Privacy Policy

Last updated: 22 October 2026

1. Who we are

Lolu is a mobile AI assistant operated by Venture Deals, Co. (Northridge, California, United States). You contact us at support@lolu.ai.

2. Information we collect

• Account data — your email address and an encrypted password, used to create and secure your account.
• Sign in with Apple or Google — if you choose to sign in with Apple or Google instead of a password, that provider sends us your name and your email address (with Apple’s Hide My Email, a private relay address that forwards to you), whether the provider has verified that email, and an identifier for your account with that provider. Apple shares your name only the first time you sign in, and only if you choose to. We use this information only to create your account, sign you in and, when Apple or Google sign-in is added to an account that also has a password, email you that it was added. We never receive your Apple or Google password, and we do not keep your Google profile photo. Signing in with Google does not give Lolu access to your Gmail, Google Calendar or other Google data; those are only accessed if you separately connect them (see “Connected accounts” below).
• Your API keys (BYOK) — if you provide your own AI-provider API key, we store it solely to operate the assistant on your behalf. We do not use it for any other purpose.
• Conversations & memory — the messages you send, the assistant’s responses, and any facts you ask it to remember, so the service can function and improve your experience.
• Connected accounts — when you connect an app (e.g. Gmail, Google Calendar, Google Drive, Todoist), we access the data needed to perform the actions you request, using tokens granted via that provider’s authorization flow. For Google Drive this is read-only: Lolu can list, search and read your files, and cannot create, edit or delete anything in Drive. You can disconnect an app at any time on the Lolu app’s Connectors screen, which revokes Lolu’s access. For a meeting-recording app (e.g. Otter.ai), Lolu can search and read your recorded conversations, their transcripts and summaries. Transcripts include what other people in those conversations said, and the parts relevant to your question are sent to the AI model you use to answer it. This access is read-only: Lolu cannot change or delete anything in Otter.ai.
• Bank accounts (United States, through Plaid) — if you connect a bank, you sign in to it inside Plaid, the service Lolu uses to connect banks; your bank login goes to Plaid and never to Lolu. Lolu then reads, read-only: your accounts’ names, types and last 4 digits, their balances, the last 90 days of transactions, and investment holdings and loan details where your bank shares them. Lolu never receives your full account or routing numbers and cannot move money. We use this data only to answer what you ask about your money, in chat and in the Automations you set up. To write those answers, the bank data an answer needs is sent to the AI provider named when you connect your bank, only with your agreement and only to answer you; it is never used for ads, model training or sale, or for credit, insurance or employment decisions.
• Telegram — if you connect Telegram in the Lolu app, we keep your Telegram user id, username and first name, and the phone’s time zone, to know which chat is yours. The messages you send Lolu there and its replies pass through Telegram, and Lolu keeps the last 20 messages of that conversation, none older than 30 days, so the assistant can follow it. Answers that use your bank or health data are never sent to Telegram: Lolu asks you to open the app instead. A reminder, calendar or email draft that Lolu offers in Telegram is kept for at most 2 days, until you confirm or cancel it.
• Uploaded files and photos — documents you attach (e.g. PDFs) are processed to answer your requests, and, if you add them to your knowledge base, indexed for search. A photo you attach in the app, or send to Lolu in Telegram, is sent to our image-reading provider to describe what it shows for the assistant; the description is kept with your conversation, and a photo sent in Telegram is not stored.
• Subscription status — if you subscribe to a paid plan, Apple processes the payment; we receive your plan, its status and anonymized transaction identifiers. We never see your card details.
• Shopping activity — when you use shopping features (e.g. price watches, quick checkout), we keep the product, store, price and status of the actions you initiated, so you can review them and so the features work. Purchases themselves are completed on the merchant’s site.
• Push tokens — a device token used to deliver the notifications you enable (e.g. price alerts, briefings).
• Read Aloud (voice) — when you ask the app to read a reply out loud, the text of that reply is sent to our speech provider to synthesize the audio. Your microphone is not involved, we do not store the audio, and the file is cached on your device only. Dictation is separate: speech-to-text runs on your device through the operating system.
• Usage & diagnostics — limited technical data (e.g. feature usage, error logs) to keep the service reliable.

3. How we use your information

To provide and operate the assistant, run the actions you request, maintain your account, secure the service against abuse, and improve reliability. We do not sell your personal information.

You decide how much Lolu may do on its own. By default Lolu asks before any action that changes something outside Lolu — for example sending an email or creating a calendar event — and does nothing until you approve. You can choose to let Lolu act on its own for some or all of your connected apps; you can change this at any time in Settings. Every action Lolu takes is recorded so you can review it.

4. Third-party services

To deliver the service we share data, as needed, with:

• AI model providers — your prompts and relevant context are sent to the model provider you choose (or our default backend) to generate responses.
• Speech synthesis — if you use Read Aloud, the text being read is sent to our speech provider to generate audio. This uses our own provider account, not the API key you may have supplied for chat.
• Image reading — when you send Lolu a photo, it is sent to our image-reading provider (currently Google’s Gemini, through OpenRouter) to describe it. This uses our own provider account, not the API key you may have supplied for chat.
• Connected app providers (e.g. Google) — to read or act on data you have explicitly connected.
• Lolu’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your connected Google account is used only to provide the features you request; it is never used to serve ads, never used to determine creditworthiness or for lending, never sold or transferred to data brokers or other information resellers, never read by humans except with your consent, for security purposes or to comply with law, and never used to train or fine-tune generalized AI or machine-learning models.
• Plaid — if you connect a bank, Plaid Inc. connects Lolu to it. Plaid collects and processes your bank data under its own End User Privacy Policy, and you can see and manage the connections it holds for you at my.plaid.com.
• Telegram — if you connect Telegram, Telegram carries your messages to Lolu’s bot and its replies, and stores them in your Telegram chat under its own Privacy Policy. Telegram chats with bots are not end-to-end encrypted. You can disconnect Telegram at any time in the Lolu app’s Settings, or by sending /stop to the bot.
• Apple — processes subscription payments under its own terms; we receive plan and transaction status.
• Apple and Google sign-in — if you sign in with Apple or Google, that provider confirms your identity under its own terms and privacy policy, and sends us only the sign-in information described in section 2.
• Infrastructure & tooling — hosting, web search, document processing (e.g. OCR and text indexing), and email delivery providers that help run the service.
• Affiliate networks — when you tap a product link, the destination store and its affiliate network may receive standard referral information.

Each provider processes data under its own terms and privacy policy.

5. Affiliate links

Some product links Lolu shows are affiliate links. If you buy through them, we may earn a commission at no extra cost to you. This never changes the price you pay.

6. Data retention & deletion

We keep your data while your account is active. You can delete your account at any time from the app’s Settings; this removes your account (including its link to Sign in with Apple or Google), your stored keys, and your assistant data. Some records may be retained briefly where required for security or legal reasons. You can also stop using Sign in with Apple for Lolu in your Apple ID settings, or remove Lolu from the third-party connections in your Google Account; this stops future sign-ins through that provider but does not delete your Lolu account.

If you connect a bank, the transactions Lolu stores are kept, encrypted, for 90 days, and are never copied into our backups. Disconnecting the bank on the Connectors screen, or deleting your account, ends Lolu’s connection at Plaid and deletes the bank data Lolu stored. Your conversations, including answers about your bank, stay until you delete them; copies in our encrypted backups are deleted as those backups expire, within 30 days.

If you connect Telegram, Lolu keeps at most the last 30 days (and last 20 messages) of your conversation with its bot. Disconnecting Telegram in Settings, sending /stop to the bot, or deleting your account deletes that conversation from Lolu; the copy in your Telegram chat is yours to delete in Telegram.

7. Security

We use reasonable technical and organizational measures to protect your data, including isolation of each user’s assistant instance, encryption in transit, encryption at rest of our database and backups, and additional encryption of account and sign-in tokens. No system is perfectly secure.

8. Children

Lolu is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data.

9. International transfers

Your data may be processed in countries other than your own, including by the third-party providers listed above.

10. Changes

We may update this policy; material changes will be reflected by the “last updated” date above.

11. Contact

Questions? Email support@lolu.ai.