GDPR at LeraLink
How SSStudio, trading as LeraLink, meets the General Data Protection Regulation, activity by activity.
Last updated: 13 November 2026
Scope of this page
This page explains how LeraLink applies Regulation (EU) 2016/679 (the GDPR) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG). It is written for organisations that run, or are considering, an installation on LeraLink, and for the people whose data the platform holds.
It summarises. The binding texts are the Privacy Statement, the Data Processing Agreement with its Technical and Organisational Measures, and the Terms of Service. Where this page and those texts differ, those texts apply.
"We" means SSStudio, trading as LeraLink, a sole proprietorship under Dutch law owned by Sajad Sepehri. LeraLink is in a controlled pilot; general availability has not been declared.
Roles: controller and processor, decided per activity
We do not take one role for all data. The role depends on who decides why and how the data is processed in each activity.
| Activity | Our role | Who else is involved |
|---|---|---|
| LeraLink's own website, enquiries and sales contacts | Controller | — |
| Customer relationships, agreements, invoicing and bookkeeping | Controller | — |
| Platform-wide accounts: the account itself, sign-in, sessions, acceptance of our Terms and Privacy Statement | Controller | — |
| Platform administration, service security, abuse handling and the audit record | Controller | — |
| Handling reports of illegal content and requests from authorities | Controller | The installation concerned may be informed |
| LeraLink's own public-knowledge curation and discovery (the platform's record of concepts and entities) | Controller | See "Shared identities and public discovery" below |
| LeraLink's own installation, the Hub (hub.lera.link) | Controller | — |
| An installation's members, editorial contributions, review, newsletters, private content and access | Processor | The installation customer is the controller |
| AI tasks run inside an installation (translation, suggestions, images, the installation's search index) | Processor | The installation customer is the controller; AI providers are our subprocessors |
Platform-wide accounts and installations
One account can belong to several installations. The account (email address, sign-in, sessions) is held by us as controller. Each membership of an installation, and what a person does there, belongs to that installation, for which the customer is controller. An installation never sees which other installations a person belongs to.
Shared identities and public discovery
Some processing touches more than one installation. Examples are the platform's record of concepts and of people that published texts are about, and the discovery of public works across installations. For our own record we act as controller. Where we and an installation customer together determine the purposes and means of a specific operation, we may be joint controllers within the meaning of art. 26 GDPR. Where that is the case, we set out our respective responsibilities in an arrangement and make its essence available to the people concerned, as art. 26(2) requires. Where each party decides separately, each is a separate controller for its own part.
What a customer needs to do as controller
A customer that is controller for its installation:
- concludes the Data Processing Agreement with us (art. 28 GDPR);
- publishes its own privacy notice for its installation. We provide an Installation Privacy Statement Template for this;
- decides the legal basis for its own processing, and handles requests from its members, with the self-service tools described below.
Lawful bases for our own processing
For the activities where we are controller, we rely on the following bases under art. 6(1) GDPR. The Privacy Statement gives the full table, with retention periods.
| Activity | Legal basis |
|---|---|
| Accounts and sign-in | Contract (art. 6(1)(b)) where a person has one with us; otherwise legitimate interests (art. 6(1)(f)); security of sign-in on legitimate interests |
| Record of accepted Terms and Privacy Statement | Legal obligation (art. 6(1)(c)) and legitimate interests in showing what was agreed |
| Enquiries and agreements | Steps before a contract, the contract, or legitimate interests |
| Invoicing and bookkeeping | Legal obligation (Dutch tax law) and contract |
| Support, security and the audit record | Contract, legal obligation and legitimate interests |
| Email the service needs (such as sign-in codes) | Contract |
| Anonymous reading statistics | Legitimate interests |
| Public discovery and curation | Legitimate interests, after a necessity and balancing assessment |
| Backups | Legitimate interests in recovering from loss |
| A person's own data package | The person's request (right of access and right to data portability) |
| Showing content from other services (such as embedded video) | Consent, given by the reader in the browser |
Where we rely on legitimate interests, we assess the interest, the necessity and the balance with the rights of the people concerned; the written record of these assessments is in preparation. A person may object under art. 21 GDPR.
We do not sell personal data and do not use it for behavioural advertising. We make no decisions based solely on automated processing that have legal or similarly significant effects on a person (art. 22 GDPR).
Special categories of data
Works published on an installation can reveal special categories of data (art. 9 GDPR), such as political opinions or religious beliefs, about their authors or the people they discuss. That a work is public does not remove the protection of the GDPR. We give such data additional care in public discovery, and it is part of the data protection impact assessment described below. Customers whose installations hold such data can restrict works to named people and roles, and can ask us to place their installation under a stricter AI policy (see below).
Transparency
We inform people through these documents:
| Document | What it covers |
|---|---|
| Privacy Statement | Our processing as controller: purposes, data, legal bases, retention, recipients, transfers and rights |
| Cookie and Local Storage Statement | Each cookie and each kind of browser storage, with purpose and lifetime |
| Where Your Data Is Stored | What is stored in the EU and what is not |
| How LeraLink Uses AI | The fixed set of AI tasks, providers and AI policies |
| Data Retention Schedule | How long each kind of data is kept |
| Your Data Rights | How to use the rights and the self-service tools |
| Subprocessors and Recipients | Every subprocessor and recipient, with role, location and safeguard |
| Installation Privacy Statement Template | A starting text for customers as controllers |
New accounts accept the Terms of Service and the Privacy Statement after entering a valid sign-in code. We record which document and which version was accepted, when, and on which site.
Records of processing activities (art. 30)
A record of processing activities is required of us, both for the activities where we are controller (art. 30(1)) and for the categories of processing we carry out for customers as processor (art. 30(2)). The exemption for small organisations in art. 30(5) does not apply, because our processing is not occasional. The record is in preparation. It will be kept up to date when processing changes, and will be available to the Autoriteit Persoonsgegevens on request.
Data protection impact assessment (art. 35)
We are carrying out a data protection impact assessment for the knowledge layer and public discovery: the platform's record of concepts and people that published texts are about, the AI-written descriptions of them, and discovery of public works across installations. It covers the necessity and proportionality of the processing, the risks to the people described, and the measures taken, including those listed below. We will review it when the processing changes.
For processing in an installation, the customer as controller decides whether its own processing needs an impact assessment. We assist as processor, as art. 28(3)(f) GDPR requires, by providing information about how the platform works.
Data protection by design and by default (art. 25)
These measures are built into the product, not left to configuration:
| Measure | What it does |
|---|---|
| Hashed identifiers | Session records hold only a hash of the session token. IP addresses and browser descriptions are stored only as keyed hashes. Rate-limit counters use a hashed IP address and are kept 7 days. We do not treat hashed identifiers as anonymous: a hashed IP address can still be personal data. |
| No passwords | Readers, members and authors sign in with a one-time email code that works once and expires within minutes. There are no passwords to leak. Sign-in requests are limited per hashed address and per hashed IP address. |
| Anonymous reading statistics | Counts of reading carry no account, IP address, cookie or stored identifier; a random number lasts one page visit. Detail is kept up to 3 months, then only totals. |
| No tracking cookies | Only sign-in session cookies and two language cookies. No analytics cookies, no Google Analytics, no advertising cookies. |
| External content off by default | Video, posts and media from other services load only after the reader allows it. |
| Restricted content | A work can be restricted to named people or roles. It is then readable by nobody else, by any path, and no AI model ever reads it. |
| AI as proposal | AI output is a proposal, marked as machine-made, until a person accepts it. Machine translations can be shown to readers before a person has reviewed them; they are then labelled 'AI translation · Not yet human-reviewed'. A person's correction of an AI-written description is kept beside it and always wins. |
| AI policies | Each installation is under an AI policy: Standard, EU only, Open models only, or No external AI. The platform administrator sets it, at the customer's request. The platform enforces the policy for every model call. |
| Separation of installations | Every request is resolved to one installation. An installation never sees another installation's memberships. Cross-installation requests fail closed. |
| Data minimisation towards providers | AI providers receive only what the task needs. Source lookups send only the search terms, never account information. |
| Newsletters and publication email | Members receive them by default and can switch them off at any time in their settings or with the link in every message. Newsletters may record whether a message was opened and which links were followed, to measure reach. |
| Retention by registry | Short-lived data (sign-in codes, challenges, ended sessions, data packages) is deleted on a fixed schedule; see the Data Retention Schedule. |
| Self-service rights | A signed-in person can download their data, leave an installation and delete their account, and can ask for correction or removal of an AI-written description of them, without writing to anyone. |
Self-service rights in more detail
- Download my data. A person asks from their account. After a warning, a typed confirmation and an emailed code, a package is built. The link goes to their inbox, works for 7 days and only for the same person signed in. One kind of package holds one installation's data about them; the other holds their shared account and the list of their installations, which no installation ever sees. A package holds only what is theirs alone: works shared with other people are represented by the person's own credit; reviewers receive their own words; authors receive decisions but not who reviewed; editors' internal notes are excluded and can be asked for separately.
- Leave an installation. Removes that installation's profile, preferences, contact relationship, sessions, roles and grants. The account and other memberships remain.
- Delete my account. Takes effect after 7 days and can be cancelled until then. It is blocked, with the reason shown, while the person is the sole owner of an installation or has an open submission. Published works and credits stay under the published name, because they are also other people's record. What connects that name to a living person is removed. The audit record keeps the account identifier under legal hold, the record of accepted documents remains, and backups expire after 30 days.
- AI-written descriptions of a person. A person who has been confirmed as the person described can ask the installation for correction or removal of a description a model wrote about them. The installation decides on the request. A removal takes the text in every language and leaves a mark that every automatic process honours, so the description is not written again.
Other requests go to privacy@lera.link. Where we are controller we respond without undue delay and within one month, which may be extended where art. 12(3) GDPR allows. Where an installation is controller, we pass the request to it and assist it.
Security of processing (art. 32)
We apply technical and organisational measures appropriate to the risk. They include separation of installations in software with server-side access decisions, phishing-resistant passkeys for administrators (required for platform administration; being introduced for the administration of installations, and not yet required by every installation), administration surfaces behind Cloudflare Access, encrypted connections with HSTS, an append-only audit record, staged change management with the owner's approval before production, nightly checksummed backups kept 30 days in the EU, and rehearsed restores.
The Security Overview describes these measures and states what is not yet in place, including that no independent penetration test has yet been carried out. The contractual description is in the Technical and Organisational Measures.
Personal data breaches (arts. 33 and 34)
- Where we are controller, we notify the Autoriteit Persoonsgegevens without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless the breach is unlikely to result in a risk to people (art. 33). Where the risk is likely to be high, we also inform the people concerned (art. 34).
- Where we are processor, we notify the customer without undue delay after becoming aware of a breach (art. 33(2)), and in any case within 48 hours, as the Data Processing Agreement sets out, and give the information the customer needs for its own notification.
- We document every breach, including its facts, effects and the measures taken, whether or not it is notified (art. 33(5)).
Incident Response and Notification describes the process. Report a suspected incident to security@lera.link.
Processors and international transfers (art. 28 and chapter V)
We use a small number of subprocessors: Cloudflare (hosting, storage, DNS and AI models), Resend (email delivery), OpenAI and Google (AI models), GitHub (code hosting, the status page, and maintenance operations such as restore rehearsals, during which it processes backup data), where web search lookup is enabled, Perplexity, and DotNet Talk AB (Sweden), our continuity partner, which holds standing access to the source repository and to the Cloudflare account so that it can take over the operation of the service if SSStudio cannot continue, without using that access in normal operation. Each task tries its models in a fixed order set by the platform; an installation's administrators can see that order, with each provider, on the page 'AI in this installation'. Subprocessors and Recipients lists each one with its role, location, contract and safeguard. We announce changes in advance under the Change Notification Policy, so that customers can object as the Data Processing Agreement provides.
Since 3 November 2026, databases, files, backups, configuration and job queues are stored in Cloudflare's EU jurisdiction. The resources that held the data before the move are not in that jurisdiction; they keep an unchanged copy, are no longer used, and are deleted on or after 3 December 2026. Some processing is not held in the EU: the search index, temporary caches, anonymous reading statistics, AI processing and email delivery records. Requests are processed on Cloudflare's global network. Where Your Data Is Stored lists each part.
Where personal data is transferred outside the European Economic Area, we rely on an adequacy decision, including the EU–US Data Privacy Framework for certified recipients (Commission Implementing Decision (EU) 2023/1795), or on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with a transfer impact assessment and supplementary measures where needed. The Data Privacy Framework has been upheld by the EU General Court; an appeal is pending before the Court of Justice. We follow that case and will adjust our safeguards if the legal position changes.
Data protection officer
SSStudio has not appointed a data protection officer. In our assessment art. 37(1) GDPR does not require one: we are not a public authority, and our core activities do not consist of large-scale regular and systematic monitoring of people, or large-scale processing of special categories of data. We review this assessment as the service grows.
Privacy questions and requests: privacy@lera.link. They are handled by SSStudio, in English or Dutch.
Supervisory authority
Our lead supervisory authority is the Dutch Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). Anyone may lodge a complaint with it, or with the supervisory authority of the EU member state where they live or work. They do not need to contact us first.
Children
We do not offer separate account registration to people under 16. Under art. 8 GDPR and art. 5 of the Dutch GDPR Implementation Act, where consent is the basis for an information society service offered directly to a child under 16, the consent of a person with parental responsibility is needed. Where a customer wants to offer its installation to minors, for example for education, the customer and we must first agree on our respective duties and put age-appropriate notices, settings and, where required, verifiable parental consent in place. An educational purpose does not remove these requirements.
Contact
Privacy: privacy@lera.link. Security: security@lera.link. Legal: legal@lera.link. Formal business details: Company Information.
Sources
- Regulation (EU) 2016/679 (GDPR): eur-lex.europa.eu
- Uitvoeringswet Algemene verordening gegevensbescherming: wetten.overheid.nl
- Commission Implementing Decision (EU) 2023/1795 (EU–US Data Privacy Framework): eur-lex.europa.eu
- Commission Implementing Decision (EU) 2021/914 (Standard Contractual Clauses): eur-lex.europa.eu
- General Court, Latombe v Commission, judgment of 3 September 2025 (Case T-553/23); appeal lodged 31 October 2025, Case C-703/25 P (OJ C/2025/6610): eur-lex.europa.eu
- Autoriteit Persoonsgegevens: autoriteitpersoonsgegevens.nl