Your Customer Content stays yours. We use it to provide the features you request, we do not sell personal information, and you control who can access your recordings.
Scope and our role
This Privacy Policy explains how Lassu collects, uses, discloses, stores, and protects personal information when you use our websites, applications, recording and sharing tools, APIs, AI features, and related services (the “Services”).
For account administration, service operations, security, billing, and our own analytics, Lassu acts as the controller or business responsible for personal information. When an organization uses Lassu to process Customer Content on its behalf, that organization is generally the controller or business and Lassu acts as its processor or service provider. In that case, direct a request about Customer Content to the organization or workspace Administrator first.
This Policy does not cover third-party products or websites, even if linked from Lassu. Their privacy policies apply to their processing.
Information we collect
Information you provide
- Account and profile data: name, email address, avatar, sign-in method, account preferences, and workspace membership.
- Customer Content: recordings, screen and camera video, microphone and system audio, screenshots, titles, edits, comments, transcripts, prompts, AI Outputs, files, and sharing permissions.
- Workspace data: organization or workspace name, member and invitee details, roles, access grants, and administrative settings.
- Billing data: plan, subscription status, billing identifiers, invoice metadata, and transaction status. Payment card details are collected and handled by our payment provider rather than stored by Lassu.
- Communications: support requests, feedback, survey responses, program applications, and other messages you send us.
- Integration data: information you authorize us to receive from or send to a connected service, such as an identity provider.
Information collected automatically
- Device and connection data: IP address, device and browser type, operating system, app version, language, and approximate region derived from connection data.
- Service activity: sign-ins, feature interactions, upload and processing events, sharing settings, view and comment activity, errors, performance data, and security events.
- Cookies and local storage: session, security, preference, and—where enabled—analytics technologies needed to operate and understand the Services.
We design product analytics to avoid screen contents, recording titles, comment bodies, raw IP addresses, and full referrer URLs where they are not needed. We may collect privacy-minimized or aggregated view data to show engagement and protect against abuse.
Where information comes from
We receive information directly from you; from workspace owners, Administrators, and other users who invite or share with you; automatically from your use of Lassu; from connected services you authorize; and from vendors that help with identity, payments, email delivery, hosting, security, analytics, and support.
How we use information
We use personal information to:
- provide recording, upload, processing, editing, playback, sharing, workspace, search, comments, analytics, and AI features;
- create and secure accounts, authenticate users, and administer workspaces and subscriptions;
- process transactions and send service, billing, security, and legal communications;
- support users, troubleshoot errors, monitor performance, and maintain reliability;
- prevent fraud, spam, infringement, misuse, and security incidents; investigate content or account signals; and enforce our Terms;
- understand and improve features using aggregated or privacy-minimized analytics;
- comply with law, valid legal process, and our contractual obligations; and
- establish, exercise, or defend legal claims.
We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not use Customer Content to target ads.
Legal bases
Where applicable law requires a legal basis, we rely on:
- Contract: processing needed to provide the Services you request and perform our Terms or an Order.
- Legitimate interests: securing, maintaining, supporting, and improving Lassu; preventing abuse; and communicating about the Services, where those interests are not overridden by your rights.
- Consent: for optional analytics, marketing, or other processing where consent is required. You may withdraw consent prospectively.
- Legal obligations and rights: processing needed to comply with law or protect rights, safety, and security.
Data storage and subprocessors
Lassu uses a limited group of infrastructure, storage, database, AI, identity, and analytics providers. The data each provider receives depends on the feature you use and the configuration of your workspace.
| Provider | Purpose | Information processed |
|---|---|---|
| Porter | Application hosting and compute | Customer Content and service data processed by Lassu's web, API, administration, and media workloads |
| Cloudflare | Private object storage, content delivery, and network security | Recordings, screenshots, derived media, upload and playback requests, and connection metadata |
| Google Cloud | Identity and cloud services | Account identifiers and information used for Google sign-in or other Google-powered features you enable |
| OpenAI | Optional AI features | Only the Input, relevant Customer Content, instructions, and service metadata needed to provide the AI feature you request |
| PostHog | Product analytics and feature measurement | Account or workspace identifiers, device information, and privacy-minimized feature and performance events where analytics is enabled |
| MongoDB | Managed application database | Accounts, workspaces, content metadata, permissions, comments, subscription status, processing state, and security records |
Where data is kept
Media objects are primarily stored in private Cloudflare object storage. Application and content metadata are primarily stored in MongoDB. Porter-hosted workloads process data to operate the Services and may hold temporary working files during upload, recovery, transcoding, thumbnail generation, and other media jobs. Selected information is sent to Google Cloud, OpenAI, or PostHog only when the relevant feature or analytics setting is used.
We may also use providers for payment processing, transactional email, authentication, support, and professional services. Those providers receive only information reasonably needed for their function. We may update providers as Lassu evolves and will give notice of material changes where required by contract or law.
AI data use
When you invoke an AI Feature, we send the Input and only the related Customer Content needed to perform your request to OpenAI. Depending on the feature, that may include audio, a transcript, selected text, titles, prompts, or prior Output. Do not submit information to an AI Feature unless you have the right to process it in this way.
Lassu does not use Customer Content to train a generalized AI model unless the Customer expressly opts in. We use business/API offerings and available provider data controls intended to prevent API data from being used for general model training. Providers may retain limited data for abuse monitoring or feature operation under their applicable terms, unless stricter retention controls apply.
AI Output can be inaccurate and may contain personal information derived from the Input. Review it before sharing or relying on it, and delete it when you no longer need it.
Retention and deletion
We keep personal information only as long as reasonably needed for the purposes described in this Policy, including to provide the Services, comply with law, resolve disputes, enforce agreements, and protect security. Retention depends on data type and workspace settings:
- Standard recordings and screenshots remain until you delete them. Deleted standard content is generally restorable from Trash for 30 days before permanent deletion.
- Disposable recordings are scheduled for permanent deletion 48 hours after finalization unless you convert them to standard retention before expiry.
- Account and workspace records remain while the account or workspace is active and for a limited period afterward as needed for legitimate business, security, and legal purposes.
- Upload, processing, and playback records are kept for the time needed to finish, recover, secure, or audit the applicable operation.
- Billing and transaction records may be retained for tax, accounting, fraud prevention, and legal requirements.
Deletion from active systems may not immediately remove data from encrypted backups, disaster-recovery copies, security records, or records we must preserve by law. We isolate such data from ordinary use and delete or render it inaccessible through normal retention cycles. De-identified information that cannot reasonably identify you may be retained.
International data transfers
Lassu and its providers may process information in countries other than the one where you live. Those countries may have different data-protection laws. Where required, we use contractual and organizational safeguards intended to provide an appropriate level of protection, such as approved standard contractual clauses or comparable transfer mechanisms. Contact us for more information about safeguards relevant to your data.
Security
We use reasonable administrative, technical, and organizational measures designed to protect personal information. These include access controls, encrypted network transport, private object storage, time-limited signed media links, credential and secret management, logging and monitoring, and deletion workflows appropriate to the Services.
No system is completely secure. Protect your credentials, use appropriate workspace and sharing settings, and contact allan+lassu@pageonelab.com if you believe an account or Customer Content has been compromised.
Your choices and controls
- Profile: update supported profile information in account settings.
- Sharing: choose public, team, or restricted access and control comments and downloads for supported content.
- Analytics: use privacy settings to control optional video or product analytics where the control is available.
- Integrations: disconnect third-party services through Lassu or the provider.
- Content: export, move to Trash, restore, or permanently delete supported Customer Content using available tools.
- Communications: opt out of marketing using the message instructions. You will still receive transactional, security, billing, and legal messages.
Browser privacy signals such as Do Not Track are not uniformly standardized. Where law requires and the signal applies to our practices, we recognize valid opt-out preference signals such as Global Privacy Control. Because we do not sell personal information or share it for cross-context behavioral advertising, there is ordinarily no sale or advertising share to opt out of.
Your privacy rights
Depending on where you live and subject to legal exceptions, you may have rights to know or access personal information, correct it, delete it, receive a portable copy, restrict or object to processing, withdraw consent, and appeal a denied request. You may also have the right to complain to your local data-protection authority. We will not discriminate against you for exercising a privacy right.
Submit a request to allan+lassu@pageonelab.com. Describe your request and the Lassu account or workspace involved. We may verify your identity and authority before acting. An authorized agent may submit a request where law permits, but we may require proof of authorization.
If Lassu processes Customer Content solely for an organization, we may direct the request to that organization and assist it under our contract. Some information cannot be deleted or disclosed when an exception applies, including where needed for security, legal compliance, another person's rights, or legal claims.
Children
The Services are not directed to children under 13, and we do not knowingly collect their personal information through direct account registration. Users must be old enough to enter into the Terms. If you believe a child has provided personal information unlawfully, contact us so we can investigate and take appropriate action.
Changes to this Policy
We may update this Policy to reflect changes in the Services, providers, law, or our practices. We will post the updated version and change the “Last updated” date. If a change materially affects your rights, we will provide additional notice as required, such as by email or in-product notice.
Contact us
For privacy questions, requests, or complaints, contact Lassu at allan+lassu@pageonelab.com. For security reports, contact allan+lassu@pageonelab.com.
If you use Lassu through an organization, its workspace owner or Administrator may be the best first contact for questions about its use of your Customer Content.