1. Data and purposes
| Category | Data | Purpose | When |
|---|---|---|---|
| Account | Email, internal account identifier, sign-up and sign-in time; name and profile image if Google sign-in is used | Identity, sessions, and account security | Sign-up and sign-in |
| Lecture use | Classroom and lecture titles, transcripts, questions, answers, sources, and recorded time | Save and review lectures; answer from lecture context | Recording and questions |
| Lecture materials | Text and search index extracted from uploaded lecture materials, and the original PDF file | Use material content and citations in answers, show material pages in lecture notes | Material upload |
| Voice | Microphone audio stream; for online lectures, the audio stream of the browser tab you choose | Live speech recognition | While recording |
| Personal AI | Selected provider and model; API key entered by the user | Use the AI provider selected by the user | When selected |
| Service use | IP address, browser and device data, access time, cookies, error and security logs | Security, abuse prevention, and troubleshooting | Automatically during use |
| Payment | Product, amount, payment, subscription and refund status, customer and transaction identifiers supplied by the payment provider, and credit balance | Billing, subscriptions, credits, and refunds | Trial, payment, and refund |
| Support | Email, request, and response history | Support and dispute handling | When support is contacted |
We do not sell personal data or use lecture audio, transcripts, or questions to create advertising profiles.
2. Retention
- Account, classroom, and lecture records: until deleted by the user or the account is closed.
- Saved personal AI key: until removed by the user or the account is closed.
- Access and security logs: 3 months, or until an active security investigation ends.
- Support and dispute records: 3 years after resolution.
- Advertising-display records: 6 months where Korean law requires them.
- Contract, cancellation, payment, and service-supply records: 5 years where Korean law requires them.
Records required by law are separated and used only for that legal purpose. Account deletion and backup propagation may take up to 30 days.
3. Storage and audio
Classroom names, lecture titles, transcripts, questions, and answers are linked to the account. Relevant earlier lectures in the same classroom may be used to answer a question.
Lecue keeps the original PDF of uploaded lecture materials in private storage alongside the extracted text and search index, so lecture notes can show the user the relevant material page. The original opens only through a short-lived signed URL issued to the owner. Non-PDF materials are not kept as originals. Deleting a material also deletes its original file, extracted text, and index.
Microphone audio, and for online lectures the audio of the browser tab you choose yourself, is streamed to a speech-recognition provider. Lecue does not separately store the original audio. The shared tab’s screen is displayed locally inside Lecue so you can watch while asking questions. It is never sent to Lecue’s servers or anyone else, nor stored. The chosen tab’s title and URL are not stored either.
A personal AI key is stored only if the user chooses encrypted account storage. Otherwise it is used only in the current browser tab. A saved key is not redisplayed or written to application logs, and the user may replace or delete it at any time.
4. Disclosure and payment data
We do not sell or disclose personal data to unrelated third parties without consent or another lawful basis. The providers below process data to deliver the Service.
Paddle independently handles checkout, sale, tax, recurring billing, and refunds. Lecue receives transaction results and identifiers but does not store full card numbers.
Depending on the user's location, our legal bases may include performance of a contract, consent, compliance with law, and legitimate interests in security and reliable operation where permitted.
5. Service providers and international transfers
Data is transferred over encrypted networks when the relevant feature is used. A user can avoid an optional transfer by not selecting that feature; refusing a transfer needed for a core function makes that function unavailable.
| Recipient | Purpose and data | Location, time, and retention |
|---|---|---|
| Supabase, Inc. | Account authentication and service data storage: email, account data, lecture records, uploaded lecture materials, and an optionally saved encrypted API key | Republic of Korea (AWS Seoul region) / at sign-up and storage / until deletion or account closure |
| Soniox, Inc. | Live speech recognition for Korean lectures: microphone audio, chosen-tab audio | United States / while recording / provider retention policy |
| Deepgram, Inc. | Live speech recognition for English lectures and uploaded-recording transcription: microphone audio, chosen-tab audio, uploaded recordings | United States / while recording or transcribing / provider retention policy |
| OpenAI, L.L.C. | AI answers, necessary web search, and relevant lecture retrieval: transcript, question, and related lecture records | United States and other disclosed processing locations / when asking / provider policy and account settings |
| Anthropic, PBC | User-selected AI answers: transcript, question, and personal API key | United States and other disclosed processing locations / when selected / provider policy and account settings |
| Google LLC | Google sign-in or user-selected AI answers: account data or transcript, question, and personal API key | United States and other disclosed processing locations / when selected / provider policy and account settings |
| Paddle entities | Checkout, recurring billing, tax, refunds, and fraud prevention: name, email, billing, and purchase data | United Kingdom, United States, Canada, and other disclosed locations / at payment / as required for the transaction, law, and disputes |
A personal AI provider's terms, privacy policy, and user account settings also apply when that connection is used.
6. Cookies
Essential authentication cookies maintain sign-in and protect sessions. Blocking them may prevent account functions from working. We currently use no targeted-advertising cookie or third-party advertising tracker. Future analytics will be disclosed here with its data and opt-out method.
7. Your rights
Subject to applicable law, users may request access, portability, correction, deletion, restriction, withdrawal of consent, and account closure.
- Use available account controls or contact the privacy address below.
- We may verify identity and will respond within the legally required period.
- If law requires retention or another person's rights would be harmed, we may limit a request and explain why.
8. Deletion and security
Data is deleted when its purpose or retention period ends. Electronic records are deleted using methods intended to prevent practical recovery, and legally retained records are separated and access-restricted.
- Encryption in transit and at rest, with least-privilege access.
- Separate protection for credentials and secrets.
- Protected access logs, security monitoring, and updates.
- Purpose and security restrictions for service providers.
9. Children
We do not accept accounts from children under 14 because the Service has no verified parental-consent flow. A higher minimum age applies where local law requires it.
10. Contact, complaints, and changes
Privacy inquiries: support@lecue.app
Users in Korea may also contact the privacy portal, the Korea Internet & Security Agency privacy center at 118, or the Personal Information Dispute Mediation Committee at 1833-6972.
We normally announce changes at least 7 days before they take effect. Material changes are announced at least 30 days in advance, and consent is obtained where required.