Lattice Privacy Notice
Version: 2026-10-22 Effective date: 22 October 2026
1. Who is responsible for your data
Lattice Holdings LLC, 1118 Thompson Road, Alabaster, AL 35007 ("Lattice", "we") runs Lattice Personal and decides how your personal data is used (it is the "controller" under European and UK law, and the "business" under California law). Contact: privacy@latticesuite.io.
Where this service is offered. Lattice Personal is currently offered only to people in the United States. Before we offer it in the European Economic Area or the United Kingdom we will appoint representatives there and update this notice; the parts of it written for those regions apply from then. We have not appointed a data protection officer because the law does not require one for what we do; privacy@latticesuite.io reaches the person responsible.
This notice covers Lattice Personal accounts. Business accounts provided by an employer or school are covered by that organisation's agreement with us.
2. What we collect
| What | Why | Where it comes from |
|---|---|---|
| Email address | To prove the account is yours, sign you in, send security messages and recover access | You |
| Name you give us | To show who you are inside the Service | You |
| Password | To sign you in. We store only a salted one-way hash, never the password itself | You |
| Authenticator and recovery details (if you turn them on) | Second-step sign-in and account recovery. Authenticator secrets are encrypted | You |
| Your content: documents, spreadsheets, presentations, files and their recent versions | To provide the Service | You |
| Sign-in and security records: when you signed in or changed security settings, session information | Security, fraud and abuse prevention, and showing you your own security history | Generated by the Service |
| Consent record: the terms and privacy versions you agreed to, that you confirmed your age, and when | To show you agreed and to meet legal duties | You |
| Network information: your IP address as seen when you use the Service, and request details such as time and page requested | To run and secure the Service, rate-limit abuse and diagnose faults. For abuse limits we keep only a keyed, one-way code derived from your address (for IPv6, from its network part), not the address itself | Your device |
| Email delivery results: whether a message we sent was delivered, bounced or marked as spam | To avoid sending mail to addresses that cannot receive it and to protect our sending reputation | Our email provider |
| Plan and payment details (only if you buy a paid plan): the plan, amount, dates, billing country, the last four digits of your card and a payment reference | To take payment, issue receipts, handle renewals and refunds, and meet tax and accounting duties | You and our payment provider |
Your card number is entered with our payment provider and is not stored by us. We do not collect data from advertising networks and the Service contains no advertising or analytics trackers. We do not ask you for special categories of data (for example health or political opinions), but what you put in your own documents is up to you; we treat it only as content to store and show back to you.
3. How we use it, and the basis for doing so
| Purpose | Legal basis (EU/UK) |
|---|---|
| To provide the Service you asked for (account, sign-in, storing and showing your content, paid plans) | Performance of a contract with you |
| To keep the Service secure and prevent abuse (rate limits, fraud and bot checks, suspensions, diagnosing faults) | Our legitimate interests in running a safe service, balanced against your rights |
| To send messages about your account: one-time codes, security notices (for example that your password or authenticator changed), renewal reminders and service notices | Performance of a contract; legitimate interests |
| To meet legal duties and handle legal claims, including tax and accounting records | Legal obligation; legitimate interests |
We do not send marketing email. If we ever do, we will ask for your consent first and you can withdraw it at any time. We do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not use your content to train AI models.
We use automated limits and checks to block abuse (for example too many sign-up attempts from one network). They do not produce legal or similarly significant effects on you beyond refusing a request or a sign-in; if you think you were blocked wrongly, write to support@latticesuite.io and a person will review it.
4. Who we share it with
We use service providers to run Lattice, acting on our instructions:
- Amazon Web Services hosts the Service in the United States (us-east-1): databases, file storage (encrypted at rest), email sending (Amazon SES), network protection and logging.
- Stripe, Inc. processes payments for paid plans. It receives your card details, billing country and the plan you buy, and tells us whether a payment succeeded. Stripe is a separate controller for some of that data under its own privacy policy.
We disclose data to authorities only when the law requires it or to protect people from serious harm, and we review such requests. We may share data with a buyer or successor if we are reorganised, with notice to you. In the last 12 months we have not sold or shared personal information as those terms are defined in California law.
5. How long we keep it
| Data | How long |
|---|---|
| Account details and your content | While your account is open. After you close it, removed from live systems within 30 days |
| Backups | Rolling backups kept for up to 40 days; deleted content ages out of them, so it is fully gone within 40 days after removal from live systems |
| One-time sign-up codes | Valid for 30 minutes, then unusable; records of them are kept while your account exists and deleted when it is closed |
| Abuse-limit counters | Hours to days; they hold one-way codes only |
| Security and audit records about your account (sign-ins, security changes, your consent) | Kept as a permanent log that cannot be altered, so that we can investigate abuse and show that you agreed. When you close your account we remove your email address, name and every other detail that could identify you from what those records point to, so they no longer identify anyone. They contain no content from your documents |
| Network and web-firewall logs | 30 days, with cookies and query strings removed |
| Payment and tax records (paid plans only) | 7 years, as tax and accounting law requires |
6. Cookies
We use only the cookies needed to keep you signed in and to protect sign-in forms from forgery. They are set by the Service for your session, are not readable by scripts and are not used for tracking. Because they are strictly necessary, we do not show a cookie banner. We do not track you across other sites; we nonetheless treat a Global Privacy Control signal from your browser as a request to opt out of any sale or sharing.
7. Security
We protect your data with encryption in transit and at rest, one-way password hashing, rate limiting, optional second-step sign-in, separation between our systems, and limited, audited staff access. No system is perfectly secure; tell us at security@latticesuite.io if you find a problem. If a breach affects you we will tell you, and the relevant authority, as the law requires (in the EU and UK, authorities within 72 hours where the law requires it).
8. Your choices and rights
Everyone. You can see and correct your name and security settings in the Service, export your documents, turn on a second sign-in step, and ask us to close your account and delete your data by writing to privacy@latticesuite.io. We will not penalise you, or change the price or quality of the Service, for exercising a right.
If you are in the EU or UK, you have the right to: access your personal data and receive a copy; have inaccurate data corrected; have your data erased; restrict our processing; object to processing based on our legitimate interests; receive your data in a portable format; and withdraw any consent you have given (this does not affect what we did before). You can also complain to a supervisory authority, for example the data protection authority in the country where you live or work, or in the UK the Information Commissioner's Office (ico.org.uk, telephone 0303 123 1113). We will answer within one month of a request; if it is complex we may extend that by up to two further months and will tell you why.
Your California rights. If you are a California resident you have the right to: know what personal information we collect, use, disclose and sell or share, and to get a copy; correct inaccurate information; delete personal information; limit the use of sensitive personal information; opt out of the sale or sharing of personal information (we do neither); and not be discriminated against for exercising these rights. In the past 12 months we collected these categories: identifiers (email address, name, IP address); customer records (account details); internet and network activity (sign-in and security records, request logs); commercial information (plan and payment details, if you buy one); and, as sensitive personal information, your account log-in in combination with your password. We collect them for the purposes in section 3, from the sources in section 2, and disclose them only to the providers in section 4 for those purposes. We do not use sensitive personal information to infer characteristics about you. California residents who want to know whether we disclose information to third parties for their direct marketing may ask us; we do not.
Other US states. If your state gives you rights to access, correct, delete or port your personal data, or to opt out of targeted advertising, sale or profiling, you may use them by the same route. If we refuse a request you may appeal by replying to our decision with "appeal" in the subject line, and we will respond within 45 days.
How to make a request. Write to privacy@latticesuite.io from the email address on the account, or use the account's settings where the Service offers the option. To protect your account we confirm the request comes from you, normally by sending a link to the email address on the account, and we may ask for no more than that. An authorised agent may act for you with your written permission, and we may confirm it with you. We answer within the time the law of your region sets: one month in the EU and UK, and 45 days (extendable once by a further 45) in California and other US states.
9. Children
The Service is not for anyone under 18. We do not knowingly collect data from younger people, and never from anyone under 13. If you think a child has an account, tell us and we will close it and delete the data.
10. International transfers
We host in the United States and Lattice is a United States company. If you use the Service from the EU, the UK or elsewhere, your data is sent to and processed in the United States. For the processing that our providers carry out for us, we rely on the data processing terms and standard contractual clauses (with the UK addendum for UK data) that our hosting provider offers. You can ask us for a copy of the safeguards that apply.
11. Changes to this notice
If we change this notice in a material way we will tell you and ask you to agree again before you continue. The version you agreed to is recorded with your account.
12. Contact
privacy@latticesuite.io, 1118 Thompson Road, Alabaster, AL 35007. If you are in the EU or UK you can also use the representatives in section 1. You may complain to your local data protection authority at any time; we would appreciate the chance to put things right first.