Privacy Policy | Lemondrop

1. Overview

Lemondrop ("we", "us", "our") is committed to protecting your privacy. This policy explains what data we collect, how we use it, and your rights over it. By using Lemondrop, you agree to this policy.

2. Information We Collect

Account information: When you sign in with Google, we receive your name, email address, and profile picture. We store this to identify your account.

Business data: All financial data you enter — invoices, bills, expenses, contacts, accounts — is stored securely in our database. This data belongs to you.

Usage data: We collect basic activity logs (e.g., which actions were taken on which records) to support account management and customer support.

Payment data: Subscription payments are handled by Xendit. We do not store your payment method details. We receive confirmation of payment status from Xendit.

Uploaded files: Receipt images and other uploaded files are stored securely via Vercel Blob storage.

3. How We Use Your Information

To provide and maintain the Service
To authenticate your identity and manage your account
To send transactional emails (invoices, payment confirmations, reminders) via Resend
To process subscription payments via Xendit
To monitor errors and performance via Sentry
To respond to support inquiries

We do not use your data for advertising. We do not sell your data to third parties.

4. Third-Party Services

Lemondrop uses the following third-party services to operate. Each has its own privacy policy:

Google OAuth — account authentication (policies.google.com)
Neon — PostgreSQL database hosting (neon.tech/privacy)
Vercel — application hosting and file storage (vercel.com/legal/privacy-policy)
Resend — transactional email delivery (resend.com/legal/privacy-policy)
Xendit — payment processing (xendit.co/privacy-policy)
Sentry — error monitoring (sentry.io/privacy)

5. Data Security

Your data is stored in an encrypted database hosted on Neon (PostgreSQL). All data is transmitted over HTTPS. We use secure session tokens and do not store passwords. Access to production infrastructure is strictly limited.

6. Data Retention

We retain your data for as long as your account is active. If you cancel your subscription, your data is retained for 90 days before permanent deletion. You may request earlier deletion by contacting us.

7. Your Rights

You have the right to:

Access the data we hold about you
Correct inaccurate personal data
Request deletion of your account and data
Export your data (contact us and we will provide a copy)

To exercise any of these rights, email us at hello@lemondrop.id.

8. Cookies

We use a single session cookie to keep you signed in. We also use Google Analytics to understand how visitors use the site — which pages are visited and which features are used. Google Analytics does not serve advertising and does not receive personally identifying information. IPs are not used to identify individuals, and analytics data is not sold. No cookie consent banner is required as we do not use advertising or tracking cookies for targeting purposes.

9. Children

Lemondrop is not directed at children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal information, contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions or requests, contact us at hello@lemondrop.id.