Controller: Fiveon Group AB, org.nr 559220-9414, Gothenburg, Sweden. Contact for privacy requests: john@psymgmt.com.
Our registered address is available in the Swedish company register (Bolagsverket).
What we collect
- Account: email address, username, display name, password (hashed).
- Profile content: bio, avatar, banner, favorite films, pinned reviews, guestbook, theme choices — whatever you put in your profile.
- Activity: film logs (score, review, watched date, tags), watchlist, lists, likes, comments, follows.
- Uploads: images you upload for your avatar/banner.
- Technical: coarse request logs (IP, user agent, timestamps) used only for security and abuse prevention.
- Billing (when subscribed): see Payment data below.
- AI usage (Stand tier): see AI recommendations below.
We do not use ad tracking. We do not sell your data.
Where your data lives
Application data (accounts, profiles, logs, uploads) is stored with Supabase (our hosting/database/auth/storage processor). Film metadata is fetched from TMDB; no personal data beyond your search queries and film ids is sent to them. See Processors for the full list.
Legal bases (GDPR)
- Contract (Art 6(1)(b)) — to provide the Service you signed up for, including AI recommendations you actively use.
- Legal obligation (Art 6(1)(c)) — to keep accounting records required by law.
- Legitimate interest (Art 6(1)(f)) — security, abuse prevention, service integrity.
- Consent (Art 6(1)(a)) — where applicable (e.g. optional features you opt in to).
Payment data
Paid subscriptions are sold and processed by Lemon Squeezy, LLC (a Stripe company) acting as merchant of record — Lemon Squeezy is the seller of record for your purchase and handles payment data and applicable VAT/sales tax. Lemon Squeezy acts as an independent controller for payment data and, to the extent applicable, our processor. We never see or store your full card details, which go directly to Lemon Squeezy's PCI-compliant environment (card processing is handled by Stripe under Lemon Squeezy's merchant-of-record setup). We receive limited billing information — your name, email, plan, transaction id, and country for VAT purposes. Legal basis: performance of contract (Art 6(1)(b)) and, for kept accounting records, legal obligation (Art 6(1)(c)).
AI recommendations data
If you use AI recommendations (when available), we send relevant parts of your film history — titles, scores, and tags — to our AI provider, Anthropic (USA), to generate your picks. We do not send your email, name, or contact details. The provider processes this data only to produce your recommendations for that request and does not use it to train their models (contractually confirmed with our provider). You can avoid this processing entirely by not using the feature. Legal basis: performance of contract / your request for the feature.
We also store a small server-side counter of your daily and monthly AI usage to enforce fair-use limits (see the Terms). This counter contains only your user id, a date, and a number — no film history content.
International transfers
Some processors — in particular our AI provider Anthropic (USA) — may process data outside the EU/EEA. Where that happens, transfers are protected by the EU Standard Contractual Clauses (SCCs) and, where applicable, the EU–U.S. Data Privacy Framework, together with equivalent technical and organisational safeguards. We select providers with data-processing agreements that reflect those safeguards.
Processors / subprocessors
We rely on the following processors to run the Service. This list may change; we'll announce material changes in-app.
- Supabase — hosting, database, authentication, storage.
- TMDB — film metadata. Only your search terms and film ids are sent; no personal data.
- Anthropic — AI recommendations (when available, and only if you use the feature).
- Lemon Squeezy — subscription payments, refunds, and merchant-of-record for paid tiers (when paid tiers are available).
Your rights
You have the right to:
- Access the data we hold about you.
- Correct inaccurate data.
- Erase your account and its data — use Settings → Delete account in the app.
- Export your data (portability).
- Object to or restrict certain processing.
- Lodge a complaint with the Swedish Authority for Privacy Protection (IMY).
Retention
Account and content data are kept for as long as your account exists. When you delete your account, most personal data is removed from live systems. However, records we are required to keep by law — in particular payment and invoice data under the Swedish Accounting Act (Bokföringslagen) — are retained for up to 7 years from the end of the applicable financial year, after which they are deleted. These records are not used for any other purpose.
Encrypted backups age out on a normal rotation schedule and are not restored except in disaster recovery.
Automated decision-making
AI recommendations suggest films but do not make any decision with legal or similarly significant effects about you. Article 22 GDPR (solely-automated decisions with legal/similarly significant effect) does not apply.
Cookies and local storage
We use essential cookies and local storage only, for authentication, session state, and to enforce AI usage/rate limits on the server. We don't use analytics, marketing, or third-party tracking cookies, so no cookie banner is required today — but you deserve to know.
Future-proof: If we ever introduce analytics or any non-essential cookies, we will ask for your consent first via a cookie banner, and this policy will be updated before that change goes live.
Age
Lemini is for people 13 and older (in line with Sweden's GDPR consent age). Accounts for anyone under 13 are not permitted and will be removed on notice.
Sharing
We share data only with the processors listed under Processors. We don't sell data to advertisers or brokers.
Contact
Privacy questions: john@psymgmt.com.
Fiveon Group AB, org.nr 559220-9414, Gothenburg, Sweden. Our registered address is available in the Swedish company register (Bolagsverket).
Last updated: 18 July 2026.