Privacy Policy

1. Data controller

LionIQ
Tzeni Vlachopoulou – Sole Proprietorship
Akadimias 16, Pefka, Thessaloniki, 57010, Greece
VAT No.: 161763303
Phone: +30 698 875 9349
Email: info@lioniq.gr

Tzeni Vlachopoulou is the data controller for data submitted through lioniq.gr unless stated otherwise.

2. Scope and categories of data

This policy covers website visits, Leo, Business Scan, contact forms and related LionIQ functions. A contact request may include name, email, phone, business and message. Where it originates from Leo or Business Scan, it may include relevant context, Scan answers, result or score, a session identifier, user agent and a hashed technical identifier derived from the IP address.

Leo processes the full message entered by the user and Leo responses. Its temporary server memory exists only in application memory, retains up to 6 messages in total (user messages and Leo replies combined). On an AI request, the current user message is sent in addition to up to 6 previous messages. History expires after 2 hours of inactivity and is removed at the next 15-minute cleanup, or sooner on access or application restart.

3. Leo and external AI provider

Some Leo responses are provided using DeepSeek, an external artificial-intelligence provider. This may involve sending the current message, up to 6 previous messages, language, page, service and path context, LionIQ knowledge context, inferences about the visitor's business or needs and, where relevant, completed Business Scan context.

LionIQ does not automatically add name, email, phone, IP address, hashed IP, user ID or session identifier to the request sent to the AI provider. If you voluntarily type personal information into the chat, it becomes part of your message and may be sent to DeepSeek. Do not enter sensitive data, passwords, payment information, health data or unnecessary third-party data.

Using DeepSeek may involve processing or transfer of data outside the European Economic Area. International transfers to DeepSeek are covered by a suitable transfer mechanism and appropriate safeguards under Chapter V GDPR. LionIQ limits the data sent to the provider to what is necessary for Leo to operate and uses non-persistent or stateless response settings for API calls where supported.

LionIQ does not use Leo conversation transcripts to train its own model. Provider-side data retention and processing for security or model improvement are governed by the applicable API terms and account settings. LionIQ's settings do not guarantee zero retention by DeepSeek or exclude all model-improvement processing by the provider.

4. Business Scan

Business Scan is deterministic. /api/leo-scan-result does not call DeepSeek and does not permanently store full answers, score or recommendation on the server. Its data remains in sessionStorage until the Scan is reset or the browser session ends. A completed Scan may later be used as context for Leo or form part of a contact request you submit.

5. Usage analytics and technical data

LionIQ uses optional, pseudonymised first-party usage analytics through /api/leo-event only while analytics consent is enabled. Normal event emission is gated by the browser's consent choice, and the server stores an allowed event only with an active, temporary analytics grant it has issued. The grant is held in localStorage as lioniqAnalyticsGrant, separate from the functional leoSessionId, and is not included in analytics event records. Data is limited to language, page type, device category, interaction or action identifiers, timing or progress categories, and outcome. It does not store full chat content, Leo responses, full Business Scan answers, Scan score, recommendation text, email, phone or contact-message content. The current production code does not load Google Analytics or Google Tag Manager. Withdrawing consent stops future analytics emission during normal site use, removes the active grant from the browser and attempts to revoke it on the server; it does not automatically delete previously stored events.

IP addresses are used temporarily in memory for request rate limiting, with a window of about 15 minutes. Analytics events do not store IP or hashed IP. The application code does not include a general HTTP access logger; console output for errors and operational incidents may be generated for security, abuse prevention, diagnosis and resolution of technical issues, and availability.

6. Purposes and legal bases

For a contact, quote or commercial request, processing takes place where necessary for steps you request before entering into a contract, under GDPR Article 6(1)(b). Optional Usage analytics rely on your consent under Article 6(1)(a). Security, abuse prevention, request rate limiting and operational integrity rely on LionIQ's legitimate interests under Article 6(1)(f). Legal or accounting obligations may require processing under Article 6(1)(c), where applicable.

7. Service providers and international transfers

Technical providers include Contabo for VPS hosting in Nuremberg, Germany/EU, Enartia/Papaki for SMTP services and contact-request or lead notification emails, and DeepSeek for certain Leo responses. Processing by DeepSeek is described in section 3.

Enartia, through its Papaki brand, acts as a data processor when processing personal data on behalf of LionIQ in the context of the email service, under the Email Service Terms and the applicable Data Processing Agreement (DPA).

International transfers

Transfers of personal data outside the EEA take place only under GDPR Chapter V, through an adequacy decision or appropriate safeguards under Article 46, as applicable. Information about the applicable safeguards can be requested at info@lioniq.gr.

8. Retention

Backups and snapshots may temporarily contain data that existed in active systems. They are used only for security and disaster recovery, with restricted access. They are retained according to the backup rotation cycle and security requirements and are automatically deleted or overwritten at the end of the cycle. Data deleted from active systems may remain temporarily in backups until that cycle expires.

9. Providing data

Use of Leo, Business Scan and contact forms is optional. You do not have to provide personal data beyond what is necessary for the function you choose. If you do not provide the contact details required for a relevant request, we may be unable to reply to or process that request.

10. Security and automated processing

We use reasonable technical and organisational measures, without an absolute guarantee of security. Leo and Business Scan provide automated information or recommendations, not decisions with legal or similarly significant effects.

11. Your rights

You may request access, rectification, erasure, restriction, portability where applicable, objection or withdrawal of consent at info@lioniq.gr. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. You may also lodge a complaint with the Hellenic Data Protection Authority.

12. Changes

We may update this policy when services, providers, retention periods or legal information change.