Privacy Policy

1. Definitions

• Builder: A user who creates and manages websites using the Lantanios platform.
• Visitor: An end user who visits or interacts with a website built on Lantanios.
• Platform: The Lantanios website builder, e-commerce engine, AI assistant, and associated services.
• Personal Information (PI): Any information that identifies or can be used to identify an individual, directly or indirectly.
• Sensitive Personal Information (SPI): As defined under CPRA Section 1798.140(ae), includes account login credentials, precise geolocation, and financial account information.
• Processing: Any operation performed on personal information, including collection, storage, use, disclosure, or deletion.

2. Information We Collect

We collect personal information both directly from you and automatically through your use of the Platform. We may also receive information indirectly through third-party services (e.g., payment confirmation data from Stripe, domain verification status from Cloudflare). When we receive data indirectly, we process it only for the purposes described in this policy.

2.1 Account Information

When you create a Lantanios account, we collect:

• Email address and display name (via Google OAuth or direct registration)
• Password (stored as a salted hash)
• Account type (Google user, local user)
• Account role (user, builder, admin — determines access level)
• Account creation and login timestamps
• Email verification status and verification tokens (temporary)
• Terms acceptance status and version accepted
• Theme and display preferences
• Phone number (optional, for account verification via SMS)
• SMS consent status and timestamp (whether you opted in to receive verification codes)
• Phone verification status

For Tenant users (Visitors who create accounts on Builder sites), we additionally collect:

• Associated site identifier (which Builder site the account belongs to)
• Saved addresses (if provided for shipping/billing purposes)

2.2 Payment and Billing Information

When you make purchases, subscribe to a plan, or set up a merchant account, we collect:

• Billing name and address (street, city, state, postal code, country)
• Payment method details (card brand, last four digits, expiration month/year, digital wallet provider name if applicable — full card numbers are collected and processed by Stripe, not by us)
• Stripe Link email (if you use Stripe Link for payment, a separate email associated with your Link account)
• Shipping address (if applicable)
• Shopping cart contents (items selected for purchase, stored temporarily)
• Transaction records (order amounts, items purchased, currency, timestamps)
• Refund records (refund amounts, reasons, and processing status)
• Subscription details (plan tier, billing interval, cancellation status)
• Account balance and credit transactions (for platform credits, AI usage budgets, and internal balance tracking)
• Stripe Connect account information (for Builders receiving payments: account type, business type, onboarding status, payout capability)

2.3 Domain Registration Information

When you register or transfer a domain through the Platform, we collect:

• Registrant contact information (full name, email, phone number, and physical address)
• Domain registration details (domain name, registration period, renewal dates, WHOIS privacy protection status)
• Transfer authorization codes (if transferring from another registrar)

This information is required by ICANN regulations and is transmitted to our domain registrar partners.

2.4 AI Assistant and Conversation Data

When you use the Lantanios AI assistant, we collect:

• User prompts and messages you send to the AI
• AI-generated responses and action plans
• Session metadata (session duration, token usage, cost, model used)
• Action execution logs (what platform actions the AI performed on your behalf)

Your AI conversations are sent to third-party large language model (LLM) providers for processing. See Section 5 for full details.

2.5 Analytics and Visitor Data

When you visit Platform public pages, sign up, start an initial plan purchase, or visit Builder sites, we may collect:

• Page views and navigation (URLs visited, referrer, time on page)
• Device information (device type, browser, screen resolution)
• Approximate location (country, derived from IP address)
• Network address (used transiently for traffic exclusions and coarse location; raw IP addresses are not stored in analytics event or session records)
• Session identifiers (cookie-based, or a random identifier held in the page's memory)
• Interaction events (clicks, scroll depth, form submissions, product views — as configured by the Builder)
• UTM and campaign parameters (source, medium, campaign, term, content)

Analytics may associate a Platform signup or initial plan purchase with its stored visit context. Platform analytics excludes the Builder and Admin workspaces.

First-party analytics measures Platform public pages and Builder sites. Visitors in the European Economic Area, the United Kingdom and Switzerland are measured without analytics cookies until they accept Analytics; other visitors can turn analytics cookies off in Privacy Choices and are then measured without them. Builders choose which analytics features are tracked on their sites and may configure IP addresses to exclude from analytics tracking; these IP addresses are stored in the site's analytics settings.

2.6 Affiliate and Referral Data

When you participate in or interact with the affiliate program, we collect:

• Affiliate application details (email, application text, IP address, user agent)
• Referral click data (IP address, user agent, country, device type, UTM parameters, referrer URL)
• Conversion data (transaction amounts, timestamps, associated affiliate codes, referred user email)
• Commission records (earnings, payout status, payout history)

Referral tracking data containing personal identifiers (IP, user agent, device) is anonymized after 3 months (approximately 90 days) from the date of the event.

2.7 User-Generated Content

When Builders create sites, we store:

• Site content (pages, text, images, layout configurations)
• Uploaded media (images, files, and associated metadata such as original filenames)
• Product catalogs (product names, descriptions, prices, variants)
• Collection and organizational data

2.8 Automatically Collected Information

When you access the Platform, we automatically collect:

• IP address
• User agent (browser type, version, operating system)
• Device viewport dimensions (screen height, width, touch capability)
• Geolocation data (only if a feature asks for it and you grant browser permission)
• Cookies and similar identifiers (see Section 6)
• Login activity timestamps

2.9 Sensitive Personal Information (California Residents)

Under the California Privacy Rights Act (CPRA), the following categories of Sensitive Personal Information may be collected:

• Account login credentials (email and password combination) — used solely for authentication
• Financial account information (Stripe Connect account data for Builders receiving payouts) — used solely to facilitate payment processing
• Precise geolocation (only if you grant browser location permission)

We use Sensitive Personal Information only for the purposes of providing the services you have requested, maintaining security, and complying with legal obligations.

3. How We Use Your Information

We use your personal information for the following purposes:

We do not sell your personal information for monetary consideration. Optional advertising tags and Platform server conversion sharing may involve "sharing" as defined under CPRA — see Section 10.2 for details.

4. How We Share Your Information

We share personal information only in the following circumstances:

4.1 Service Providers (Sub-Processors)

We use third-party service providers to operate the Platform. Each handles data under its own terms and privacy policy, which we do not control:

The list of sub-processors is at lantanios.com/sub-processors. It may change at any time, and that page is updated when it does.

4.2 AI Model Providers

See Section 5 for detailed information about AI data sharing.

4.3 Builder-Visitor Relationship

When Visitors interact with Builder sites:

• Builders can access analytics data about their site visitors (in anonymized or aggregated form, depending on configuration)
• Builders receive order and customer information for transactions on their sites
• Lantanios acts as a data processor on behalf of Builders for Visitor data

4.4 Legal Requirements

We may disclose personal information if required to:

• Comply with applicable law, regulation, or legal process
• Respond to lawful requests from public authorities
• Protect the rights, property, or safety of Lantanios, our users, or the public
• Enforce our Terms of Service

4.5 Business Transfers

In the event of a merger, acquisition, or sale of assets, personal information may be transferred to the acquiring entity.

5. AI Services and Third-Party Model Providers

The Lantanios AI assistant uses a multi-agent architecture that routes requests to third-party large language model providers. This section explains how your data is processed by these services.

5.1 Providers We Use

Every AI model request goes through OpenRouter, which passes it to the company that runs the model chosen for it. These are all the companies that can receive data from an AI request.

Which company receives a given request depends on the model chosen for it; the Terms of Service list the operator of each model. A single complex request may reach more than one of them. Not yet used for customer requests: Upstage, xAI, Anthropic, TypeSafe.

5.2 What Is Sent to AI Providers

• The text of your messages and prompts
• Platform context necessary to fulfill your request (e.g., site structure, page names, component types)

We do not add payment card numbers, passwords or domain registrant contact details to an AI request ourselves. Anything you, your site's visitors or an AI Agent types or attaches is sent as written, so do not put sensitive information in a prompt.

5.3 How AI Providers Handle Your Data

Each company that receives an AI request handles it under its own terms and privacy policy. We do not control those terms, and we make no promise about how any provider stores, uses, shares or deletes what it receives, including whether it uses it to improve its models.

Providers may be located anywhere in the world and may be subject to the laws of countries other than yours. If any of this matters for your content, do not use AI features for that content.

5.4 AI Data Retention

• AI conversation sessions are automatically deleted after 7 days of inactivity
• Action plans and checkpoints are retained until you delete them or your account is closed
• Token usage statistics are retained in aggregated form
• Other AI records, such as session summaries, saved knowledge and profile entries, request logs and audit logs, are kept for longer periods

5.5 Limitations

AI-generated content is informational only and may contain inaccuracies. It should not be relied upon as professional, legal, medical, or financial advice. You should not input sensitive personal information (such as health data, government identification numbers, or financial account credentials) into the AI assistant.

6. Cookies and Tracking Technologies

6.1 Cookies We Use

Essential Cookies (always active — required for the Platform to function):

Functional Cookies (enhance your experience):

Analytics Cookies (require consent where applicable):

Marketing Cookies (on unless you opt out, except in the EEA, UK and Switzerland, where they require your acceptance; see section 6.4):

6.2 Geolocation in Browser Storage

If a feature asks for your location and you grant browser permission, the Platform may store your coordinates in a browser cookie to provide that feature. Your browser asks you first. You can revoke the permission in your browser settings and clear the cookie by deleting your browser cookies.

6.3 Cookieless Tracking

When you are visiting from the European Economic Area, the United Kingdom or Switzerland and have not accepted Analytics, or when a site asks every visitor first, the Platform measures visits with a random identifier held only in the page's memory. This identifier:

• Is not derived from your device characteristics and is discarded when the page closes
• Is not kept across visits or sites
• Is used for aggregate analytics

6.4 Managing Your Cookie Preferences

Use Privacy Choices to review your choices. Outside the European Economic Area, the United Kingdom and Switzerland, advertising tags run unless you opt out; turning off personalized advertising or sending a Global Privacy Control signal switches the Google and Meta tags to those providers' limited data use modes and stops TikTok Pixel. In the EEA, UK and Switzerland, and on sites that ask every visitor, advertising runs only after you accept it. Platform server conversions use the same Marketing choice: restricted Google sends omit matching email, and restricted Meta sends are skipped. Analytics cookies have a separate choice; visits can be measured without them. You can also use:

• The compact privacy prompt shown to visitors in the EEA, UK and Switzerland
• The Privacy Choices link in the page footer
• Your browser's cookie settings

6.5 Do Not Track

The Do Not Track (DNT) browser signal is not a recognized standard and does not change how sites on the Platform measure visits. To opt out of personalized advertising, use Global Privacy Control or Privacy Choices.

7. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law.

When your account is deleted, we erase your profile, credentials, conversations, and content without undue delay, and replace identifying details — such as your email address, IP address, and browser identifier — in security and legal-acceptance records with a neutral marker, so that those records no longer identify you.

Records of orders, charges, subscriptions, and account ledger entries are retained as accounting evidence for the period required by tax and accounting law. Once your account record is erased, they carry only an internal identifier that no longer resolves to you. This retention is permitted by GDPR Article 17(3)(b) and equivalent provisions elsewhere.

A Builder account that still owns sites cannot be deleted until those sites are deleted, because deleting it would take live storefronts and their customers' records with it. Export your products first, delete each site, then request deletion. We record a receipt of each deletion — which records were touched and when — that contains no personal data.

8. Data Breach Notification

In the event of a personal data breach that affects your information:

Notification to you: Where the law requires it, we will notify affected individuals without undue delay.

Content of notification: Our breach notification will include: a description of the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, the measures taken or proposed to address the breach, and contact information for follow-up questions.

Notification to authorities: Where GDPR Article 33 requires it, we will notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of a breach involving personal data of EU/EEA or UK residents. We will also comply with breach notification requirements under CCPA, state breach notification laws, and any other applicable regulations.

9. Data Security

We use technical and organizational measures intended to protect your personal information, including:

• Password hashing: Passwords are hashed using PBKDF2 with per-user salts
• Analytics IP minimization: Raw IP addresses are not stored in analytics event or session records
• Access controls: Access to data is limited by role
• Automated security measures: The Platform employs automated request filtering to detect and block potentially malicious traffic patterns. These measures may result in access restrictions based on IP address and request behavior.

Payment card security: Payment card processing is handled by Stripe under Stripe's own terms.

No method of transmission or storage is 100% secure. If you become aware of a security vulnerability, please contact us at the address in Section 16.

10. Your Privacy Rights

Depending on your location, you may have the following rights regarding your personal information:

10.1 Rights Under GDPR (EU/EEA Residents)

If you are located in the European Economic Area, you have the right to:

• Access: Request a copy of the personal information we hold about you (Article 15)
• Rectification: Request correction of inaccurate or incomplete information (Article 16)
• Erasure: Request deletion of your personal information ("right to be forgotten") (Article 17)
• Restriction: Request that we limit how we process your information (Article 18)
• Portability: Receive your data in a structured, machine-readable format (Article 20)
• Objection: Object to processing based on legitimate interest (Article 21)
• Automated decision-making: Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects (Article 22). The Platform uses automated security and fraud controls (such as request filtering), based on our legitimate interest in platform security, which may restrict access.
• Withdraw consent: Withdraw previously given consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal

Legal basis for processing: We process your data under the following GDPR legal bases:

• Contract performance (Article 6(1)(b)) — to provide the Platform services you requested
• Legitimate interest (Article 6(1)(f)) — for security, fraud prevention, and service improvement
• Consent (Article 6(1)(a)) — for analytics cookies and marketing communications
• Legal obligation (Article 6(1)(c)) — for tax and financial record-keeping

Response timeline: We respond to a request without undue delay and in any event within one month of receiving it. Where the law allows, that period may be extended by two further months, and we will tell you if it is, with the reasons for the delay.

Supervisory authority: You have the right to lodge a complaint with your local data protection authority. A list of EU/EEA data protection authorities is available at the European Data Protection Board website (edpb.europa.eu). As Lantanios does not have an establishment in the EU, you may contact the DPA in your member state of residence.

Data Protection Officer: We have not appointed a Data Protection Officer as we have determined that the conditions under GDPR Article 37 do not currently apply to our processing activities. For all data protection inquiries, contact [email protected].

10.2 Rights Under CCPA/CPRA (California Residents)

If you are a California resident, you have the right to:

• Know: Request disclosure of the categories and specific pieces of personal information we have collected
• Delete: Request deletion of your personal information
• Correct: Request correction of inaccurate personal information
• Opt-out of sale or sharing: Opt out of the sale or sharing of personal information for cross-context behavioral advertising
• Limit use of sensitive PI: Request that we limit the use and disclosure of your Sensitive Personal Information to purposes necessary to provide the services you requested
• Non-discrimination: Exercise your rights without receiving discriminatory treatment

Sale and sharing disclosure (preceding 12 months): We have not sold personal information for monetary consideration. Configured advertising tags and Platform server conversions may involve "sharing" under CPRA. When enabled, the Platform may send Google and Meta stored signup and initial plan-purchase events, including event identifiers and times, available ad-click or browser identifiers, browser context and purchase value/currency. Meta also receives the conversion page URL. When personalized advertising is allowed, matching may include a one-way SHA-256 email hash; hashing does not make it anonymous. Google and Meta handle data under their own terms and privacy policies, which we do not control. Use Privacy Choices or Global Privacy Control to opt out. Restricted Google server sends omit matching email; restricted Meta server sends are skipped. Existing Google and Meta browser tags use their limited data use modes, and TikTok Pixel stops. Required-region visitors must accept Marketing before advertising runs. Accepting these legal documents does not accept Marketing. Essential referral attribution remains separate.

Sensitive Personal Information: We collect the following categories of SPI: account login credentials (email and password) and financial account information (for Builders using Stripe Connect). We use SPI only for the purposes of providing services you have requested and for security. Because our use of SPI is limited to these exempt purposes, the right to limit does not currently require a separate opt-out mechanism. If our practices change, we will provide a clear method to exercise this right.

How to opt out of sharing:

• Use the Privacy Choices link in the site footer and turn off personalized advertising
• Enable Global Privacy Control (GPC) in your browser — we honor GPC signals and show that the signal was honored

Response timeline: We will acknowledge your request within 10 business days and respond substantively within 45 calendar days (extendable by an additional 45 days with notice).

Authorized agents: You may designate an authorized agent to submit requests on your behalf. We may require verification of the agent's authority and your identity.

10.3 Rights Under UK GDPR (United Kingdom Residents)

UK residents have rights substantially similar to those under the EU GDPR (Section 10.1). Our supervisory authority for UK data protection matters is the Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk/make-a-complaint.

10.4 Rights Under Other Jurisdictions

If the data protection law of your jurisdiction gives you rights over your personal information, contact us using the information in Section 16 to exercise them.

10.5 How to Exercise Your Rights

To submit a privacy rights request, contact us at:

• Email: [email protected]
• Subject line: "Privacy Rights Request — [Your Request Type]"

We will verify your identity before processing your request. For account holders, we will verify through your authenticated session. For non-account holders, we may request additional information to confirm your identity.

Account deletion requests are fulfilled by our team, not by an automatic button, without undue delay after a verified request. Send the request from the email address on your account with the subject line "Privacy Rights Request — Delete Account". If you are a member or customer of a site built on Lantanios, the site owner is the controller of your data; you may contact them, or contact us and we will pass the request to them and act on their instruction. What deletion does, and what is retained, is described in Section 7.

10.6 Complaint Handling

If you have a complaint about how we handle your personal information, contact us at [email protected]. You also have the right to lodge a complaint with your local data protection authority (see Sections 10.1 and 10.3 for contact details).

11. International Data Transfers

Lantanios Solutions Inc. is based in the United States. If you access the Platform from outside the United States, your information will be transferred to and processed in the United States and potentially other countries where our service providers operate.

For transfers of personal information from the EU/EEA or UK to countries without an adequacy decision, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission (June 2021 version)
• UK International Data Transfer Addendum to those clauses

By using the Platform, you acknowledge that your information may be processed in jurisdictions with different data protection standards than your own.

12. Children's Privacy

The Platform is not directed at children under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at [email protected] and we will delete it where the law requires.

Builders are responsible for ensuring that their sites comply with applicable laws regarding children's privacy, including COPPA (United States) and GDPR age requirements (EU/EEA).

13. Health and Sensitive Data Disclaimer

The Platform is not designed to process, store, or transmit Protected Health Information (PHI) as defined by the Health Insurance Portability and Accountability Act (HIPAA) or equivalent health privacy regulations. Users should not submit health information, medical records, or other regulated health data through the Platform, including through Builder sites, the AI assistant, or any other Platform feature.

If you are a healthcare provider, health plan, or other covered entity under HIPAA, you should not use the Platform to process PHI. Lantanios does not enter into Business Associate Agreements.

14. Changes to This Policy

We may update this Privacy Policy at any time. Where the law requires your consent to a change, we will ask for it. If you do not agree with a change, stop using the Platform.

You are responsible for reviewing this policy periodically.

15. SMS and Phone Verification

If you choose to provide your phone number for account verification, the following applies:

15.1 Data Collected

• Phone number
• SMS consent status (whether you agreed to receive verification codes)
• Consent timestamp (date and time consent was provided)

15.2 Purpose

We use your phone number solely for the following purposes:

• Account verification during registration
• Two-factor authentication for account security
• Password reset verification

15.3 Third-Party Processor

SMS messages are delivered through AWS End User Messaging SMS, a third-party SMS delivery service, with Twilio retained as a backup SMS delivery provider. These providers receive your phone number and the message so that they can deliver it, and handle both under their own terms and privacy policies.

15.4 Data Retention

Your phone number and SMS consent records are retained until you delete your account or withdraw consent. You may remove your phone number at any time through your account settings.

15.5 Your Rights

• Opt out at any time: Reply STOP to any SMS message, or remove your phone number from your account settings
• Phone verification is optional: You are not required to provide a phone number to use the Platform
• Withdraw consent: Toggle SMS notifications off in your account settings at any time

16. Contact Information

If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, contact us at:

For EU/EEA data protection matters, you may contact your local supervisory authority. A directory is available at edpb.europa.eu.

For UK data protection matters, you may contact the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

For California privacy matters, you may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov.