Privacy Policy

This Privacy Policy explains how Lanesra AI collects, uses, discloses, stores, and otherwise processes personal data in connection with its website, software, communications, sales activities, customer relationships, recruitment, and internal operations. It also explains the choices and rights available to individuals.

Controller and Contact Details

Controller: Lanesra AI

The Controller is currently establishing a company in the Republic of the Marshall Islands that is intended to assume the operation of the Service following its incorporation. Once the company has been incorporated, the Controller may transfer the operation of the Service and, where legally permitted, its rights and obligations under these Terms to the newly incorporated entity. Customers will be informed of the new legal entity’s name, registration number, registered office, and effective date of the transfer.

Support email: hello@lanesra.ai

Billing email: hello@lanesra.ai

Lanesra AI is organized in the Republic of the Marshall Islands. Depending on our operational arrangements and the individuals and markets concerned, the EU General Data Protection Regulation (“GDPR”) may apply to some processing activities. Where Article 27 GDPR requires an EU representative, the representative identified above acts as a contact point and is not the controller.

1. Scope

This Policy applies when you:

• visit our website or interact with our online content;
• request information, join a waitlist, register, start a Trial, create an account, or use the Service;
• communicate with us, subscribe to updates, book a meeting, attend an event, or interact with sales or support;
• purchase a subscription or otherwise make a payment;
• act as a customer, prospect, partner, supplier, contractor, or representative of an organization; or
• apply for a role or otherwise participate in recruitment.

This Policy does not govern personal data that a customer submits to the Service and for which the customer determines the purposes and means of processing. In that situation, the customer is normally the controller and Lanesra AI acts as its processor under a Data Processing Addendum.

2. Personal Data We Collect

Depending on your relationship with us, we may collect the following categories:

• Identity and contact data, such as name, business email, telephone number, job title, employer, country, and business address;
• Account data, such as workspace, organization, user identifier, role, login records, authentication information, and account preferences;
• Customer and commercial data, such as plan, contract, subscription status, communications, support history, meeting notes, and customer relationship records;
• Billing and transaction data, such as billing contact, billing address, tax information, payment status, invoice number, amount, currency, payment token, card brand, expiry, and last four digits. We do not normally receive full card numbers or security codes;
• Product and Customer Content, such as prompts, URLs, project names, brands, keywords, files, instructions, results, reports, exports, and other information entered or generated in the Service;
• Usage and device data, such as IP address, device type, browser, operating system, timestamps, pages, clicks, feature events, logs, crash information, session information, approximate location derived from IP, and security events;
• Marketing and communications data, such as subscriptions, consent records, campaign source, email opens and clicks where permitted, preferences, messages, and meeting bookings;
• Recruitment data, such as CV, application, work history, education, qualifications, interview notes, references, compensation expectations, and work authorization; and
• Other information you choose to provide or that we receive lawfully from public sources, business data providers, partners, or the organization you represent.

3. How We Collect Personal Data

We collect personal data:

• directly from you when you complete forms, create an account, use the Service, communicate with us, book meetings, or apply for a role;
• automatically through servers, logs, cookies, pixels, software development kits, analytics tools, and security systems;
• from your employer, account administrator, colleague, partner, referral source, or other person who provides access or introduces you;
• from payment processors, authentication providers, customer relationship systems, support systems, scheduling providers, and other service providers; and
• from lawful public or commercial sources, such as company websites, professional networks, public directories, and business contact databases.

4. Purposes and Legal Bases

Where the GDPR applies, we rely on one or more of the legal bases described below. Where another privacy law applies, we use the equivalent basis permitted by that law.

4.1 Website Delivery and Security

We process network, device, browser, IP, request, and log information to deliver the website, maintain availability, prevent abuse, detect security incidents, troubleshoot, and protect our systems. The GDPR legal basis is our legitimate interest in operating a secure and functional website and, where applicable, taking steps requested before entering a contract.

4.2 Cookies, Analytics, and Advertising

We use essential technologies required to provide, secure, remember, and operate the website or Service. Where required, we use analytics, advertising, remarketing, session-replay, or similar non-essential technologies only after consent. You can withdraw or change consent through the cookie-preference tool. Refusing non-essential cookies does not prevent basic website access, although some optional functionality may be unavailable.

The GDPR legal bases are legitimate interests or contractual necessity for strictly necessary technologies and consent for non-essential tracking where consent is required. The cookie banner and Cookie Policy provide more specific information about current technologies and retention periods.

4.3 Registration, Trial, Authentication, and Account Administration

We use identity, contact, account, login, organization, device, and security information to create and administer accounts, verify access, provide the three-day Trial, manage workspaces, prevent duplicate or abusive Trials, communicate account information, and protect accounts. The GDPR legal basis is performance of a contract or steps requested before entering a contract, together with our legitimate interest in security and fraud prevention.

4.4 Providing and Improving the Service

We process Customer Content, account information, product events, logs, results, and technical information to deliver functionality, generate reports and outputs, maintain integrations, personalize permitted settings, troubleshoot, measure performance, understand feature usage, develop improvements, and support customers. The GDPR legal bases are contract performance and our legitimate interests in maintaining, securing, and improving the Service.

We may use aggregated or de-identified information that does not identify an individual or customer for analytics, benchmarking, product development, and business planning. We do not use confidential Customer Content to train a generalized public model unless the relevant customer expressly agrees in writing.

4.5 Customer Support and Communications

We use names, contact details, account data, message content, attachments, logs, and support history to answer inquiries, diagnose issues, provide customer success services, manage complaints, and maintain relationship context. The GDPR legal bases are contract performance, steps requested before entering a contract, and our legitimate interests in providing support and managing relationships.

4.6 Marketing, Newsletters, and Sales

We may use business contact information, company information, interaction history, interests, source information, and communication preferences to send requested updates, respond to demo requests, conduct business-to-business outreach where permitted, manage campaigns, measure engagement, and maintain customer relationship records. We rely on consent where required and otherwise on legitimate interests in promoting our business to relevant professional contacts, subject to applicable direct-marketing rules and your right to object.

You may unsubscribe using the link in a marketing email or contact us. Unsubscribing from marketing does not stop essential account, security, billing, legal, or service communications.

4.7 Meetings and Events

We process booking details, availability, questions, meeting links, notes, recordings where separately disclosed, and follow-up actions to schedule and conduct meetings, demos, interviews, webinars, and events. The GDPR legal bases are consent where required, contract-related steps, and legitimate interests in business communications and record keeping.

4.8 Billing, Payments, and Accounting

We process billing contacts, transaction data, tax details, payment status, invoice records, subscription changes, cancellations, and limited payment-method information to activate paid plans, collect charges after the Trial, process renewals, detect fraud, administer the no-refund policy, resolve billing errors, and comply with accounting, tax, and legal duties. The GDPR legal bases are contract performance, legal obligations, and legitimate interests in fraud prevention and financial administration.

Payment card data is generally collected directly by our payment processor. We normally receive a payment token and limited card metadata rather than the full card number or security code.

4.9 Legal, Compliance, and Protection

We may process information to establish, exercise, or defend legal claims; enforce agreements; investigate suspected fraud, abuse, security incidents, or unlawful conduct; comply with court orders and lawful government requests; conduct audits; and meet sanctions, export-control, tax, corporate, and regulatory obligations. The GDPR legal bases are legal obligation and legitimate interests in protecting our rights, users, systems, and business.

4.10 Recruitment and Contractor Engagement

We process application and professional information to assess candidates, communicate, schedule interviews, obtain references where permitted, make hiring or contracting decisions, and maintain legally required records. The GDPR legal bases are steps requested before a contract, legitimate interests in recruitment, consent where specifically requested, and legal obligations.

5. Cookies and Similar Technologies

Our website and Service may use:

• Strictly necessary technologies for security, authentication, load balancing, preferences, checkout, and core functionality;
• Analytics technologies to understand traffic and product usage;
• Advertising and conversion technologies to measure campaigns or show relevant advertisements;
• Session, support, or diagnostic technologies to understand issues and improve usability; and
• Embedded content or integrations that may place or access information on your device.

Non-essential technologies will be activated only in accordance with the consent choices and laws applicable to the user.

6. Recipients and Service Providers

We may disclose personal data to the following categories of recipients where necessary for the purposes described in this Policy:

• cloud hosting, database, storage, content-delivery, and infrastructure providers;
• authentication, identity, security, monitoring, logging, and error-detection providers;
• AI model, search, API, data-source, and integration providers used to deliver requested functionality;
• analytics, product intelligence, cookie-consent, advertising, and conversion providers;
• email, communications, customer relationship management, support, scheduling, and collaboration providers;
• payment, billing, tax, accounting, banking, and fraud-prevention providers;
• professional advisers, auditors, insurers, corporate service providers, and legal representatives;
• affiliates, investors, lenders, acquirers, or transaction counterparties in connection with financing, restructuring, merger, acquisition, or asset sale, subject to appropriate confidentiality; and
• courts, regulators, law-enforcement bodies, tax authorities, or other persons where required or permitted by law.

Service providers acting as processors may process data only under our documented instructions and contractual safeguards, except where they independently determine purposes required by law. We maintain a current list of material subprocessors or providers below.

Not every subprocessor receives data for every customer. Lanesra may enable, disable, or route a request to one or more model providers depending on the selected product feature, workspace configuration, availability, and customer instructions. Where a provider is not enabled for a customer workspace, Lanesra does not send that workspace’s Customer Data to that provider.

The references to GPT, Claude, Gemini, Grok, and Perplexity below concern business or developer API services. Consumer accounts and consumer chat products are not approved production subprocessors for Lanesra.

Operational safeguards and customer controls

Lanesra will use business, enterprise, or paid API arrangements and will not route production Customer Data through consumer chatbot accounts.

Lanesra will configure providers not to use Customer Data for model training where the provider offers such controls, and will not voluntarily opt in to provider training or data-sharing programs without a documented lawful basis and appropriate customer notice.

Customers should not submit special-category data, highly sensitive data, regulated health data, payment-card data, authentication secrets, or confidential personal data unless the applicable order form and DPA expressly permit that processing and appropriate safeguards have been agreed.

Lanesra may apply data minimisation, redaction, pseudonymisation, caching controls, regional routing, or Zero Data Retention settings depending on the customer plan and technical availability.

Model outputs may be inaccurate or incomplete and should be independently reviewed before decisions or external use.

Changes and objections

Lanesra may update this list when it adds, replaces, or removes a subprocessor. Where required by the applicable DPA, Lanesra will provide advance notice through the Service, by email. A customer may object to a new subprocessor on reasonable data-protection grounds within the period specified in the applicable DPA. Lanesra and the customer will work in good faith to address a valid objection, which may include disabling the affected feature or terminating the affected service where no reasonable alternative is available.

7. International Data Transfers

Lanesra AI is organized in the Republic of the Marshall Islands, and our providers may operate in the Marshall Islands, the United States, the European Economic Area, the United Kingdom, and other countries. As a result, personal data may be processed outside the country where you are located.

Where the GDPR applies and personal data is transferred from the European Economic Area to a country that has not been recognized as providing adequate protection, we use an approved transfer mechanism where required, such as the European Commission’s Standard Contractual Clauses, together with supplementary measures where appropriate. We may also rely on an adequacy decision, an applicable certification framework, or a permitted statutory derogation.

You may contact us for information about the relevant transfer safeguards, subject to protection of confidential and security-sensitive information.

8. Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including contractual, security, accounting, tax, dispute, and legal requirements. Retention depends on the type of information and relationship.

• Account and Customer Content: generally for the active account or subscription period and a limited post-termination period to support export, restoration, dispute handling, and deletion workflows, subject to backups and legal duties;
• Trial records: for a reasonable period to administer the Trial, prevent repeated or abusive Trials, resolve billing issues, and maintain security records;
• Billing and transaction records: for the period required by applicable tax, accounting, corporate, and anti-fraud rules;
• Support and customer relationship records: for the active relationship and a reasonable period afterward based on business and legal needs;
• Marketing records: until consent is withdrawn, an objection is made, the contact becomes inactive, or the data is no longer relevant, while maintaining a suppression record where necessary to honor opt-outs;
• Security and technical logs: for periods proportionate to security, troubleshooting, fraud prevention, and operational needs;
• Cookie data: for the durations stated in the consent tool or Cookie Policy; and
• Unsuccessful recruitment records: generally for up to six months after the process unless a longer period is required or permitted by applicable law or you consent to a talent-pool period.

When the retention period ends, we delete, anonymize, or securely isolate the data, subject to reasonable backup cycles and legal holds.

9. Security

We use technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Measures may include access controls, encryption in transit, secure credential management, logging, backups, vulnerability management, vendor diligence, least-privilege practices, and incident-response procedures, as appropriate to the risk and maturity of the Service.

No transmission or storage system is completely secure. You are responsible for protecting login credentials, using appropriate account controls, and notifying us promptly of suspected compromise.

10. Your Rights

Depending on applicable law, you may have rights to:

• request access to personal data and information about its processing;
• request correction of inaccurate or incomplete data;
• request deletion of personal data;
• request restriction of processing;
• object to processing based on legitimate interests, including direct marketing;
• receive certain data in a portable format and transmit it to another controller;
• withdraw consent at any time without affecting prior lawful processing;
• not be subject to qualifying decisions based solely on automated processing; and
• lodge a complaint with an applicable supervisory authority.

To exercise a right, contact the privacy email above. We may need to verify identity and authority before acting. Rights may be limited by applicable exceptions, including legal obligations, confidentiality, the rights of others, and legal claims.

If you are in the European Economic Area, you may complain to the data-protection authority in the country of your habitual residence, place of work, or alleged infringement.

11. Automated Decision-Making

We do not currently use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals within the meaning of Article 22 GDPR. Product analytics, fraud signals, lead scoring, or recommendations may involve automation but are not intended to make such decisions without meaningful human involvement. If this changes, we will provide the notices and safeguards required by law.

12. Children

The Service is a business service and is not directed to children. We do not knowingly collect personal data from children through the Service. If you believe a child has provided personal data without appropriate authorization, contact us so we can investigate and delete it where required.

13. Third-Party Services and Links

The website or Service may link to or integrate with third-party websites, AI models, platforms, or applications. Their privacy practices are governed by their own notices unless they act solely as our processor. We are not responsible for independent third-party privacy practices.

14. Changes to This Policy

We may update this Policy to reflect changes in the Service, providers, business operations, or law. We will update the “Last Updated” date and, where appropriate, provide additional notice through the Service, website, or email. Material changes will apply prospectively unless law permits or requires otherwise.

15. Contact Us

For questions, complaints, or requests relating to privacy, contact:

General/support: hello@lanesra.ai