This privacy notice explains how Loracta processes personal data when you visit the marketing site, create an account, use a tenant workspace, publish public pages, request support, or interact with consent and analytics controls.
Controller and processor roles
Loracta is the controller for its own marketing, account, billing, and platform-security processing. For customer workspace content and donor records, the customer organization is usually the controller and Loracta acts as processor under the DPA.
For marketing-site visits, sales requests, account administration, billing, security, and platform operations, the controller is Loracta UG (haftungsbeschränkt). For content, member, contributor, donor, and publication data uploaded by a customer organization, Loracta processes that data on the customer organization’s documented instructions under the Data Processing Agreement.
Some public surfaces may also identify a tenant organization or shared-surface operator as controller. Where that happens, the relevant public site or workspace notice controls that organization-specific processing.
Data we process
| Category | Examples | Source |
|---|---|---|
| Account and identity | Email address, name, organization, role, login timestamps, password hash, workspace membership. | You / admin |
| Customer content | Articles, media, transcripts, translations, publications, contributor metadata, donor records where enabled. | Workspace |
| Usage and audit | Searches, assistant questions, opened items, consent choices, administrative actions, access logs. | Product |
| Technical | IP address, browser and device information, session identifiers, CSRF tokens, timestamps, error diagnostics. | Automatic |
| Cookies and signals | Consent record, functional preferences, analytics consent, DNT and GPC privacy signals. | Device |
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Provide the service | Contract performance or pre-contract steps — Art. 6(1)(b) GDPR. |
| Security and abuse prevention | Legitimate interests in protecting users, tenants, and infrastructure — Art. 6(1)(f) GDPR. |
| Audit, tax, and compliance records | Legal obligation where required, otherwise legitimate interests — Art. 6(1)(c) or Art. 6(1)(f) GDPR. |
| Analytics and embedded media | Consent for non-essential cookies and similar technologies — Art. 6(1)(a) GDPR and § 25 TDDDG. |
| Support and sales communication | Contract steps, legitimate interests, or consent depending on the request — Art. 6(1)(b), (f), or (a) GDPR. |
Where we rely on consent, you can withdraw it at any time. For cookies, use , and for other processing contact privacy@loracta.com.
AI and automation
Loracta uses AI features for retrieval, drafting assistance, summarization, translation, transcription, and citation-supported assistant responses. Prompts may include user questions, retrieved content snippets, instructions, and limited workspace context needed to perform the requested task.
AI output is assistive. Customers remain responsible for reviewing generated or transformed content before publication, especially legal, medical, financial, pastoral, or safety-sensitive material.
Sharing and transfers
We do not sell personal data. We share data with service providers only to run Loracta, under contract, and disclose the current list at /subprocessors.
Recipient categories include hosting and storage providers, payment processors, transactional email providers, AI/ML providers selected for enabled features, import integrations, and observability/logging providers.
Where a provider processes data outside the EU/EEA, transfers rely on an adequacy decision, EU Standard Contractual Clauses, and appropriate supplementary measures.
Retention
| Data | Retention |
|---|---|
| Account and workspace data | For the subscription or account lifetime, then for the export/deletion period stated in the DPA or customer agreement. |
| Consent record | Stored in the first-party consent cookie for up to 365 days, or until changed or cleared. |
| Audit and security logs | Kept as needed for security, compliance, legal claims, and customer audit obligations. |
| Billing and tax records | Retained for statutory accounting and tax periods. |
Your rights
Depending on your location and role, you may have rights to access, rectify, erase, restrict, port, or object to processing, and to withdraw consent. The request flow is described at /rights.
Contact
privacy@loracta.com
Version history
We update this page when the underlying processing, service terms, or legal references change materially.