This Privacy Policy explains how Lasques, Inc. (las/ques) handles personal information in the Services described in the Terms of Service. Contact us at [email protected] about this policy or a privacy request.
1. Our role
Lasques handles account, security, billing, support, and service-administration information for its own purposes. When an organization provides personal data in workspace content and determines its purposes, the organization is responsible for that data and Lasques processes it to provide the Services. The Data Processing Addendum applies where its conditions are met.
2. Information we process
We process information you provide: account and profile details, email address, authentication information, organization memberships and invitations, research goals, prompts, documents, datasets, media, code, comments, and support messages. Research activity also produces agent histories, model and tool calls, outputs, metrics, evidence, reports, knowledge usage, and credit transactions.
We process payment and subscription identifiers, purchase history, invoices, plan information, and payment status. Stripe processes payment details; Lasques does not store full card numbers.
Service and security records may include IP addresses, request and device information, authentication and session events, operational logs, and error reports. Optional analytics and monitoring depend on the configured services. See the Cookie Policy.
If you use a supported external sign-in provider, we receive the account information supplied through that sign-in. People may also provide your email address to invite you to an organization, research, repository, or expert review.
3. Purposes and legal bases
We use information to provide accounts and workspaces, execute research and chat requests, search documents and knowledge, generate reports, manage permissions, process payments, deliver invitations and transactional emails, support users, prevent abuse, investigate failures, and comply with legal obligations.
Where applicable law requires a legal basis, these activities rely on performing our contract, legitimate interests in operating and protecting the Services, compliance with legal obligations, or consent where required. You may withdraw consent for consent-based processing without affecting earlier lawful processing.
4. AI processing and external research sources
Providing research and chat features requires sending relevant prompts and content to configured AI infrastructure, creating embeddings, and executing code. Agents may send research-derived queries to external scientific sources and fetch public data. Do not submit secrets or prohibited sensitive information to prompts, documents, or code.
As stated in the Terms, we do not use private User Content or private Outputs to train generative AI foundation models. Public Content, de-identified or aggregated information, operational metadata, and feedback may be used as described in the Terms. This statement is not a representation about the policies of an independent service you choose to use outside Lasques.
5. Visibility and sharing
Workspace content is made available to the users and collaborators authorized for it. Organization owners and admins control organization membership and content. A file shared by link can be accessed according to its sharing settings.
When you publish content, research, repositories, claims, knowledge, profiles, and attribution records may become publicly accessible and searchable. Public knowledge can be reused by others and can produce persistent citations, derived results, verification records, and corrections. Changing visibility later does not necessarily remove earlier lawful copies or derived records. The Terms explain the relevant licenses.
We share information with service providers as needed to operate the Services, when you direct us to share it, to comply with law or protect rights and security, or in connection with an applicable business transaction. Access to private content is limited to service purposes, authorized access, and the circumstances described in this policy and the Terms.
6. Retention and deletion
We retain information for the purposes for which it is needed, including operating your account, preserving research provenance, investigating abuse, meeting accounting or legal obligations, and resolving disputes. Retention depends on the record and the applicable requirement; this policy does not promise one fixed retention period for all data.
Account or content deletion is subject to workspace ownership requirements, shared evidence, applicable licenses, legal retention, and backup lifecycles. Public citations or derived records may remain where permitted, with personal information removed or de-identified where required by law. Keep independent copies of material you need.
7. Your choices and rights
You can use account and workspace settings to update information, manage access, change available visibility settings, and request deletion. Organization members should contact their organization administrator about content controlled by that organization.
Depending on applicable law, you may request access, correction, deletion, portability, restriction, or objection to processing, and may complain to the relevant privacy regulator. Email [email protected] with enough information to identify your account and request. We may verify identity and authority before acting. We will respond within applicable legal requirements; some requests are subject to lawful exceptions.
8. Security and international processing
We use access controls and the service isolation and storage arrangements described in the Services, but no system is completely secure. Protect your credentials and Git tokens and report suspected unauthorized access promptly.
Our providers may process data in countries other than yours. Applicable transfer requirements depend on the data, provider, and processing arrangement. Contact us for information about the arrangement relevant to your account. This policy does not claim a particular certification, data-residency guarantee, or transfer mechanism that has not been agreed or established.
9. Children and restricted data
The Services are for adults as set out in the Terms. If you believe a child has provided information, contact us. Do not upload protected health information or other prohibited sensitive data except where an express written agreement permits it or it has been lawfully de-identified as required by the Terms.
10. Changes and contact
We will post an updated policy when our practices change and provide additional notice where required. Contact Lasques, Inc. at [email protected]. The English version governs subject to mandatory law.