Content only to provide, secure and support the Service for you, as described in the Privacy Policy and, for organisations, the DPA.
We do not use Your Content to train or fine-tune AI models, and we use AI providers only on terms that do not allow them to train on it.
We do not use Your Content to train or improve AI models unless you explicitly choose to share specific content with us for that purpose.
We may use de-identified content to improve Loresis’s own prompts and skills. You can opt out in Settings or by emailing us. We never let AI providers train on Your Content.
If you give us feedback, we may use it without obligation to you.
11. Sharing and illegal content
If you share a dashboard, anyone with its link can view its latest saved version and data, including later refreshes and your name, until you stop sharing. You are responsible for what you share and with whom.
Anyone can report content they believe is illegal to . Please include the link, an explanation and your contact details. We review reports promptly and with care, may disable a link or remove content, and will tell the affected user what we did and why, unless the law prevents us. That user can contest the decision by replying to us. This address is also our single point of contact for authorities and users under the EU Digital Services Act; we communicate in English.
12. Acceptable use
You must follow the Acceptable Use Policy. We may remove content or suspend features that breach it.
13. Fees
The Service is currently free of charge during early access. If we introduce paid plans, we will announce them at least 30 days in advance. You will not be charged unless you choose a paid plan and accept its price. Paid plans will be billed through .
13. Fees
The Service is provided free of charge. We may introduce paid features in the future under updated terms that you will be asked to accept.
13. Fees and payment
Paid plans are billed in advance on a basis through , which acts as the merchant of record and reseller of the Service and whose buyer terms also apply to your purchase. Subscriptions renew automatically until you cancel. You can cancel at any time in your account, and cancellation takes effect at the end of the current billing period.
Fees are non-refundable, except where the law requires a refund or where these Terms say otherwise.
If you are not satisfied, you can request a full refund of your first payment within 14 days of it.
If you cancel, we refund the unused part of the prepaid period on a pro-rata basis.
We will give you at least notice of a price increase. It applies from your next renewal, and you can cancel before then.
Prices exclude VAT and other taxes, which are added where applicable. Business customers in the EU with a valid VAT number are invoiced under the reverse-charge mechanism.
Prices include all applicable taxes.
EU/UK consumers. You have a 14-day right to withdraw from a paid subscription. If you ask us to start the Service during that period, you acknowledge that you will pay for the part of the period already provided.
14. Privacy and confidentiality
Our Privacy Policy explains how we handle personal data. When an organisation provides Loresis to its people, our Data Processing Agreement applies and we process that workspace’s personal data as its processor. We treat Your Content as confidential and disclose it only as these Terms and the Privacy Policy allow.
15. Suspension and termination
You can stop using the Service and ask us to delete your account at any time by emailing . We may suspend access immediately where it is necessary to protect the Service, users or third parties, to stop unlawful use or a breach of the Acceptable Use Policy, or where the law requires it. In other cases we will give notice first where reasonable. We may end the Service for everyone with at least 30 days’ notice.
After an account is closed, we delete its data , as described in the Privacy Policy. Before deletion, you can ask for an export of your data.Before deletion, you can export your data in Settings. Disconnecting a single source stops future access but does not delete content already indexed. Ask us if you want that content deleted.
16. Disclaimers
To the extent permitted by law, the Service is provided “as is” and “as available”. We do not promise that it will be uninterrupted, error-free or fit for a particular purpose, or that AI output will be accurate. We are not responsible for third-party services, networks or connected accounts.
17. Limitation of liability
To the extent permitted by law: (a) neither party is liable for indirect or consequential loss, lost profits, revenue, goodwill or data; and (b) our total liability arising out of or relating to the Service or these Terms is limited to . Nothing in these Terms limits liability for fraud, intentional misconduct or gross negligence, death or personal injury caused by negligence, or any liability that cannot lawfully be limited, including your statutory rights as a consumer.
18. Indemnity
You will defend and indemnify us against third-party claims arising from Your Content, your connected accounts, actions you approved, your recordings or your breach of these Terms or the law.
If you are on a paid plan, we will defend and indemnify you against third-party claims that the Service itself, as we provide it, infringes their intellectual property rights.
19. Changes
We may update these Terms. For material changes we will notify you by email or in the product at least before they take effect, and may ask you to accept them again. If you do not agree, stop using the Service before the effective date, and we will refund any prepaid fees for the unused period. Continued use after the effective date means you accept the change.
20. Governing law and disputes
These Terms are governed by , without regard to conflict-of-law rules. First contact us at . Both parties will try in good faith to resolve the dispute within 30 days.
If that fails, disputes go exclusively to the competent courts of the Republic of Cyprus.
If that fails, the dispute will be finally resolved under the Rules of Arbitration of the International Chamber of Commerce by one arbitrator, with the seat of arbitration in Nicosia, Cyprus, in English.
If you are a consumer, you may also bring proceedings in the courts of your country of residence, and you keep the mandatory protections of its law.
21. General
We may assign these Terms in connection with a merger, acquisition or sale of assets; you may not assign them without our consent. Neither party is liable for delays caused by events beyond its reasonable control, including war and martial law, attacks on energy infrastructure and the resulting power outages, cyberattacks, and failures of providers or networks. If a provision is unenforceable, the rest remains in effect. Not enforcing a provision is not a waiver. These Terms, together with the documents they reference, are the entire agreement on their subject. We will not use your name or logo without your written permission.We may name you as a customer unless you ask us not to.
These Terms are also published in UkrainianGreek. If the versions differ, the English version prevails, unless the law requires otherwise for consumers.
22. Contact
, , Cyprus. Email: . Privacy: .
Privacy Policy
Effective · Version 1.0 · Replaces the earlier connect.loresis.ai and loresis.ai pages
In short. We read what you connect so we can do what you ask. We don’t sell data, show ads or track you across the web. Nobody trains AI on your content. Outgoing messages and calendar changes wait for your approval. You can disconnect anything, and ask us to export or delete everything.
1. Who is responsible
, , registration number , registered office (“Loresis”). Privacy contact: . We are established in the EU, and our lead supervisory authority is the Commissioner for Personal Data Protection of the Republic of Cyprus.
- Your own account. If you sign up yourself, Loresis is the controller of your account data and of the content processed for you.
- Organisation workspaces. If an organisation provides Loresis to you, that organisation is the controller and Loresis processes data on its behalf under our Data Processing Agreement. Direct your requests to your organisation; we will help it respond.
- Other people. Your connected accounts contain information about people who don’t use Loresis. Section 9 explains how we handle it.
2. What we collect and why
Our Google connection also requests access to your contacts, other contacts, addresses, birthday and phone numbers. We currently do not read these.
We do not collect passwords for connected websites, payment card data, precise location or browsing history. We do not use your data for advertising, sell it, or share it for cross-context behavioural advertising.
3. How AI is used
To answer a request, Loresis sends the relevant parts of your content to AI models. Text, indexing, summaries and web search go to Anthropic (Claude). Voice conversations go to OpenAI. Browser tasks go to Browser Use and the models it runs. Meeting audio is transcribed by Recall.ai’s speech-to-text.
We use these providers under business terms that make them our processors and do not allow them to train models on your content.
Text processing currently runs through an Anthropic Claude account whose model-improvement setting is switched off. Anthropic may keep inputs and outputs for a limited period for safety and abuse monitoring, under its own terms.
We do not use your content to train or fine-tune AI models.
We use your content to improve AI only if you explicitly share specific content with us for that purpose.
We may use de-identified content to improve Loresis’s own prompts and skills. You can opt out at any time. AI providers never train on your content.
Loresis makes no decisions that produce legal or similarly significant effects on you based solely on automated processing.
4. Who receives data
- Service providers (subprocessors) that host, sign you in, connect your accounts, run AI models, record meetings or run browser tasks, each receiving only what its function needs. See the subprocessor list.
- The services you connect, when you approve an action, such as a recipient of an email you approve.
- People you share with: anyone holding a dashboard share link sees that dashboard, its data and your name.
- Authorities, when the law compels us. We review each request and disclose only what is legally required.
- A successor in a merger or acquisition, under this policy.
5. Where data is processed
Your workspace and its backups are hosted by Hetzner in Germany, inside the EU. Several providers process data in the United States: Anthropic, OpenAI, WorkOS, Composio, Recall.ai (US West region) and Browser Use. For these transfers we rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses (with the UK Addendum for UK data).
Some of our team members who operate and support the Service work from Ukraine and may access data there when needed for those tasks. Ukraine does not have an EU adequacy decision, so this access is covered by the Standard Contractual Clauses and strict confidentiality obligations.
For users in Ukraine, we also comply with the Law of Ukraine “On Personal Data Protection”.
6. How long we keep data
- Workspace content (email, calendar, meetings, chats, files, knowledge, dashboards, drafts) is kept while your account exists. Disconnecting a source stops new access but keeps what is already indexed until you delete it or ask us to.
- Meeting recordings: transcripts and summaries live in your workspace; recordings held by Recall.ai are kept only as long as needed to produce them. [confirm Recall retention setting]
- Account closure: we delete your workspace .
- Inactive accounts:
- Backups are taken every 6 hours, overwritten on a rolling basis and kept for no more than 7 days.
- Logs are rotated and kept for no more than 30 days.
7. Your rights
You can ask to access, correct, delete, restrict or export your personal data, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time. Email ; we reply within one month. We provide exports in machine-readable formats (JSON, Markdown, original files).You can also export your data yourself in Settings.
- You may complain to the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy), or to the data protection authority where you live or work (in the UK, the ICO).
- In Ukraine you have the rights in Article 8 of the Law “On Personal Data Protection” and may complain to the Ukrainian Parliament Commissioner for Human Rights.
- US residents: we do not sell or share personal information for cross-context behavioural advertising. Depending on your state, you may have rights to know, delete and correct. Use the contact above. We will not discriminate against you for exercising them.
8. Recordings
The notetaker joins as a visible participant named after the Loresis user. The user who brings it is responsible for telling participants and obtaining any consent the law requires. If you were recorded and want the recording or transcript deleted, write to .
9. If you don’t use Loresis
We may hold information about you because a Loresis user connected an account you correspond with, invited you to a meeting, or chats with you. This can include your name, email address, the messages you exchanged, meeting recordings and transcripts, and AI-written notes about your role and communication style. We process this on behalf of the user, or for their legitimate interest in managing their own communications, and only within their private workspace. We never use it to contact you, never combine it across workspaces and never sell it. You may object or ask for deletion at . We will delete the AI-written notes about you and, where the law requires, the underlying data, or pass your request to the account holder where they are the controller.
9. If you don’t use Loresis
Information about you may be processed because a Loresis user corresponds or meets with you. Contact to object or request deletion.
10. Google, Microsoft and Chrome data
Google. Loresis’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the user-facing features described above. We do not use it for advertising, do not sell it, and do not use it to develop, improve or train generalised AI models. Humans read it only with your consent, for security, or where the law requires.
Microsoft. We apply the same limits to data from Microsoft accounts (Outlook mail and calendar, Teams).
Chrome extension. Loresis Browser Connect transfers only the cookies of the websites you select, to your own workspace and private Browser Use profile. It does not monitor browsing or sync later changes. Its use of data follows the Chrome Web Store User Data Policy, including Limited Use.
11. Security
See the security overview. If a breach affects your personal data, we will notify you , and notify the regulators where the law requires.
Staff access. Our staff do not read your workspace content except at your request, to investigate security incidents or abuse, or where the law requires.
Staff access. Our staff may read workspace content only at your request, to investigate security incidents or abuse, to diagnose failures of jobs you ran, or where the law requires. Every such access is logged.
12. Cookies
We use only the cookies needed to sign you in and keep you signed in. See the cookie notice.
13. Children
Loresis is not for anyone under , and we do not knowingly collect their data.
14. Changes
We will notify you of material changes by email or in the product at least before they apply. The effective date is shown at the top.
Data Processing Agreement
Effective · Version 1.0 · Applies when an organisation (the “Customer”) provides Loresis to its people
You answered “individuals only”, so this DPA would be published but rarely used. Keep it ready for the first company customer.
1. Parties and roles
This DPA forms part of the Terms between the Customer (controller) and , (“Loresis”, processor). It applies to personal data that Loresis processes on the Customer’s behalf in providing the Service (“Customer Personal Data”). It is intended to meet Article 28 GDPR, Cyprus Law 125(I)/2018 and the UK GDPR.
2. Instructions
Loresis processes Customer Personal Data only on the Customer’s documented instructions. These are the Terms, this DPA, the Customer’s configuration of the Service, and the requests its users make in it. Where Union or Member State law requires otherwise, Loresis will inform the Customer before processing unless that law forbids it. Loresis will tell the Customer if it believes an instruction infringes data protection law.
3. Confidentiality
Persons authorised to process Customer Personal Data are bound by confidentiality, and access is limited to what their role needs.
4. Security
Loresis implements the measures in Annex II and may update them, provided the overall level of protection is not reduced.
5. Subprocessors
The Customer authorises the subprocessors listed in Annex III. Loresis imposes data-protection obligations on each subprocessor that are no less protective than this DPA, and remains responsible for their performance. Loresis will give at least notice of a new subprocessor by email and on the subprocessor page. The Customer may object on reasonable data-protection grounds. If the parties cannot resolve the objection, the Customer may terminate the affected Service and receive a refund of prepaid fees for it.
6. Assistance
Taking into account the nature of the processing, Loresis helps the Customer respond to data subjects’ requests, carry out data protection impact assessments and consult supervisory authorities. Requests received directly are forwarded to the Customer without undue delay.
7. Personal data breaches
Loresis will notify the Customer of a personal data breach affecting Customer Personal Data , with the information the Customer needs to meet its own obligations, and will take reasonable steps to contain it.
8. Deletion and return
At the end of the Service, Loresis deletes Customer Personal Data , unless the law requires it to be kept. On request made before deletion, Loresis returns the data in a machine-readable format.
9. Audits
Loresis makes available the information necessary to demonstrate compliance with this DPA. Once a year, or after a breach, the Customer may carry out an audit, at its own cost, with 30 days’ notice. The audit is conducted remotely where possible, by an auditor bound by confidentiality, and must not access other customers’ data.
10. International transfers
Loresis is established in the EU (Cyprus) and hosts Customer Personal Data in the EU (Germany). Loresis transfers Customer Personal Data outside the EEA only to the subprocessors listed in Annex III and to its own personnel working from Ukraine, and only under an adequacy decision (including the EU–US Data Privacy Framework) or the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914, Module 3) together with supplementary measures where needed. If the Customer is established outside the EEA, the parties will agree on the appropriate SCC module on request.
11. Liability and precedence
Liability under this DPA is subject to the limits in the Terms, except where the law forbids it. If this DPA conflicts with the Terms, this DPA prevails for the processing of personal data. If the SCCs conflict with either, the SCCs prevail.
Annex I · Details of processing
- Subject matter and duration: provision of the Service for the term of the Customer’s use, plus the deletion period.
- Nature and purpose: collection from connected accounts, storage, indexing, AI analysis and summarisation, generating drafts and dashboards, recording and transcribing meetings, and executing actions the Customer’s users approve.
- Data subjects: the Customer’s users; their correspondents, meeting participants, chat members, contacts and colleagues; people named in connected business systems.
- Categories of data: identification and contact details, communications content and metadata, calendar data, audio and video recordings and transcripts, code-collaboration metadata, business records from connected systems, AI-generated profiles and notes, and any other data in connected sources. Special categories are not targeted, but may appear in communications.
Annex II · Technical and organisational measures
As described in the security overview, which forms part of this DPA.
Annex III · Subprocessors
As listed on the subprocessor page on the date the Customer accepts this DPA, as later updated under section 5.