Privacy policy

This notice explains how LMXAI processes personal data when you use lmxai.com and related locale pages (/nl/, /tr/). It is written to meet the information duties in Articles 13 and 14 of the GDPR (AVG), the Dutch implementation of the ePrivacy rules on cookies, and Google’s requirements for sites that use Google Analytics.

Paid client work is covered by a separate proposal or services agreement. Those terms prevail for that engagement.

LMXAI is the controller for personal data processed through this website.

• Trade name: LMXAI
• Place of establishment: Leiden, the Netherlands
• Email: [email protected]
• Website: https://lmxai.com

We do not currently appoint a Data Protection Officer. Privacy requests go to the email above.

We only process what we need to run the site, answer enquiries, and — if you opt in — measure traffic. We do not sell personal data. We do not use automated decision-making that produces legal or similarly significant effects (GDPR Article 22).

Contact form

If you submit the form on the homepage, we receive your name, email address and message, plus technical metadata the form provider attaches (for example time of submission and approximate IP used to prevent abuse).

• Purpose: to reply to your enquiry and keep a record of the conversation.
• Legal basis: GDPR Article 6(1)(b) where the message is a request to take steps toward a contract; otherwise Article 6(1)(f) (legitimate interest in answering business enquiries) or Article 6(1)(a) if you clearly consent.
• Processor: Web3Forms delivers the submission to us.

Direct email

If you write to [email protected], we process the content of that correspondence, your email address and any attachments you send, on the same bases as the contact form.

On-site chat assistant

The optional chat widget sends the text you type, and a short recent history of that chat, to our server and then to Anthropic, which hosts the language model. If you ask to be put in touch and share a name and email, those details may be captured as a lead so we can reply.

• Purpose: to answer questions about LMXAI and, if you ask, to pass a message to us.
• Legal basis: Article 6(1)(b) or 6(1)(f) for ordinary questions; Article 6(1)(a) where you volunteer contact details to be forwarded.
• Processor: Anthropic, PBC (model inference). Do not paste secrets, passwords, health data or other special-category data into the chat.

The assistant is an AI system. It can be wrong. It is not legal, medical or financial advice.

Strictly necessary storage

We store a theme preference and your cookie-consent choice in local storage or a similar browser store so the site can remember those settings. This is necessary to provide the service you request and to record consent (ePrivacy / GDPR Article 6(1)(c) and 6(1)(f)).

GEO traffic measurement (no cookies)

We load a first-party measurement script from https://api.lmxai.com/t.js (site key gs_bqACP6S9PMgF6qC3, which is public). It does not set cookies and does not send IP addresses, user-agent strings or form contents. It keeps a random session identifier in sessionStorage for the duration of the tab so page views in one visit can be grouped. Data is sent to our collector at api.lmxai.com to measure human visits for GEO/AEO analysis.

• Purpose: understand which pages people and AI crawlers see, without advertising identifiers.
• Legal basis: Article 6(1)(f) (legitimate interest in measuring our own site). This script is not Google Analytics and is not gated by the analytics cookie toggle because it does not use cookies.

Separately, Vercel middleware may report requests whose user-agent matches known crawlers (for example GPTBot, ClaudeBot, Googlebot) to the same collector. That channel is for bot traffic only; ordinary human visitors are not sent through it.

Analytics (off until you opt in)

Only after you accept analytics we load:

• Google Analytics 4, measurement ID G-7M3DQXH8VD, operated by Google Ireland Limited / Google LLC as processor;
• Vercel Web Analytics, operated by Vercel Inc. as processor for our hosting account.

Typical data: pages viewed, referrer, approximate location, device and browser type, and a random client identifier stored in first-party cookies (for example _ga, _ga_*). Google’s current documentation states that Google Analytics does not log or store IP addresses; we also set anonymize_ip on the tag. We do not enable Google signals, User-ID, or advertising features unless you separately enable the marketing category.

• Purpose: to understand which pages are useful and to improve the site.
• Legal basis: GDPR Article 6(1)(a) and prior consent under the Dutch/EU cookie rules. Analytics cookies are not strictly necessary, so they stay off until you opt in.

Google requires us to tell you that we use Google Analytics, that it uses cookies or similar identifiers, and how measurement data is processed. See Google’s Analytics data-safeguarding overview, the Google Privacy Policy, and the optional Google Analytics opt-out browser add-on.

Marketing / advertising category

The banner includes a marketing toggle so we can store a granular choice. This marketing site does not currently load Google Ads or remarketing tags. If that changes, we will update this notice and will not set advertising cookies until you opt in to that category. Legal basis would be consent (Article 6(1)(a)).

Hosting, fonts and security logs

The site is hosted on Vercel. Vercel processes request data (IP address, user-agent, URL, timestamps) to deliver pages, absorb abuse and keep the service running. Legal basis: Article 6(1)(f) (security and delivery of the website) and 6(1)(b) where you use an interactive feature.

Some pages load typefaces from Google Fonts. That request can expose your IP address and user-agent to Google. Some pages also load open-source scripts from jsDelivr (anime.js for the drawings, Mermaid for diagrams, and a Markdown parser for the chat assistant). These are technical resources, not advertising cookies.

Non-essential cookies and similar technologies are denied by default. We use Google Consent Mode v2 with analytics_storage, ad_storage, ad_user_data and ad_personalization set to denied until you choose otherwise. Google Analytics and Vercel Web Analytics scripts are not loaded unless you opt in to analytics (basic / blocking implementation). The GEO measurement script described above does not use cookies.

You can accept all, reject non-essential, or save categories. You can change or withdraw consent at any time via Cookie settings in the footer or the bottom-left control. Withdrawal does not affect processing that was lawful before you withdrew. When you turn analytics or marketing off, we update Consent Mode and delete related tracking cookies where the browser lets us.

Consent choices are stored in your browser under lmxai-consent-v1 until you clear site data or change them.

We use the following processors or independent providers for this website:

• Vercel Inc. — hosting and, if enabled, web analytics;
• LMXAI GEO collector (api.lmxai.com) — cookieless page-view and crawler logs;
• Google Ireland Limited / Google LLC — Analytics 4 (and Fonts where loaded);
• Web3Forms — contact-form delivery;
• Anthropic, PBC — chat-model inference;
• jsDelivr — script CDN used on some pages.

For Google Analytics we rely on Google’s Ads Data Processing Terms / Analytics Data Processing Terms in the Google account. Other processors are bound by their own DPA or equivalent terms with us as customer. We do not share analytics data with other Google advertising products unless you enable marketing and we say so here.

Some processors are in the United States or other countries outside the EEA. Where that happens we rely on an adequacy decision where one exists (including the EU–US Data Privacy Framework for certified organisations such as Google LLC) and/or Standard Contractual Clauses and supplementary measures described in the processor’s documentation. You can ask us for more detail at [email protected].

• Contact and chat leads: as long as needed to answer you and for a reasonable follow-up, then deleted or archived with restricted access. Unfinished spam or abusive messages may be dropped earlier.
• Analytics: follows the retention setting on our GA4 property (Google currently allows 2, 14, 26 or 38 months for event-level data) and Vercel’s product default, and only while consent remains granted.
• GEO measurement: the browser session identifier lasts for the tab; collector events are kept only as long as needed for GEO reporting and then aggregated or deleted.
• Server logs: according to the host’s security defaults, typically a short rolling window.
• Consent record in your browser: until you change it or clear site data.

Under the GDPR/AVG you may request access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time. You also have the right not to be subject to solely automated decisions with legal or similarly significant effects — we do not operate such decisions on this site.

Email [email protected]. We may need to verify who is asking. You may lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or with the supervisory authority in your EU Member State of habitual residence or work.

This site is aimed at professional readers. We do not knowingly collect personal data from children under 16. If you believe a child has sent us data, contact us and we will delete it.

The site is served over HTTPS. Access to enquiry inboxes and analytics accounts is limited to people who need it. No method of transmission or storage is perfectly secure; please do not send credentials or special-category data through the public form or chat.

We will update this notice when tools, processors or the law change. The date at the top is the version date. Material changes will be reflected on this page before or when they take effect.

Open cookie settings · Terms of use · Nederlands · Türkçe