Privacy Policy

Effective 29 July 2026

1. Who is responsible

Lazy PA is operated by Lazy Cat Media OÜ, a private limited company (osaühing) registered in Estonia. For the personal data described in section 2 we are the data controller under the General Data Protection Regulation (EU) 2016/679.

• Contact: info@lazycat.media
• Registry code: 14537212
• Registered address: Sepapaja 6, Tallinn 15551, Estonia

We are a very small operation — a one-person shop. That is not a disclaimer, it is a fact that shapes what follows: there is no dedicated privacy team, and a request sent to the address above reaches the person who runs the service.

2. What we collect, and why

Lazy PA is an invite-only private beta. We collect only what the service needs to work.

Account data

Your email address, an optional display name and avatar, your time zone (measured from your browser so scheduled things happen at your local time), your interface preferences, and the credentials that sign you in — a password hash if you set one, and your passkey public keys if you enrolled any. We never store a password in readable form, and a passkey’s private key never leaves your device.

Lawful basis: performance of a contract (Art. 6(1)(b)) — we cannot give you an account without it.

What you put into the service

Your notes, tasks, projects, events, uploaded documents, voice recordings and their transcripts, your conversations with the assistant, and the long-term facts you ask it to remember. This is the substance of the product; it is your material and you direct what happens to it.

Lawful basis: performance of a contract (Art. 6(1)(b)).

Information about other people

When you mention someone, Lazy PA creates a contact record. It can hold their name, email address, phone number, employer, role, department, alternative names you have used for them, their relationships to other people you have recorded, and a log of the interactions you described. See section 3 — this is the part with obligations attached.

Material the system derives

To make search and recall work, we compute numerical representations (“embeddings”) of your text, and we record links between the things you mention — which note a fact came from, who was at which event. These are derived from your material and are deleted with it.

Technical and usage data

Server logs (including IP address) for security and debugging, and a deliberately small amount of usage telemetry stored in our own database:

That is the whole list. No content is recorded in telemetry — not your messages, not your search terms. There is no third-party analytics service of any kind, no advertising network, and no cross-site tracking.

Lawful basis: our legitimate interest in keeping the service secure and knowing whether its features are used at all (Art. 6(1)(f)).

3. Information you record about other people

This is the most important section in this document, and the one most likely to matter to you.

Lazy PA is built around recording things about the people you deal with. Those people are not our users. They have not signed up, and in most cases they will not know a record exists.

You decide who to record and what to write about them. Because you determine the purposes and the means of that processing, in data-protection terms you are the controller of those contact records and we act as your processor — we hold and process them on your behalf, on your instructions, and for no purpose of our own.

In practice that means:

• We process those records only to provide the service to you. We do not mine them, profile the people in them, sell them, or use them to build anything.
• You are responsible for having a proper reason to record what you record. If you use Lazy PA purely for your own personal or household purposes, GDPR generally does not apply to you at all (Art. 2(2)(c)). If you use it for work, it does — and you need a lawful basis, which for professional contact details is usually your legitimate interest.
• Please do not record special-category data — health, religion, political opinions, sexual orientation, trade-union membership, biometric or genetic data, or criminal-offence data — about anyone. The service is not designed for it and has no additional safeguards for it.
• If one of those people contacts us directly asking what we hold or asking us to erase it, we will not act on our own initiative on your data. We will pass the request to you and help you respond, because you are the controller. If they contact you, you can find, correct and delete any record from inside the app.

The sub-processors in section 5 also process this material, on the same terms; the list is a standing notice of them under Art. 28(2), and section 5 explains how to object.

4. Automated processing by AI models

Lazy PA sends what you write to a language-model provider so it can understand it, answer questions about your own material, and pull out things like tasks and names. This is automated, and it is the core of the product rather than an add-on.

It does not produce decisions with legal or similarly significant effects for anyone, so Art. 22 does not apply. The assistant suggests; you confirm. It can be wrong, and section 4 of the Terms says so plainly.

Your material is not used to train models — not ours, and not our providers’. We run no training or fine-tuning of any kind, and we use these providers through their business APIs.

5. Who else processes your data

We share personal data only with the providers needed to run the service. The current list is kept on its own page so it can be updated without reissuing this policy:

See the full sub-processor list →

In summary, that is OpenAI, Deepgram, Resend, DigitalOcean. We do not sell personal data, and we do not share it with advertisers or data brokers. We may disclose data if we are legally required to.

If you object to a new sub-processor, tell us at info@lazycat.media. Your remedy is to stop using the service and delete your account — we cannot run Lazy PA without the providers listed.

6. Where your data is processed

Your data is processed in the United States. All of it, not just some of it. We are an Estonian company, but the service does not run in Estonia — the application server and the PostgreSQL database that holds everything run in the United States (DigitalOcean, San Francisco / sfo). Uploaded documents and database backups sit in the same region, and every provider in section 5 — the AI, transcription and email services — is US-based as well.

We would rather say this plainly than bury it, because it is the kind of thing people reasonably assume works the other way round when they see an EU company.

These are transfers outside the EEA under Chapter V of the GDPR. They are made under the Standard Contractual Clauses incorporated into those providers’ data processing agreements, and where applicable under the EU–US Data Privacy Framework. Being established in the EU, we remain fully subject to the GDPR wherever the servers sit, and your rights in section 8 are unaffected by the location. You can read each provider’s terms from the links on the sub-processor page.

7. How long we keep it

8. Your rights

Under the GDPR you have the right to:

• Access and portability — Settings → Your data → export gives you everything we hold about you as a JSON file, immediately and without asking us.
• Erasure — Settings → Your data → delete account removes your account and all your material, including stored files. This cannot be undone.
• Rectification — correct anything by telling the assistant, or by editing the record.
• Restriction and objection — write to us at the address below.
• Withdraw consent where processing relies on it, without affecting what came before.

We answer within one month. If you are unhappy with how we handle it, you can complain to the Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate), https://www.aki.ee, or to the authority where you live.

9. Cookies and what your browser stores

Lazy PA sets no cookies — none at all, and no consent banner is required. It does keep a few things in your browser’s local storage, which never leave your device except when you are signed in:

Clearing your browser storage signs you out and loses an unsent draft. Nothing else.

10. Security

Traffic is encrypted in transit (HTTPS). Passwords are hashed, never stored in readable form, and passkeys keep their private key on your device. Every database query is scoped to the signed-in account. The application runs behind a restrictive Content Security Policy and can only reach an explicit allowlist of external hosts. Dependencies are scanned automatically for known vulnerabilities before they can ship.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your rights and freedoms we will notify the supervisory authority within 72 hours and tell you without undue delay. We have done this before and will do it again if we have to.

11. Children

Lazy PA is not intended for anyone under 16 and we do not knowingly collect their data. If you believe a child has an account, write to us and we will remove it.

12. Changes

If we change this policy we will update the effective date at the top, and for anything that materially affects you we will email you before it takes effect. During the beta the service changes often; this document is kept in step with it rather than written once.

13. Contact

Questions, requests, or complaints: info@lazycat.media. A real person reads it.