Privacy Policy

Effective date: 17 July 2026 · Last updated: 21 July 2026

1. Who we are and who this covers

LimeliJourney is operated by Lime Lift BV, a company incorporated under Belgian law with enterprise number BE 1021.859.168 and registered office at Bredabaan 342, 2170 Antwerpen, Belgium. Lime Lift BV is the controller for the personal data described in sections 2 and 3 (this website, customer accounts, billing, support and platform administration) and a processor for the data described in section 4 (data our customers track through the platform). Contact us about privacy at hello@limelijourney.com.

This policy covers visitors to limelijourney.com, our customers (workspace users), and the end users whose interactions our customers track through the platform.

2. Data we collect on this website

• The demo and contact forms collect the details you type: name, work email, company, and estimated volume. We use them to respond to you and take steps toward a contract (legal basis: pre-contractual steps at your request, and our legitimate interest in following up on inquiries).
• This marketing site sets no analytics or advertising cookies. Web fonts are self-hosted, so viewing this site sends no requests to third-party font or analytics services.
• Lead-form submissions are normally deleted within 12 months after our last substantive interaction with you, unless you become a customer, you ask us to delete them sooner, or a longer period is necessary to establish, exercise or defend legal claims.

3. Data we collect when you use the platform

When your organization opens and uses a workspace, we process data about your users to operate the service. For this data we are the controller:

• Account data: workspace user names, work email addresses, roles and permissions, and login identities and authentication records (legal basis: performance of the contract).
• Billing data: billing contact details, postal address, VAT number where applicable, payment status and invoice records (legal basis: performance of the contract and our legal obligations under tax and accounting law).
• Security and operations data: IP addresses, security and audit logs, browser, device and request information (legal basis: our legitimate interest in securing the service and preventing fraud and abuse, and legal obligations where they apply).
• Support and communications: support requests, tickets and related correspondence (legal basis: performance of the contract).
• Usage data: plan usage, quota and overage information used for billing and capacity (legal basis: performance of the contract).
• Email records: delivery, bounce and complaint signals for platform email, processed to protect deliverability (legal basis: our legitimate interest in operating reliable email).
• Service emails needed to operate the service (such as invites, credentials, billing and security notices) are sent on the basis of the contract. We do not currently send marketing newsletters; if we introduce them, we will do so in accordance with applicable e-marketing rules, including opt-outs.

4. Data our customers process through the platform

Customers use LimeliJourney to track marketing interactions: clicks, impressions, leads, conversions, and associated attribution data (identifiers such as click IDs, sub-IDs, IP-derived metadata, and cookie identifiers set on the customer's own domain). For this data the customer is the controller and we are a processor: we store and process it solely to provide tracking, attribution and reporting to that customer, on the customer's documented instructions. Each customer's data is isolated per tenant, and staff access within a workspace can be further scoped by role.

5. Where data lives and who touches it

• Hosting: Amazon Web Services. Each customer's workspace is provisioned in a single region (see section 6). Today the default region is US West (Oregon, USA): database, login identities and uploaded assets reside there. Data is encrypted in transit and at rest.
• Email: platform emails are sent via Amazon SES from our AWS infrastructure in the workspace's region (US West (Oregon) by default). Bounce and complaint signals are processed in the same region to protect deliverability.
• AI features: LimeliChat and the Creative Studio run on Amazon Bedrock inside our AWS account. Model providers do not receive access to customer prompts or outputs, and prompts and outputs are not used to train foundation models. Where prompts or outputs are stored by LimeliJourney itself to provide conversation history, auditability or workspace functionality, they are stored as part of the customer's workspace data and follow the retention rules in section 8.
• Payments: Mollie B.V. (Netherlands) processes subscription payments and acts as an independent controller for the personal data it processes in connection with its payment services, including payment execution, fraud prevention and compliance with financial regulation. Card and bank details are entered on Mollie's hosted checkout and never reach our servers; we store only payment status, mandate references and invoice records. Payment information is also subject to Mollie's privacy statement.
• Breaches: if we become aware of a personal data breach affecting a customer's data, we notify that customer's workspace administrators without undue delay.
• Lime Lift personnel: authorised Lime Lift personnel may access workspace data where reasonably necessary to operate, maintain, secure, support or troubleshoot the platform, investigate an incident, or respond to a customer request. This may include accessing a workspace through a privileged support-access or impersonation function. Access is restricted to authorised personnel, subject to confidentiality and security controls, and logged. Personnel may not access or use workspace data for personal purposes, advertising or purposes unrelated to providing and protecting the service.

6. Data residency and international transfers

Each customer's workspace and its primary customer content (the tracking data, assets and records described in section 4) are stored in the workspace's selected AWS region. Our default region is the United States (Oregon). European customers can request EU data residency: we provision their workspace in an EU region so their primary customer content remains in the EU. Certain limited account, billing, security, support and service metadata may be processed from other locations where necessary to operate, secure and support the service. Tell us your residency requirement before onboarding and we will place your workspace accordingly.

Where personal data is transferred outside the European Economic Area, the United Kingdom or Switzerland, we rely on an applicable lawful transfer mechanism: an adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or another legally recognised safeguard (our hosting provider, AWS, also participates in the EU–US Data Privacy Framework). Details of the safeguards that apply to your data, and how to obtain a copy, are available through our data processing agreement or by contacting us.

7. Cookies

The marketing site uses no tracking cookies. The application uses strictly necessary cookies and tokens for authentication and session state. Tracking cookies created by the platform's SDK are first-party cookies on our customers' own domains, governed by the customer's privacy policy and consent mechanism.

8. Retention and deletion

Workspace data is retained while the subscription is active, except that raw event-level records (individual clicks, impressions and similar events) may be archived or deleted once older than 12 months, with at least 30 days' notice to workspace administrators before any retention schedule takes effect. Conversions, payout-bearing events and aggregated reporting are kept for the life of the subscription. After termination, customers can request an export within 30 days, after which data may be deleted; deleted data may persist in encrypted backups for up to 35 days before it is purged. Billing, invoice and accounting records are retained for the period required by applicable tax and accounting law; in Belgium this is generally ten years from 1 January of the year following the relevant accounting period. Lead-form retention is described in section 2.

9. Your rights

Depending on your jurisdiction (including under the GDPR and US state privacy laws such as the California Consumer Privacy Act), you may have the right to access, correct, delete or export personal data we hold about you, to restrict or object to its processing, and to withdraw consent where processing relies on consent (without affecting processing before the withdrawal). Some rights are subject to legal limits: for example, we cannot delete records the law requires us to keep, such as invoices. We do not sell or share personal information within the meaning of US state privacy laws. We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects concerning individuals.

Requests: hello@limelijourney.com. If you are an end user of a site tracked by one of our customers, please direct requests to that company; we support our customers in fulfilling them. You can also lodge a complaint with your data protection authority; for Belgium this is the Data Protection Authority (dataprotectionauthority.be).

10. Children

LimeliJourney is a business service and is not directed to children. We do not knowingly collect personal data directly from children through this website or through customer account registration. Customers remain responsible for the lawfulness of the data they track through their workspace, including where their campaigns concern younger audiences.

11. Subprocessors and other recipients

We use the following providers to deliver the service. We tell workspace administrators before adding or replacing a subprocessor, as described in our data processing terms.

• Amazon Web Services EMEA SARL / Amazon Web Services, Inc. — subprocessor for hosting, storage, platform email (SES) and AI inference (Bedrock). Processing locations: the workspace's selected region (US West (Oregon) by default, or an EU region on request), including platform email and AI inference for that workspace. Safeguards: AWS Data Processing Addendum incorporating the EU Standard Contractual Clauses; AWS participates in the EU–US Data Privacy Framework.
• Mollie B.V. (Amsterdam, Netherlands) — payment services. Independent controller for the payment data it processes (see section 5); recipient of billing contact and payment details only, never of workspace or tracking data.

12. Changes

We will post updates to this policy here and notify workspace administrators of material changes.