Last updated: November 2026
This Privacy Policy explains how Lystra ("Lystra", "we", "us") handles personal data when you use our study tool. It is written in plain language and is intended to meet the transparency requirements of the EU General Data Protection Regulation (GDPR). It describes how the product works and is not legal advice.
Lystra is the data controller responsible for the personal data described here. For any privacy-related questions, contact us at contact@lystra.chat.
We only process the data needed to run the service. The table below sets out each purpose and the legal basis under Article 6 GDPR.
| Data | Purpose | Legal basis |
|---|---|---|
| Email address (and authentication identifiers) | Create and secure your account, sign you in, and contact you about the service. | Performance of a contract (Art. 6(1)(b)). |
| Saved conversations and profile data | Store your chats so you can return to them while signed in. | Performance of a contract (Art. 6(1)(b)). |
| Message content you send to the AI | Generate the chatbot's responses. | Performance of a contract (Art. 6(1)(b)). |
| Usage counters (per-account message counts) | Enforce fair-use limits and prevent abuse. | Legitimate interests (Art. 6(1)(f)) in keeping the service fair and available. |
| Security signals (App Check / reCAPTCHA Enterprise) | Protect the service against automated abuse and fraud. | Legitimate interests (Art. 6(1)(f)) in security. |
| Payment and subscription status | Process paid subscriptions. Card details are handled by Stripe; we do not see or store them. | Performance of a contract (Art. 6(1)(b)). |
If you use Lystra as a guest (not signed in), your chat stays in your browser only and is lost when you refresh or close the tab; it is not stored on our servers.
We do not use advertising or third-party tracking cookies, and we do not show a cookie banner because the technologies below are strictly necessary to provide the service you requested. For transparency, we store and read the following on your device:
We use the following providers, which act as our processors or as independent controllers where noted:
Our providers (including Google and Stripe) may process personal data outside the European Economic Area, including in the United States. Where this happens, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses and the providers' data processing agreements.
Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent where processing is based on consent. You can delete your account at any time from Account Settings in the app, which removes your profile and saved conversations and cancels any active subscription. For any questions, contact us at contact@lystra.chat.
You also have the right to lodge a complaint with a data protection supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY); if you are in another EU/EEA country, you may contact your local authority.
Lystra uses AI to generate study responses, but we do not make decisions that produce legal or similarly significant effects about you solely by automated means.
Lystra is not directed at children under the age of 13, and you must be old enough to consent to use an online service under the laws of your country.
We use industry-standard measures provided by our infrastructure partners to protect your data, including authentication, access controls, and abuse protection. No service can guarantee absolute security.
Lystra is an AI tool and can make mistakes. Please verify important information.
We may update this policy. Material changes will be reflected by updating the "Last updated" date above.
Questions about privacy? Email contact@lystra.chat.