Privacy policy for the Linguini application

This policy governs the Linguini application at linguini.app, and applies to you if you hold an account in it. The website at www.trylinguini.com has a privacy notice of its own, which covers the site alone. Your acceptance of this policy is recorded against the document and the version named below.

Version 1 · in force since 22 September 2026

Who we are, and who decides what happens to your data

Leet Nordics AB (organisation number 559529-6301, Edla Sofias Gata 1, 134 50 Gustavsberg, Sweden) operates the Linguini application and is responsible for the account you hold in it: your profile, your sign-in, the consents you have given, and the records that keep the application secure.

You use the application as a member of a Community that an organisation, typically your employer or a body you belong to, has set up. That organisation decides what happens inside its Community: which conversations are held, which questions are asked, whether conversations are transcribed, what the anonymity threshold is, and how long its material is kept. For that material the organisation is the data controller and we process it on the organisation's instructions. Requests about what was said or asked in a Community go to that organisation; requests about your account come to us.

Questions about this policy and about your data reach us at support@trylinguini.com.

What we collect

Your account and profile: the e-mail address you sign in with, your first and last name, a job title where your organisation asks for it, and a profile picture if you add one. The e-mail address comes from the sign-in provider and is never edited by the application.

If you sign in with Google or Microsoft, we receive your e-mail address, your name and your profile picture from that account, and nothing else. We use them only to create and sign you in to your account and to show your name to the people you talk with. We never use them for advertising, never sell them, and never use them to train AI models.

Your membership: the role you hold in each Community, the Events you are registered for and attended, and the consents you have given, each recorded with the document and the version you accepted.

What happens in a conversation: in an Event, two people see and hear each other over video while they talk, and the conversation is transcribed where the organisation has turned transcription on. In a Ling conversation you speak with an AI voice, and what you say is transcribed as you speak. Written answers you give to questions are collected as text.

What the application makes of it: as a transcript or a written answer enters the analysis, names, e-mail addresses and telephone numbers in it are replaced by markers, your identity is replaced by a code that is different in every conversation and is never stored alongside your name, and times are rounded. The reports your organisation reads are built from this de-identified material alone, and any group too small to stay anonymous is withheld from every reader. The anonymity is a property of the analysis and the reports; in the conversation itself, the person you talk with knows who you are.

An audit record of actions taken in a Community, holding what was done and when, and the account that did it. It holds no names and nothing anyone said.

What leaves the application, and where it goes

Sign-in. WorkOS, Inc. establishes your session. It receives your e-mail address and your name, and, if you sign in with Google or Microsoft, it is the service that exchanges the sign-in with them. The application stores no password.

Conversations. LiveKit, Inc. carries the audio and video of a conversation while it runs and transcribes it. It is told no name, e-mail address or account; it routes the media and does not retain it.

Analysis. The transcripts and written answers, already de-identified, are sent to large language models reached through OpenRouter, Inc. to be read into themes and insights. Nothing identifying you is sent, no identifier of your organisation is sent, and neither the prompts nor the responses are stored by us or, under our agreement, used to train models.

E-mail. Resend, Inc. delivers the messages the application sends you: invitations, reminders and notices that a report is ready. It receives your address and the message. The messages carry no tracking.

Files. Pictures and media your organisation uploads, and recordings where an Event was recorded with the participants' agreement, are held in Amazon Web Services object storage in Ireland (eu-west-1), where the application and its database also run.

Each of these providers processes data on our instructions, under a written data-processing agreement.

Diagnostics: errors and traces

When you use the application, your browser sends us two kinds of diagnostic record: a record of a failure, when something in the application goes wrong, and a trace of the requests the application made on your behalf.

A failure record carries the kind of error, where in the application it happened — the pattern of the screen you were on, never the address of the page — and the identifiers of what you were working on, such as an Event, a Ling session or a Report. A trace carries which operations ran and how long each of them took.

Both go to a diagnostic store we run ourselves, reached over the application's own address rather than a third party's service.

A failure record is filed under your account identifier, so that a problem you report to us can be found. A trace is filed under a random session identifier minted for the browser tab you are working in: it lives only while that tab is open, and it is never tied to your account.

Nothing you say or write in a conversation is collected this way, nothing a screen showed you is collected, and no recording of your screen is made.

We keep traces for 7 days, and logs and failure records for 14 days, after which they are deleted.

Automated browsers are not collected from: these records describe people using the application.

Why we may use what we hold

To provide the application to you under the licence you accepted: your account, your sign-in, your memberships, and the conversations you take part in. This is processing necessary to perform our agreement with you.

To run and protect the application: the audit record, the diagnostic records, and the sign-in records. This rests on our legitimate interest in a service that works and that we can keep secure, and on your organisation's interest in knowing what was done in its Community.

To produce reports for your organisation from what was said, de-identified as described above. This is processing on your organisation's instructions, and its lawful basis is your organisation's to establish.

Where the application asks for your consent — to transcribe a conversation, to record one, or to take part in a Ling conversation — it records that consent with the document and version you saw. You withdraw a consent by asking us to erase your account, which removes the consent record with everything else.

We do not use what we hold about you for advertising, we do not sell it, and we do not use it to train AI models.

Who else processes it

The providers named above: WorkOS for sign-in, LiveKit for conversations, OpenRouter and the model providers it routes to for analysis, Resend for e-mail, and Amazon Web Services for hosting, the database and file storage.

Your organisation, which reads the reports and administers its Community, and the people you talk with in a conversation.

Nobody else, unless the law requires it of us.

We keep the list of our providers current here, and a change to it is a change to this policy.

How long we keep it

Your account, profile, memberships and consents: for as long as you hold the account.

The raw transcript of a conversation, before names were replaced: 7 days after it has been processed, then deleted.

A recording of an Event, where one was made: 12 months after the Event ended, and immediately if the Event is deleted.

A Ling conversation held in identified mode, where your organisation chose that mode and you were told: 24 months.

What you said once it is de-identified, and the reports built from it: for as long as the Event or Community it belongs to exists. By then it is no longer data about you.

Diagnostic records: traces 7 days, logs and failure records 14 days, as above.

The audit record: for the life of the Community it describes.

A retention period ends in deletion, never in hiding. Your organisation can shorten a period for its Community; it cannot lengthen one.

Where it is processed

The application, its database, its file storage and its diagnostic store run in Amazon Web Services in Ireland, in the European Union.

Three providers process data outside the European Union: WorkOS and Resend in the United States, and LiveKit, which routes media over the shortest path and does not retain it. Each transfer is covered by the European Commission's standard contractual clauses in our agreement with the provider, and WorkOS and LiveKit are also certified under the EU-US Data Privacy Framework. What reaches the language models is de-identified before it leaves.

Your rights

You can see and correct your profile in the application. Your e-mail address is changed through the sign-in provider's own page, which the application links to.

You can have your account erased. Ask us from the address you sign in with. Erasure removes your account, profile, picture, sign-in links, memberships, registrations, consents and any conversation held in identified mode, in one operation. What you said anonymously stays, because once de-identified it is not personal data about you and the reports built from it do not change. The audit record keeps what was done but no longer says who did it. If you are the only administrator of a Community, we will ask you to hand it to someone first.

You have the rights the GDPR gives you over the data we hold about you: to access it, to correct it, to have it erased, to restrict or object to its processing, and to receive it in a portable form. For anything your organisation controls, including what was said in its Community, the request goes to your organisation; if you send it to us, we will pass it on and tell you we have.

We answer within one month. You may complain to a supervisory authority; in Sweden that is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY). We would welcome the chance to resolve a concern first.

Changes to this policy

A changed policy is published here as a new version, and your acceptance is asked again and recorded against that version.

The version you accepted stays available at an address of its own, so that what you agreed to can always be read.

A change that affects what we collect or whom we share it with is announced in the application before it takes effect.

Contact

Questions about this policy go to support@trylinguini.com.