Legal

Privacy Policy

We built Lorenta on synthetic data precisely so we'd never have to write a privacy policy full of uncomfortable exceptions. Here's what that actually means for you.

Last updated: June 1, 2025  ·  Effective globally · GDPR · KVKK · EU AI Act

TL;DR — The Version You'll Actually Read

  • Your business idea is processed for simulation only. We don't read it, sell it, or train on it.
  • We collect email, usage data, and payment status. Nothing exotic.
  • You can delete your account and data at any time. For real.
  • We're GDPR, KVKK, and EU AI Act compliant — not as a marketing claim, but as a design choice.

1. Who We Are

Lorenta Technologies operates Lorenta, an AI-powered market simulation platform. We're based in EU / TR and subject to applicable data protection laws including the EU General Data Protection Regulation (GDPR), the Turkish Personal Data Protection Law (KVKK — Law No. 6698), and the EU AI Act.

Data Controller: Lorenta Technologies. Contact: info@lorentaidea.com

2. What 'Synthetic Data' Means for You

Lorenta's 100 simulated personas are fully synthetic — they are not scraped from real people's profiles, opinions, or behavioral data. They are statistical constructs trained on aggregated market research patterns. No real human's identity underpins them.

When you submit a business idea for simulation, our system processes it to generate responses from these personas. Your idea is used transiently during simulation. We do not use it to train AI models. We do not share it with third parties. We do not read it for competitive intelligence.

In plain terms: your idea goes in, feedback comes out, and we don't keep it around to do anything shady with it.

3. What Data We Actually Collect

Account & Identity Data

  • Email address (required for account creation and login)
  • Name (optional — you can use a pseudonym)
  • Password (stored as a one-way hash — we cannot see it)

Usage Data

  • Simulation inputs and outputs (temporarily processed; not stored longer than session unless you explicitly save them)
  • Feature interactions, session duration, error logs
  • Device type, browser, and approximate geographic region (country level)

Payment Data

  • Billing is handled by a third-party processor (Stripe). We store only your subscription tier and billing status — not your card details.

What We Do NOT Collect

  • Your competitors' data, your cap table, your revenue figures — we don't ask, we don't want it
  • Biometric data
  • Sensitive personal data as defined under GDPR Article 9 and KVKK Article 6

5. EU AI Act Compliance

Lorenta's simulation engine is classified as a general-purpose AI system used for market research and decision support — not in a high-risk category as defined by EU AI Act Annex III.

Simulated persona feedback is explicitly synthetic and labeled as such. No output should be construed as a legal, financial, or clinical recommendation.

We maintain technical documentation and risk assessments in line with Article 11 requirements and update them as our system evolves.

6. How Long We Keep Your Data

  • Account data: For the lifetime of your account, plus 30 days after deletion request.
  • Simulation inputs/outputs: Deleted at session end unless you explicitly save them to your dashboard.
  • Payment records: Retained for 7 years for accounting and tax compliance.
  • Usage logs: Anonymized after 90 days.

7. Your Rights

Under GDPR and KVKK, you have the right to access, correct, delete, or port your personal data. You can also object to or restrict processing, and withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email us at info@lorentaidea.com. We'll respond within 30 days (GDPR) or the applicable KVKK timeframe. We won't make it difficult. We won't ask for unnecessary proof. We'll just do it.

8. International Data Transfers

If your data is transferred outside the EU/EEA or Turkey, we ensure appropriate safeguards are in place — Standard Contractual Clauses (SCCs) for EU transfers, and equivalent measures for other jurisdictions — in line with GDPR Chapter V and KVKK Article 9.

Our infrastructure providers (cloud hosting, CDN) are contractually bound to handle your data in compliance with applicable law.

9. Third-Party Services

We use a limited set of sub-processors: cloud infrastructure (hosting and storage), payment processing (Stripe), and error monitoring (anonymized crash logs). We do not use advertising networks. We do not sell data to data brokers. We do not integrate with social media platforms for tracking.

A full list of sub-processors is available upon request at info@lorentaidea.com.

10. Security

We use TLS in transit, AES-256 encryption at rest, access controls, and regular security audits. No system is perfectly impenetrable — but we operate like a company that actually cares about this, not one that discovers a breach two years after the fact.

In the event of a data breach that poses a risk to your rights, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay.

11. Children's Privacy

Lorenta is not intended for individuals under 16 years of age (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from minors. If you believe we have, contact us immediately.

12. Changes to This Policy

If we make material changes, we'll notify you via email or an in-app banner at least 14 days before they take effect. Cosmetic or legal clarifications may be updated without notice — we'll always post the updated date below.

Last updated: June 1, 2025

13. Questions & Complaints

Email us at info@lorentaidea.com. If you're in the EU and feel we haven't resolved your concern, you have the right to lodge a complaint with your local supervisory authority (e.g., CNIL in France, BfDI in Germany, KVKK Board in Turkey).

This policy was written to be understood — not to obscure. If something is unclear, ask us directly. We'd rather answer a question than have you guess.