Privacy Policy

Lethe collects the least amount of data needed to run the service. No tracking, no advertising cookies, no profiling, no data sold or shared for marketing.

To exercise your GDPR rights on your behalf, Lethe processes the identity and contact data you enter to compose a request — typically your full name, email addresses, and any phone numbers — together with request metadata such as which brokers you targeted, the request reference, status, and timestamps. Legal basis: performance of our agreement with you to act as your authorised representative in exercising your rights (Article 6(1)(b) GDPR), with your consent where required. Identity and contact data are encrypted at rest and kept only as long as needed to run and evidence the request. By design, a data-erasure (Article 17) or objection (Article 21) request necessarily discloses your identifying details to the data broker it is sent to — that disclosure is the purpose of the request and is what lets the broker find and erase your data. The verifiable receipts Lethe produces do not contain your identifying details: your identifiers are recorded only as salted cryptographic commitments, never as raw values, so a receipt proves a request was made without disclosing who you are. We do not sell or share your data for marketing.

Waitlist (closed October 2026): if you joined the Lethe waitlist, we hold your email address; which page you signed up from; a team-size range, if you chose to give one; an approximate country derived from your connection, where recorded; when you confirmed your address (and, for some earlier sign-ups, when you joined, kept for 30 days); a reference to the version of the consent wording you accepted; and a random token that makes your unsubscribe link work. If you unsubscribed, we keep a marker for 30 days so we don't email you again. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with the unsubscribe link. The waitlist no longer accepts sign-ups, and we will delete all of these records by 30 November 2026.

Lethe uses two strictly-necessary cookies, both used only to sign you in and keep you signed in. The authentication cookie (lethe_access) is an httpOnly cookie set after you sign in through Dekimu ID (id.dekimu.com); it keeps you authenticated, lasts 2 hours from when it is set (deleted earlier if you sign out) and cannot be read by client-side scripts. The sign-in security cookie (__Host-lethe_auth_state) is set when you start to sign in — by clicking a sign-in link or when a page that requires sign-in sends you to it — so it is also set before you are signed in. It holds only a random value, with no personal data and no identifier linked to you or your account, and is used solely to check that the sign-in response coming back from Dekimu ID belongs to the browser that started it, which stops anyone from signing you into an account they control without you noticing. It lasts at most 30 minutes and is deleted earlier, as soon as you come back from Dekimu ID with a sign-in response that matches it, whether sign-in then succeeds or fails. Because both cookies are strictly necessary for the sign-in you ask for, neither needs your consent (art. 5(3) ePrivacy Directive 2002/58/EC; art. 22.2 LSSI-CE). We use no tracking, advertising, analytics, or profiling cookies, and we load no third-party trackers.

Lethe relies on a small set of processors to run the service:

• Upstash — encrypted database, EU region
• Resend — transactional email delivery, EU (eu-west-1)
• Vercel — application hosting

Data brokers are not our processors. They are independent recipients of the erasure and objection requests you direct Lethe to send on your behalf, and they handle your data under their own privacy policies. Dekimu ID (id.dekimu.com) handles authentication and account management and is operated by Dekimu Labs S.L., the same company that operates Lethe.

You have the right to access your personal data and to have it rectified or erased, to object to its processing, to request its restriction and to receive it in a structured format (portability). Use the Contact options in Dekimu ID at id.dekimu.com. You may also lodge a complaint with a supervisory authority.

Dekimu Labs, S.L. (CIF B55431357) · legal@dekimu.com. You may also use the Contact options in Dekimu ID at id.dekimu.com.

Dekimu Labs, S.L. · CIF B55431357 — identificación completa en el Aviso Legal.

This policy is governed by the laws of Spain. You may lodge a complaint with the Agencia Española de Protección de Datos (AEPD) or the supervisory authority of your habitual residence.