Privacy policy

Effective August 1, 2026

This policy says what Lisano does with your data: what is processed, why, on what legal basis, and for how long. It covers the app and this website.

Who is responsible

The controller is Sebastian Grunow, Am Kreuzgarten 18, 41334 Nettetal, Deutschland. You can reach me at info@lisano.app.

What I process data for, and on what basis

• Signing in with Google or Microsoft — so that you can sign in and your account stays yours. Legal basis: contract, Art. 6(1)(b) GDPR.
• Transcription — so that what you say becomes text. Legal basis: contract, Art. 6(1)(b) GDPR.
• Storing your todos and diary — so that your entries are there when you come back to them. Legal basis: contract, Art. 6(1)(b) GDPR.
• Reminders — so that the app can remind you at the right time; they are scheduled on your device. Legal basis: contract, Art. 6(1)(b) GDPR.
• Binding the trial — so that the free trial applies once per installation. Legal basis: legitimate interest, Art. 6(1)(f) GDPR, namely preventing repeated use of a one-time offer.
• Server logs — so that I can spot faults and attacks. Legal basis: legitimate interest, Art. 6(1)(f) GDPR, namely running the service safely.
• Delivering this website — so that the site can be read. Legal basis: legitimate interest, Art. 6(1)(f) GDPR, namely making a working site available.

What that data is

• your name and email address, as your sign-in provider passes them on
• the account identifier from your sign-in provider, which recognises your account across sign-ins
• a device identifier, used to schedule reminders and to bind the trial to one installation
• your voice recordings and the transcripts made from them
• what you write: diary entries and todos
• server logs, with IP address, time and the address requested

What you put in your diary is your choice. It may include things about health, relationships, beliefs or mood. Those entries are stored as you wrote them, and are analysed for nothing beyond showing them back to you.

Who receives the data

• Hetzner Online GmbH (Germany) — the servers and database your entries live on. Privacy policy: hetzner.com/de/rechtliches/datenschutz
• ElevenLabs, Eleven Labs Inc. (USA) — transcription; the detail is below. Privacy policy: elevenlabs.io/privacy-policy
• Google, Google Ireland Limited — signing in with your Google account, if you choose that route. Privacy policy: policies.google.com/privacy
• Google Play — distribution of the app through the store. Privacy policy: policies.google.com/privacy
• Microsoft, Microsoft Ireland Operations Limited — signing in with your Microsoft account, if you choose that route. Privacy policy: privacy.microsoft.com
• bunny.net, BUNNYWAY d.o.o. (Slovenia) — delivery of this website. It is delivered exclusively within the European Union; DNS resolution, by contrast, runs on a worldwide network and falls outside that restriction. Privacy policy: bunny.net/privacy

There are no other recipients. Your entries are not sold, not used for advertising, and not made available to anyone else.

Transcription in detail

When you speak, the app opens a connection from your device straight to ElevenLabs. The recording does not travel through my servers, and I do not hear it. That changes nothing about my responsibility: I chose this provider and instructed it.

Three things are worth knowing before you speak:

• Processing in the United States. ElevenLabs handles the recordings in the United States. This rests on standard contractual clauses and on certification under the EU-US Data Privacy Framework, which is held by the US entity Eleven Labs Inc. alone — the other group companies are expressly outside it.
• No contractual retention limit. On the plan in use, ElevenLabs gives no contractual deletion period. There is no guaranteed point at which a recording disappears from their side.
• Moderation. ElevenLabs reserves the right to moderate submitted content, and may pass it to the providers Hive (USA) and Cinder (EU) to do so. A spoken diary is therefore reviewable content by design.

If that goes further than you are comfortable with: you can type any entry instead. Then no recording is made at all.

How long things are kept

Diary entries, todos and your account stay until you ask for deletion. Your content does not expire on its own — it is yours, and you decide when it goes.

Server logs are deleted after 90 days at the latest.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). An informal email to info@lisano.app is enough.

You may also lodge a complaint with a supervisory authority (Art. 77 GDPR).

Right to object

Where I process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you have the right to object to that processing on grounds arising from your particular situation (Art. 21 GDPR). Tell me what speaks against it, and I will stop processing the data unless I can demonstrate compelling legitimate grounds.

Deleting your account, revoking access

If you take Lisano's access away in your Google or Microsoft account settings, you can no longer sign in. The data already stored is not deleted by that — it stays with me. Getting rid of it is a separate step: delete your account.

Supervisory authority and data protection officer

There is no data protection officer designated; the conditions in Art. 37 GDPR are not met.

The competent supervisory authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, on the web at ldi.nrw.de.

No cookies, no measurement

This website sets no cookies, embeds no analytics, and loads no fonts, scripts or images from other origins. There is no consent banner here, because there is nothing to consent to.

Language versions

This policy exists in German and in English. Where the two versions diverge, the German version prevails.