Privacy Notice

• Account and security data such as email, display name, password hash, sign-in/session records, IP address and user agent, used to authenticate you, prevent abuse, secure accounts and operate support.
• Requests and service content such as prompts, files, images, tool inputs, generated responses and optional memories, used to provide features you request. Saved chat history is handled separately as described below.
• Usage and routing metadata such as model, token counts, timing, route/cache information and request state, used for quotas, billing, reliability, capacity planning, fraud prevention and troubleshooting.
• Billing records such as Stripe customer/session/subscription identifiers, entitlement state, purchased-wallet ledger entries, refunds/disputes and reconciliation receipts. Lattice does not store full payment-card numbers.
• Support and feedback that you choose to submit, used to investigate the issue and improve reliability.

Go remains $10/month for the OpenAI-compatible API. Browser chat and related inference tools use an admin-only policy with a temporary exception for owner-selected noncommercial beta accounts. Buying Go does not unlock them or change the processing trust boundary. Any temporary beta access still requires the account owner to accept the current notices.

Do not submit sensitive personal information that is not necessary for the task. Optional memory, files, remote-provider routing and similar features should remain off unless you intentionally enable them and understand the data flow.

When content encryption is configured for an account, the browser encrypts saved conversation titles and message parts (including inline chat images), and the server rejects plaintext history writes on those configured-account paths. The content key is protected by your 24-word recovery phrase or recovery key file. Stored ciphertext alone does not let a database administrator read that encrypted history.

This is not a blanket guarantee for every account or stored item. Unconfigured accounts can save plaintext history. Legacy plaintext can remain while migration is incomplete; configuring a key does not itself encrypt or purge older copies, backups or other features. Your password does not unlock encrypted history. If you lose both recovery methods, the admin cannot recover that encrypted history. Ephemeral chats are not saved as conversation history, but usage metadata remains.

Files keep plaintext filename and ownership metadata in canonical SQL records; extracted document text and embeddings are stored in owner-scoped Qdrant collections for retrieval. Memory keeps plaintext text and lifecycle/history records in canonical SQL, with plaintext payloads and embeddings in Qdrant. These stores are access-controlled, not encrypted with your browser content key. Inline chat images are different from the Files feature.

Turning a feature off does not purge its stored data. Removing an individual memory or clearing all memories retains SQL text/history through soft deletion; index removal is a separate operation and individual index cleanup is best-effort. Those actions are not permanent erasure.

Browser encryption of stored history does not hide an active AI request from the Lattice server, inference gateway, worker or selected model runtime/provider. The active prompt, retrieved files/memories, tool inputs and generated response are readable along that processing path. Research and refinement also use server-readable working state; server-sealed refinement checkpoints are not browser end-to-end encryption.

Transport encryption, WireGuard and process sandboxing protect different boundaries. Host administrators, root or a hypervisor can inspect or replace processes and accelerator memory. Community/consumer GPU hosts are lower-trust compute, not provider-host-proof encrypted inference.

Model runtimes may retain content-derived prompt/KV state in memory after a request ends. A no-store policy or successful application deletion does not prove erasure of runtime memory. Cache isolation, retention and purge claims require separate operational evidence; this notice does not certify them.

While a chat or code view is open and visible, the browser can send a small presence beat about every 20 seconds, including the selected model and whether the message box is in use. It never sends what you type. These short-lived signals are kept in memory for a few minutes and are reduced to anonymous aggregate activity counts before they are sent to the inference gateway for capacity planning.

Data is disclosed only as needed to operate a feature or meet a legal/security obligation. Categories of recipients can include operator-controlled infrastructure and inference hosts; Stripe for checkout, subscription management and payment reconciliation; the configured email service for invitations or account recovery; GitHub when you choose GitHub sign-in; and an operator-approved remote model/provider only when that feature is explicitly enabled under Lattice policy.

Lattice does not sell personal data, share it for cross-context behavioral advertising, or use conversations to train or fine-tune models. There are no advertising trackers in the application. Essential session cookies and browser storage are used for sign-in, security, encryption/recovery state and preferences.

Saved content has no general automatic expiry schedule. Conversation deletion removes active SQL conversation rows; Files deletion requests chunk removal in the current Qdrant collection and removes SQL metadata. Memory removal instead retains SQL text/history for restore. Switching off a feature or resetting a content key is not a purge of Files, Memory, backups or providers.

Account deletion first checks role, financial history and enrolled nodes, then requests node revocation, runtime-cache and current vector-collection cleanup before deleting the SQL user row and its cascading records. Admin accounts and accounts with financial history are blocked by the self-service path. Billing closure and a reviewed retained-records decision are needed; this is not a statement that every financial record has a legal retention duty or a fixed retention period.

A successful application response is not proof of physical erasure across legacy/versioned collections, SQL backups/WAL, snapshots, logs, runtime/accelerator memory, browser exports or vendors. Retention periods and purge evidence for those copies are not established here. Until they are established and verified, Lattice must not claim complete physical deletion or a deletion deadline. Contact the operator to request a scoped purge and receive an explanation of any retained data or incomplete cleanup.

From Account, signed-in users can download an account export and request account deletion with the limits above. Profile settings allow correction of your display name; contact the operator to correct account data that is not self-service.

Depending on where you live and whether the applicable law covers the service, you may also have rights to confirm processing, access, correct, delete or obtain a portable copy of personal data, and to opt out of certain sale, targeted-advertising or profiling uses. Lattice does not presently sell data or use it for targeted advertising, so those opt-outs are satisfied by not engaging in that processing.

Send other privacy requests to the published privacy contact. The operator may verify identity before disclosing or deleting data. If a request is denied, reply with Privacy appeal to request review. Where Delaware law applies, a denied appeal will include a way to contact the Delaware Department of Justice.

Lattice is for adults age 18 or older and new accounts require an adult-age attestation. The service is not directed to children. If the operator learns that an account belongs to a child, ordinary processing should stop while the operator determines the deletion, parental-consent or other legal steps required.

Lattice uses account authentication, tenant scoping, encryption, request limits, audited billing controls and fail-closed production gates, but no online service can promise absolute security. Suspected vulnerabilities should be reported privately as described in the security policy.

Material changes to data handling require this notice and its version to be updated. New password signups record the version acknowledged at signup. Existing or imported profiles can have no recorded acknowledgement; viewing this notice or signing in through GitHub does not supply one. Questions, privacy requests and appeals use the contact below.