LightMeans — Privacy Notice v1.0

1. About this notice

LightMeans helps founders examine assumptions behind a business idea and identify what should be tested, changed or stopped before more time and money are committed.

This notice explains what information LightMeans processes when you submit an idea, why we process it, which service providers are involved, where processing may take place, how long information may be retained, and the choices and rights available to you.

LightMeans is the name of an early-stage service operated personally by Eirik Kaasa Eliassen in Norway. LightMeans is not currently a separate company or legal entity. For Founder Pilot 001, Eirik Kaasa Eliassen is the data controller responsible for deciding why and how personal data submitted through the service is processed. Our infrastructure provider Lovable acts as a processor for Customer Personal Data under its Data Processing Agreement on the Business plan. If LightMeans is later transferred to or operated by a separate legal entity, this notice will be updated accordingly.

2. What we collect

When you use LightMeans, we may process:

• the description of your idea and the answers you provide about the intended customer, problem, reasons you think the idea may work, and development stage;
• your email address so we can deliver your private report;
• the LightMeans analysis derived from your submission, including the decision, main risk, next requirement, report text and structured result;
• research material generated during External Evidence, including claims derived from the idea, search queries, findings and source links;
• technical information needed to operate the service, such as random visitor/session identifiers, submission and report identifiers, status information, referrer and campaign parameters, and limited event data about use of the service;
• if you participate in the Founder Pilot, your invitation status and the feedback you choose to provide after receiving the report.

LightMeans is not intended for sensitive personal data. Please do not include health information, financial account or payment-card details, government identifiers, biometric data, passwords, confidential personal information about other people, or other special-category/sensitive personal data in your idea submission.

3. Why we use the information

We use submitted information to:

• receive and analyse your business idea;
• produce and deliver your LightMeans result;
• check relevant claims against public web sources where External Evidence is used;
• operate, secure, troubleshoot and improve the service;
• administer the private Founder Pilot and collect pilot feedback where applicable;
• respond to privacy, support or deletion requests; and
• comply with applicable legal obligations.

For Founder Pilot 001, the primary purpose is to provide the requested LightMeans analysis and evaluate whether the service works as intended. We do not sell submitted ideas, publish them, show them to other users, or use them to build LightMeans businesses based on founders’ submissions.

4. Your idea and ownership

Your idea remains yours. LightMeans does not claim ownership of an idea because you submit it for analysis.

Submitting an idea gives LightMeans only the ability to process the information as necessary to provide and operate the service as described in this notice and the Terms of Use.

5. AI processing

LightMeans uses AI as part of its analysis. The founder’s answers and development stage are sent through Lovable’s AI Gateway to model providers used by Lovable so that the analysis and report can be produced. Lovable does not publish whether or how long prompts and outputs are retained at the AI Gateway, does not characterise retention or deletion at individual model providers, and does not confirm which provider a given model request resolves to beyond its maintained provider list. Lovable states that its agreements with model providers restrict their use of content to what is needed to deliver the service and prohibit them from training on that content.

LightMeans currently uses Lovable on the Business plan. Lovable Support confirmed in writing on 30 September 2026 that Lovable's pre-signed Data Processing Agreement automatically became applicable to the LightMeans workspace when it upgraded to Business, requires no separate signature or acceptance, and remains applicable while the workspace stays on Business or Enterprise. Lovable Support also confirmed that Customer Content in the Business workspace is excluded from model training by default. Lovable states that its agreements with model providers restrict providers' use of content, including for training.

LightMeans has also disabled the account-level setting that permits Lovable content to be used for AI model training. This is an additional precaution; Lovable Support has confirmed that the Business workspace's Customer Content is excluded from model training by default while the DPA applies.

AI-generated analysis can contain errors. A LightMeans report is an analytical aid, not professional legal, financial, medical or other regulated advice. Important decisions should be independently checked where appropriate.

6. External Evidence and web research

Some analyses use External Evidence to check selected claims against publicly available web information.

The full founder submission is not sent to the web-search/fetch service. Instead, short search queries derived from the idea may be sent to the research provider. LightMeans applies a privacy filter intended to remove information such as email addresses, web addresses, phone numbers, money figures, parts of the founder’s email address and terms identified as private before a query is sent.

The resulting research records may include the claim checked, search query, findings and public source links.

During the current External Evidence beta, LightMeans may use Firecrawl to search and read publicly available web pages relevant to selected claims in your submission. Firecrawl is accessed through Lovable's managed connector service; LightMeans does not have a separate Firecrawl account or direct contract.

LightMeans does not send your full submission, email address, submission ID, visitor or session identifiers, private report or status links, invitation tokens or smoke-test tokens to Firecrawl. Instead, the system generates short search queries from the business idea and applies privacy filters before they are sent. These queries may still describe aspects of your business idea in general terms. Public web addresses returned by the search may subsequently be sent for page retrieval.

Firecrawl is accessed through Lovable's managed connector path. Lovable Support has confirmed that connector providers are covered by Lovable's subprocessor arrangements where the provider appears on Lovable's authoritative published subprocessor list. Lovable does not publish retention periods for connector requests on its side or the provider's side and does not offer selective deletion of stored connector data. LightMeans therefore does not promise a specific provider-side retention period or selective provider-side deletion. Processing location and current subprocessor details are governed by Lovable's maintained subprocessor information.

If you request deletion, LightMeans can delete the corresponding External Evidence records held in the LightMeans application database. This does not itself delete copies that may remain in Lovable's connector infrastructure or at Firecrawl; those copies remain subject to the applicable provider arrangements and retention periods.

7. Email delivery

LightMeans currently sends report-ready emails through Lovable's managed email service (@lovable.dev/email-js / sendLovableEmail) from noreply@notify.lightmeans.com. The service receives the founder's email address, a fixed English or Norwegian notification message and the private report link needed to deliver the message. The email itself does not contain the founder's idea or report content. LightMeans stores only the delivery status and send time in the analysis job.

Lovable Support does not publish the identity of the specific managed-email sending provider, what delivery metadata it retains, whether a URL included in a message appears in provider logs, or a specific retention period. The authoritative provider record is Lovable's maintained subprocessor list. Because the report-ready email contains the private report link, that link may be processed as part of email delivery; LightMeans does not promise that the URL is absent from provider-side delivery logs. The email itself does not contain the founder's idea or report content. LightMeans cannot delete an email already delivered to the founder's own mailbox; if the underlying submission is erased, the old private report/status links are invalidated.

8. Hosting, database and Lovable

LightMeans is built and hosted using Lovable, including Lovable Cloud and the AI Gateway.

On the Business plan, Lovable processes Customer Personal Data under its Data Processing Agreement. Lovable Support confirmed in writing on 30 September 2026 that the pre-signed DPA automatically applies from the date a workspace upgrades to Business, requires no signature or countersignature from LightMeans, and remains applicable while the workspace stays on Business or Enterprise. The DPA describes LightMeans/the customer as controller and Lovable as processor for EU personal data, requires Lovable to process Customer Personal Data on documented instructions, provides security and breach-notification commitments, governs subprocessors and incorporates safeguards for international transfers.

Lovable may separately process Service Data, Log Data and properly aggregated/de-identified data for its own permitted purposes under its contractual terms. Such data is not treated in the same way as Customer Personal Data under the DPA.

9. International transfers

Lovable’s AI Gateway entry point is hosted in the EU, but Lovable has confirmed that AI inference may be sent to model-provider endpoints in the United States. Other service providers may also process information outside Norway or the EEA.

Lovable states that transfers of personal data outside the EEA are protected using legally recognised transfer mechanisms, including the EU Standard Contractual Clauses where applicable. Its DPA incorporates the relevant SCC modules for transfers of Customer Personal Data.

This means LightMeans should not be described as an EU-only processing service.

10. How long we keep information

For Founder Pilot 001, LightMeans intends to erase or anonymise identifiable founder submissions in the active application database no later than 90 days after the pilot has ended, unless the information must be retained longer to comply with a legal obligation, resolve a security issue or handle an unresolved request. A founder may request deletion earlier by contacting privacy@lightmeans.com.

LightMeans has an approved Pilot 001 deletion procedure and a tested owner-only erasure mechanism. The mechanism has been verified end-to-end on internal smoke data: it removes founder content, derived analysis content, External Evidence and matching funnel events; closes the retry path; and invalidates the old private report and status links. It preserves only non-content technical records where required for system integrity, beta accounting or audit history. Owner-only erasure of real pilot submissions remains disabled until the final pre-flight before invitations are sent.

Some records cannot safely be physically removed without damaging system counters or referential integrity. In those cases, founder content and direct identifiers are erased or replaced so that the operational record no longer contains the submitted idea or the founder’s email address.

Lovable has not provided LightMeans with fixed retention periods for AI Gateway prompts/outputs, infrastructure logs, connector requests or database backups. Lovable Support has confirmed that database backups are daily snapshots held in the same region as the database, that backup copies are not edited individually, and that selective deletion of stored connector data is not offered. Earlier copies may therefore remain in backups or provider infrastructure until they expire under the applicable retention practices. Lovable also states that nothing on its side captures request bodies ahead of LightMeans' own application handler, while hosting-layer headers and URLs receive best-effort redaction of sensitive values.

Lovable’s public Privacy Policy states that personal data is kept only as long as needed for the stated purposes or legal requirements, and that operational/security logs are retained as needed to operate and secure the service, potentially longer when an incident is being investigated. We therefore do not promise a fixed period for deletion from provider backups or technical logs.

11. Logs and analytics

LightMeans does not currently use an external advertising or behavioural analytics platform for founder submissions. Lovable Visitor Analytics has been switched off for Founder Pilot 001 and verified absent from the published site before any Founder Pilot invitation was opened. LightMeans' own application records limited funnel events such as event name, step, technical identifiers, referrer and campaign parameters.

The application has been reviewed and hardened so that application error logs contain only a fixed stage/context label, error type, status code where available and a random reference ID. Full upstream error messages, stack traces, founder answers/email, report content, AI prompts/outputs and External Evidence queries/results are not written by LightMeans application error handlers. Browser-side Lovable error reporting has also been restricted to the same safe summary; query strings are excluded and private report/status paths are masked before reporting.

12. Who can access information

Founder information is not available to other LightMeans users.

Access may be available to:

• the founder, through the private report/status link;
• the LightMeans owner/administrator and authorised persons who need access to operate the service or respond to a request;
• Lovable and its authorised subprocessors as needed to provide hosting, database, AI Gateway, security and related services;
• AI model providers used through Lovable’s AI Gateway, as needed to perform inference;
• Firecrawl for the limited research queries and page-fetching described above when External Evidence is used;
• the email delivery provider for the recipient address and private report link; and
• public authorities or other recipients where disclosure is required by applicable law.

13. Legal basis

For Founder Pilot 001, LightMeans relies primarily on Article 6(1)(b) GDPR where processing is necessary to provide the analysis you request under the Pilot Terms, including receiving the submission, producing the report and delivering it to you. LightMeans relies on Article 6(1)(f) GDPR for limited processing necessary for its legitimate interests in securing, troubleshooting and evaluating the pilot, provided those interests are not overridden by your rights and interests. Where a legal obligation requires processing, Article 6(1)(c) may apply. Pilot feedback is voluntary; LightMeans does not require feedback in order to provide the report.

Providing the idea information and an email address is necessary if you want LightMeans to analyse the idea and deliver the private report. If you do not provide the required submission information, LightMeans cannot provide that analysis. Pilot feedback is optional. This legal-basis section should be reviewed again before public launch, particularly if LightMeans introduces paid services, marketing, optional analytics, new categories of data or materially different uses of founder information.

14. Your rights

Subject to applicable data-protection law, you may have rights to request access to personal data about you, correction of inaccurate information, deletion, restriction of processing, portability, or to object to certain processing. Where processing relies on consent, you may withdraw that consent without affecting processing that occurred before withdrawal.

To make a privacy or deletion request, contact privacy@lightmeans.com.

We may need enough information to verify that the request relates to you and to locate the relevant submission. We will not ask for more information than reasonably necessary for that purpose.

You may also have the right to complain to the relevant data-protection supervisory authority. In Norway, this is Datatilsynet.

15. Security

LightMeans uses access controls and private report links designed to prevent submissions and reports from being visible to other users. Application database tables containing founder content are server-restricted rather than publicly readable from the browser.

Lovable’s DPA and public security information describe technical and organisational measures including access controls, encryption, security monitoring and incident response. No online service can guarantee absolute security.

16. Children

LightMeans Founder Pilot 001 is intended for adult founders and business users, not children. Do not submit personal information about children through the service.

17. Changes to this notice

We may update this notice as LightMeans develops, service providers change, or legal and technical requirements evolve. The current version and effective date will be shown on the Privacy page.

18. Contact

Data controller and operator: Eirik Kaasa Eliassen, Norway

Service name: LightMeans

Privacy and deletion requests: privacy@lightmeans.com

General contact: hello@lightmeans.com