Last updated: June 2026
Lemonflow Technologies GmbH
Kreittmayrstraße 3, 80335 Munich, Germany
Email: info@lemonflow.ai
Lemonflow provides AI-powered customer support solutions for electric vehicle (EV) charging operators. This notice explains how we handle personal data in two capacities:
Lemonflow has not appointed a Data Protection Officer (DPO), as the company does not meet the thresholds under Art. 37 GDPR. For all data protection inquiries, please contact us at info@lemonflow.ai.
| Data | Purpose | Legal Basis | Retention |
|---|---|---|---|
| IP address, browser details, pages visited, timestamps | Server operation, security, and technical diagnostics | Legitimate interest (Art. 6(1)(f)) | 30 days (server logs) |
| Aggregated visit statistics | Understanding which pages and sections are useful (Cloudflare Web Analytics; PostHog, EU-hosted) | Legitimate interest (Art. 6(1)(f)) | Aggregated, no personal data retained |
We do not set tracking, marketing, or preference cookies. Our analytics — Cloudflare Web Analytics and PostHog — operate entirely without cookies or personal profiling, and all data is processed in the EU. No cookie banner is required.
| Data | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Phone number (caller ID) | Call routing | Legitimate interest (Art. 6(1)(f)) | 90 days |
| Voice recording and transcript | Product demonstration, quality improvement, diagnostics | Legitimate interest (Art. 6(1)(f)) | 90 days |
The phone number on our website connects to an automated voice AI demonstration. No human agent participates. If you prefer not to be recorded, please contact us by email instead.
| Data | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Name, email, company, job title | Responding to inquiries, sales communication | Legitimate interest (Art. 6(1)(f)) or consent (Art. 6(1)(a)) | Duration of business relationship + 2 years |
| Communication history | Relationship management | Legitimate interest (Art. 6(1)(f)) | Duration of business relationship + 2 years |
| Data | Purpose | Legal Basis | Retention |
|---|---|---|---|
| CV, cover letter, contact details, interview notes | Recruitment and hiring decisions | Pre-contractual steps (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) | 6 months after decision (or longer with consent) |
| Data | Purpose | Legal Basis | Retention |
|---|---|---|---|
| Usage data (pages and features used, interactions, session activity) | Understanding how the Hub is used to improve and secure the service | Legitimate interest (Art. 6(1)(f)) | 12 months |
The Lemonflow Hub is our operator portal, used by Lemonflow staff and authorised staff of our customers. To improve the service, we record how the Hub is used, including session activity, using a third-party product-analytics provider hosted in the EU. On-screen content is masked in recordings — we capture how the Hub is used, not the data displayed in it — and this data is never used to train AI models. Usage tracking can be enabled or disabled per user; to be excluded, contact us at info@lemonflow.ai.
When our customers (EV charging operators) use the Lemonflow platform, we process personal data on their behalf and under their instructions. In this context:
| Data Category | Examples | Processing Purpose |
|---|---|---|
| Voice interaction data | Call recordings, transcripts, caller phone number | AI-powered customer support delivery |
| Email / chat / WhatsApp interaction data | Message content, email addresses, phone numbers, IP addresses | AI-powered customer support delivery |
| Interaction metadata | Timestamps, duration, contact reason, resolution outcome | Service delivery, quality assurance, reporting |
| CRM and case data | Existing case information, customer details, interaction history retrieved from customer CRM systems | Contextual AI support; retrieved on-demand during interactions |
| Charger interaction data | Charger ID, connector ID, location, error codes | Issue diagnosis and remote resolution |
| SMS notification data | Recipient phone number, technical case summary | Alerting on-duty staff of critical escalations; recipients are pre-authorised by the customer |
| Customer employee data | Names, email addresses, login credentials (hashed) | Platform access management (Hub portal, SSO) |
If you are an EV driver whose interaction was handled by the Lemonflow platform: your data controller is the EV charging operator you contacted. Please refer to their privacy notice for information about how they use your data, or contact them directly to exercise your data protection rights. Lemonflow will assist the controller in fulfilling your request.
The Lemonflow platform uses AI to process customer interactions. This includes automated categorisation of contact reasons, escalation level classification (L0–L3), ticket routing, and charger fault diagnosis. These automated processes support human decision-making by the customer's staff and do not produce legal or similarly significant effects on individuals. No fully automated decisions with legal effect are made under Art. 22 GDPR.
We share personal data with the following categories of service providers, all of which are bound by data processing agreements. Data is hosted in the EU, with appropriate safeguards (Standard Contractual Clauses and/or the EU-US Data Privacy Framework) where a provider may access it from outside the EU/EEA:
A detailed list of sub-processors, including provider names and locations, is available upon request. Please contact us at info@lemonflow.ai.
Personal data is hosted within the European Union. Our core platform infrastructure is deployed in Google Cloud's EU regions (europe-west1, Belgium and europe-west4, Netherlands). Where a service provider may access personal data from outside the EU/EEA — such as our EU-hosted product-analytics provider — we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework.
Should any further transfer outside the EU/EEA become necessary (e.g., due to a sub-processor change), we will ensure appropriate safeguards are in place before any such transfer occurs.
Under the GDPR, you have the following rights regarding your personal data:
| Right | Description |
|---|---|
| Access (Art. 15) | Request a copy of the personal data we hold about you. |
| Rectification (Art. 16) | Request correction of inaccurate personal data. |
| Erasure (Art. 17) | Request deletion of your personal data, subject to legal retention requirements. |
| Restriction (Art. 18) | Request that we limit the processing of your data in certain circumstances. |
| Data portability (Art. 20) | Receive your data in a structured, machine-readable format. |
| Objection (Art. 21) | Object to processing based on legitimate interests. |
| Withdraw consent (Art. 7(3)) | Where processing is based on consent, withdraw it at any time without affecting prior processing. |
To exercise any of these rights, contact us at info@lemonflow.ai. We will respond within 30 days.
You also have the right to lodge a complaint with your local data protection supervisory authority. In Germany, this is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA) for private-sector matters.
We implement appropriate technical and organisational measures to protect personal data, including:
Further details on our security measures are available to customers and prospective customers upon request.
We review this notice periodically to ensure it remains accurate and compliant. Material changes will be published on our website. The "Last updated" date at the top of this page indicates when the most recent revision was made.
© 2026 Lemonflow Technologies GmbH. All rights reserved.