Privacy Policy

Customer content and integrations: Depending on the features you use and permissions you grant, the platform may process:

• Contracts, table and column definitions, SQL, transformation logic and repository files
• Ownership, classification, lineage and dependency information
• Pipeline telemetry, run logs, quality results and incident details
• Prompts, conversations, documents and sample data you submit or authorise Studio or Zeus to access
• Integration tokens, provider keys or connection settings you supply for supported features

Metadata, logs and submitted files can contain personal or confidential information. Submit only information you are authorised to share. Use synthetic or sanitised samples where possible, and avoid including passwords or secrets in prompts, contracts and support messages.

Account Information (LakeLogic Platform): When you register, we collect:

• Email address
• Name and company name
• Billing information (processed securely via Stripe)

Usage Information: Standard log and device data (IP address, browser type, pages visited) and product-analytics events, as described in "Cookies & Tracking" below.

We use collected information to:

• Generate data lineage maps and documentation
• Provide AI-powered contract generation and incident resolution (Zeus)
• Analyze schema changes and detect breaking changes
• Maintain and improve the service using service-usage information; customer content remains subject to the applicable customer agreement
• Send important service updates and notifications

We do NOT sell, rent, or share your data with third parties for marketing purposes.

Where the UK GDPR / EU GDPR applies, we process personal data on these bases:

• Performance of a contract: to provide services where we have a contract with you. Where your organisation is the contracting party, account administration may instead rely on our legitimate interests in providing that service.
• Legitimate interests: to secure, operate, and improve the service, and for limited product analytics, balanced against your rights.
• Consent: for non-essential cookies/analytics and optional marketing emails. You may withdraw consent at any time.
• Legal obligation: to meet tax, accounting, and other statutory requirements (e.g. retaining billing records).

We implement industry-standard security measures:

• Protection: Encryption and access restrictions are used to protect hosted information and supported stored credentials
• Assurance: Contact us for current security documentation and independently verified certification status
• Access Controls: Role-based access with support for multi-factor authentication
• Backups: Automated backups with defined retention
• Infrastructure: The hosted platform uses Amazon Web Services; contact us for the processing locations applicable to your deployment

Our hosted infrastructure, AI services and other suppliers may process information in different locations depending on the deployment, provider and features used. Hosting in an EU region does not mean that all support, payment, analytics or other processing takes place there.

Where personal data is transferred internationally, we rely on appropriate safeguards ( such as the UK International Data Transfer Agreement / Addendum, EU Standard Contractual Clauses, or an adequacy decision) to ensure your data remains protected.

You have the right to:

• Access: Request access to your personal information, subject to applicable exceptions
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request erasure of your personal information, subject to applicable retention obligations and exceptions
• Portability: Export your data in machine-readable format
• Objection / Restriction: Object to or restrict certain processing
• Withdraw consent: Where processing is based on consent, withdraw it at any time

For information processed on a customer organisation's behalf, direct your request to that organisation; we assist it under our agreement. For our controller activities, contact us at privacy@lakelogic.io.

Right to complain: If you are in the UK, you may lodge a complaint with the Information Commissioner's Office (ICO). EU residents may complain to their local supervisory authority. We'd appreciate the chance to address your concerns first.

We retain personal information for the purposes described in this notice. Retention depends on the account relationship, the type of information, security needs, legal obligations and the time needed to resolve disputes.

Customer content, account closure, export and deletion are handled under the applicable customer agreement and data-processing terms. Backup copies may remain until their scheduled expiry and are restricted from ordinary use. Billing records may be retained separately to meet accounting and tax obligations.

Contact privacy@lakelogic.io for the retention arrangements applicable to your account. Requests to erase information are subject to applicable legal exceptions.

We use cookies and similar technologies for:

• Essential: Authentication and session management (required)
• Analytics: Google Analytics 4 (GA4), which sets cookies to measure aggregate, site-wide usage. Where consent is required, analytics is subject to your choice. You can change your choice via the cookie preferences ("Reject all" / Customize) shown on your first visit.

We do NOT use advertising or cross-site tracking cookies.

You can sign in with an email and password, an emailed sign-in link, or an account you already have with Google, Microsoft or GitHub. When you choose one of these, that provider tells LakeLogic your name, email address and, where available, your profile picture and account ID. LakeLogic uses this only to create your account, sign you in and keep your account secure. It is not sold or used for advertising. Service providers may process it to support these purposes, and LakeLogic never receives your password for these accounts.

Google: LakeLogic's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Enterprise single sign-on (SAML): if your organisation sets up single sign-on, your organisation's identity provider (for example Microsoft Entra ID or Okta) confirms who you are and sends LakeLogic your email address and name. Your organisation controls who can sign in this way and can require it for everyone at its email domains.

We use service providers and optional integrations for the purposes below. Their role as processor, sub-processor or independent controller depends on the service and applicable agreement:

• Amazon Web Services: Cloud hosting and email delivery (EU, Frankfurt)
• Google, Microsoft and GitHub: Sign-in, only when you choose to sign in with them
• Stripe: Payment processing (PCI DSS compliant)
• Google Analytics: Aggregate product/website analytics
• Cloudflare Turnstile: Bot protection on sign-up forms
• Microsoft (Microsoft 365 Bookings and Teams): Scheduling and hosting demo calls. When you book a demo, your name, email, company and booking answers are held in our Microsoft 365 account
• Amazon Web Services (Amazon Bedrock): LakeLogic's managed AI for Zeus and other AI features, in AWS EU regions. Requests can include prompts, contract definitions, relevant code, logs and content from files or samples you authorise the feature to use. Do not assume that a request contains metadata only

Contact us for the current supplier list, processing locations and applicable contractual safeguards. Optional identity and payment providers may also handle information under their own privacy notices.

Your own AI provider: if your organisation connects its own AI provider key (for example Azure OpenAI, OpenAI, Anthropic or Google), Zeus sends its requests to that provider under your organisation's own agreement with it, and LakeLogic's managed AI is not used for them.

LakeLogic is a business tool not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

Our AI features (Zeus) process the context supplied to them to suggest contracts, diagnose incidents, and surface insights. These are decision-support tools. They do not make decisions producing legal or similarly significant effects about you without human involvement. Customer content is used subject to the applicable agreement and provider configuration. For a provider connected by your organisation, review its retention, training and regional-processing settings before use.

We may update this policy periodically. We'll notify you of significant changes via email and display a notice in the app, and update the "Last updated" date above.