Privacy Statement
Personal data, roles, rights and safeguards across LeraLink
Last updated: 12 November 2026
1. Who controls which processing
SSStudio, trading as LeraLink, is the controller under the GDPR for its own website, enquiries, customer relationships, invoicing, platform administration, service security, and its own public-knowledge curation and discovery. Contact: privacy@lera.link.
An installation customer decides the purposes and essential means of managing its own members, editorial contributions, newsletters, private content and access, and is the controller for those activities. Where SSStudio carries them out on the customer's documented instructions, it acts as processor under a data processing agreement (DPA). Roles are assessed per activity, not once for all data. Public-content federation, shared identities and independently curated concept and entity records may involve separate or joint controllership, which then requires additional disclosures or an Article 26 arrangement. A customer's own privacy notice must describe its processing and contact point.
2. What we process, why, and for how long
We process only what a function needs.
| Activity | Information | Legal ground | How long |
|---|---|---|---|
| Accounts | email address, the name and profile details you add, language settings, memberships and roles | contract where you have one with us; otherwise legitimate interests | while the account exists; deletion is described in section 9 |
| Signing in | one-time sign-in codes; a session record holding a hash of the session token, a hash of your IP address and a hash of your browser's description; for administrators who use a passkey, its public key, identifier, name and last use (never the private key, which stays on your device) | contract and legitimate interests in security | sign-in codes and passkey challenges: one day; a session record: 30 days after the session ends; a removed passkey: 90 days after removal |
| Acceptance of our Terms and this statement | which document and version you accepted, when, and on which site | legal obligation and legitimate interests in being able to show what was agreed | for the life of the account, and afterwards as evidence |
| Enquiries and agreements | names, business contact details, offers, correspondence | steps before a contract, the contract, or legitimate interests | according to our documented commercial records schedule |
| Billing and bookkeeping | invoicing identity, payment references, tax data | legal obligation and contract | seven years for Dutch tax records, subject to statutory exceptions |
| Support, security and audit | support correspondence; a record of administrative actions with a hash of the IP address and of the browser's description; abuse indicators | contract, legal obligation and legitimate interests | the audit record is kept under legal hold; other records as long as security requires |
| Email we send | your address, the message and its delivery status; for newsletters, whether a message was opened and which links were followed, to measure reach | contract for messages a service needs (such as sign-in codes); for newsletters and publication email, legitimate interests or another documented basis. Members receive them by default and can switch them off at any time in their settings or with the link in every message | delivery records as long as needed to operate the service; for newsletters, until you switch them off, with the evidence needed to respect that |
| Reading statistics | anonymous events: which public work or part of a work was read, in which language and on which kind of page, with a random number that lasts one page visit; page-speed measurements by page type and device class. No account, IP address, cookie or stored identifier | legitimate interests | up to three months, then only totals |
| Website measurement, where an installation enables it | aggregate visit figures from Cloudflare Web Analytics, which uses no cookies | legitimate interests | per Cloudflare's retention for that service |
| Public discovery and curation | public works, public author and attribution details, licences, concept and entity relationships, provenance | legitimate interests after a necessity and balancing assessment; special categories of data need additional care | as long as legitimately needed, subject to correction, delisting and legal retention |
| Backups | a copy of the database, made nightly | legitimate interests in being able to recover from loss | 30 days |
| Your data package | a file of your own data, made when you ask for it | your request (right of access and portability) | seven days, then the file is deleted |
Legal grounds differ where an installation is the controller. We do not claim that logged identifiers are anonymous merely because they are hashed: a hashed IP address can still be personal data.
3. Public content and the people described in it
When eligible public material is surfaced across installations, LeraLink may build search and meaning-based relationships, consolidate duplicate concepts and entities, and support public discovery. A public work can contain personal information about its author or about a person it discusses. Depending on an event's settings, registered participants' names or pictures may be shown to others who see the event. We assess lawful grounds, source provenance, accuracy, purpose limitation and legitimate objections; public availability alone does not remove the protection of the GDPR.
Descriptions of concepts and people written with AI are marked as made by a model, and a person's correction is shown beside it, not over it. The general description of a concept or person comes from Wikidata and Wikipedia. Affected persons may ask for correction, restriction or delisting where the law allows. We forward requests about records an installation controls to that installation and assess requests about our own discovery records ourselves. We make no solely automated decisions about people that have legal or similarly significant effects within the activities described here.
4. AI and other recipients
What AI is used for. LeraLink uses AI for a fixed set of tasks: translation; suggested search-engine fields for a work; a generated feature image; the search index, which turns text into numerical representations so that related works can be found; and naming and describing the concepts and people that published text is about. AI does not write, title, summarise or evaluate a work for its author. What a model produces is a proposal until a person accepts it. Machine translations can be shown to readers before a person has reviewed them; they are then labelled 'AI translation · Not yet human-reviewed'. The search index and the concept descriptions are the exceptions: they are computed from published text, never change it, and are marked as machine-made.
Which providers. The models come from Cloudflare (Workers AI), OpenAI and Google (Gemini API). Each task tries its models in a fixed order set by the platform; an installation's administrators can see that order, with each provider, on the page 'AI in this installation'. A task moves to the next model only if one is unavailable. Only what the task needs is sent: the passage to translate, the work's text for a suggestion, the description of the image to make.
AI policies. Every installation is under an AI policy. Under the EU-only policy, a task uses only models hosted in the EU and recorded as not training on what they receive, and the installation's text is left out of the search index. On that page, administrators also see each provider's country, hosting region and data terms. Customers can ask us for the same list as a document.
Training and retention. Providers' terms differ, and we record each provider's terms in our register. Under their published terms for the paid API services we use, OpenAI and Google do not use the data sent to train their models, and may keep it for a limited period to detect abuse.
Lookups. When an author looks up a source, the search terms they type (a title, an identifier such as a DOI or ISBN, or a name) go to bibliographic services: Crossref, OpenAlex, Open Library, Google Books, Wikidata and Wikimedia Commons, and, where it is enabled, Perplexity web search. These services receive no account information.
Service providers. Cloudflare hosts, stores and processes the platform, and Resend delivers our email. Both act as our processors.
We do not sell personal data or use it for behavioural advertising.
5. Where data is stored, and transfers
Since 3 November 2026 the platform's databases, files (images, audio, documents and backups), configuration and job queues are stored by Cloudflare in its European Union jurisdiction.
Cloudflare processes requests on its global network, so a request can be handled in a data centre outside the EU, usually the one nearest to the reader. In addition, these parts are not held in the EU:
- the search index (Cloudflare Vectorize). It holds the numerical representations of public and installation text, with identifiers. They are derived from the text and can reveal something about it. Installations under the EU-only AI policy are not in it;
- copies of configuration and of public pages that Cloudflare keeps temporarily in its network to serve them quickly;
- the anonymous reading statistics (Cloudflare Analytics Engine);
- AI processing, which runs on Cloudflare's network or with the providers named in section 4;
- email delivery: Resend sends our email from its Ireland region, but Resend is a US company and may process delivery records in the United States.
Where personal data are transferred outside the European Economic Area, we rely on an adequacy decision, including the EU–US Data Privacy Framework for certified recipients, or on Standard Contractual Clauses, together with any required transfer assessment and supplementary measures. Details are available on request insofar as they can be disclosed.
6. Security and incidents
We apply access controls, separation between installations, encrypted connections, short-lived and revocable sessions, role limits and incident-response procedures appropriate to the risks. Administrators of the platform and of installations can sign in with a passkey, which cannot be phished, and an installation can require it. Sensitive administrative actions ask for the passkey again. Backups are made every night and restoring them is rehearsed. The current state of the service is published at status.lera.link. We notify customers and supervisory authorities where the law requires, according to the role we perform.
7. Cookies and browser storage
The Cookie and Local Storage Statement lists each cookie and each kind of browser storage we use, with its purpose and lifetime. We use no advertising or cross-site tracking cookies, and no Google Analytics.
8. Children
Where an installation offers its services to minors, the customer and LeraLink must determine their respective duties and put in place age-appropriate notices, restricted settings and verifiable parental consent where required, including under Dutch rules for users under 16. An educational purpose does not remove these requirements. Until such measures are in place and verified, no separate account registration for users under 16 is offered.
9. Your rights
Subject to conditions and exceptions, you may ask for access, rectification, erasure, restriction, data portability and information about recipients, and you may object to processing based on legitimate interests. You may withdraw consent at any time, without affecting what was done before.
A signed-in person can download their own data from their account: a link is sent to their inbox and works for seven days. They can also delete their account there. Deletion takes effect after seven days, during which it can be cancelled. Published works and credits stay under the name they were published with, because they are also other people's record; what links that name to a living person is removed: email address, picture, public address, biographies, reactions, notes, reading history, and unpublished work that is theirs alone. The audit record and the record of accepted documents remain, and backups expire after 30 days.
Send other requests to privacy@lera.link. We will identify the responsible controller and, where we are the controller, respond without undue delay and in any case within one month, which the law allows us to extend. We may verify your identity in a proportionate way.
You may complain to the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl) or another competent supervisory authority in the EU. You do not have to contact us first.
10. Changes and contact
We date significant changes, explain them where appropriate and communicate them as required. People who create an account accept the Terms and this statement at sign-up, and we record which version they accepted, as described in section 2. Privacy contact: privacy@lera.link. Formal business details: Company Information.