Privacy Policy

1. Introduction

Lithora (“we”, “our”, “us”) provides a work platform for engineering-led teams. This policy explains how we collect, use, disclose and safeguard information when you visit this website or use the Service. Where you use Lithora through your employer’s workspace, your employer is the controller of the content in that workspace and we act as its processor.

2. Information We Collect

2.1 Information you provide

• Account information: email address, name, password hash and profile details
• Content: work items, projects, documents, notes, comments, files and anything else you create or upload
• Collaboration data: messages, mentions, meeting notes and activity
• Connected-tool data: whatever an integration you authorise is scoped to read, such as repositories, issues or design files
• Billing details: handled by Dodo Payments. We never see or store full card numbers.

2.2 Information collected automatically

• Usage data: which features are used and which actions are taken inside the Service
• Device and connection data: IP address, browser and operating system
• Log data: access times, requests and error traces
• Cookies:session and preference cookies. Analytics cookies on this website are set only if you allow them — see section 10.

3. How We Use Information

We use the information above to:

• Provide, maintain, secure and improve the Service
• Process payments and manage subscriptions and seats
• Send service notifications, security alerts and account email
• Provide support
• Understand usage patterns so we can improve features
• Detect, investigate and prevent fraud, abuse and security incidents
• Meet legal obligations

For visitors in the EEA and UK, our legal bases are: performance of a contract (providing the Service), legitimate interests (security, abuse prevention, and the in-product usage measurement described in section 6), consent (analytics on this marketing website, and marketing email) and legal obligation (tax and accounting records). You can object to anything we do on the basis of legitimate interests — see section 9.

4. AI Features and the AI Processor

Lithora’s AI features — drafting, decomposition, summarisation, review and the agent — run on Amazon Bedrock, operated by Amazon Web Services, Inc. The models used are from the Amazon Nova family and inference is performed in the AWS us-east-1 region, in the United States.

• What is sent: your prompt, the work items, documents and connected-tool context in scope for the request, and the conversation needed to complete it.
• Retention: AWS does not store Bedrock inference inputs or outputs after the request is served, and does not use them to train or improve any model, including its own. We do not use your content to train models either.
• Transfer: if you are in the EEA or UK, using AI features involves a transfer of that content to the United States. It is made under the Standard Contractual Clauses in our data processing agreement with AWS, together with the supplementary technical measures described in section 7.
• Control: AI features are opt-in per action. Any AI action that would change your workspace is gated behind an explicit approval step, and workspace owners can disable AI features for the whole workspace.

5. Sharing and Disclosure

We share information only in these circumstances:

• Your workspace: with the other members and guests of the workspace you are working in
• Processors: the service providers listed in section 6, each under a written data processing agreement
• Legal requirements: where we are compelled by law, or where disclosure is necessary to protect rights, safety or the integrity of the Service
• Business transfers: in connection with a merger, acquisition or sale of assets, with notice to affected customers

We do not sell personal information and we do not share it for cross-context behavioural advertising.

6. Processors and Third Parties

These providers process customer data on our behalf. Each is bound by a data processing agreement; transfers out of the EEA or UK rely on Standard Contractual Clauses. The full register — what each one receives, why, and where it runs — is published at lithora.app/subprocessors, and that page governs if this summary falls behind it.

• MongoDB, Inc. (MongoDB Atlas)— the primary database. It holds every work item, document, comment and file record. United States.
• Amazon Web Services, Inc.— application hosting and compute, file storage (S3), content delivery (CloudFront) and transactional email (SES), in us-east-1, United States. Speech-to-text (Transcribe) is used only where a workspace has turned on meeting recording.
• Amazon Bedrock (AWS)— AI inference on the Amazon Nova model family, us-east-1, United States. See section 4.
• Dodo Payments— subscription billing and payment processing.
• Jitsi Meet— video meetings. Our production meeting server is one we operate ourselves; 8x8, Inc. hosts the call only where a deployment is pointed at the public meet.jit.si instance.
• Zoho Corporation (Zoho Meeting)— hosts the call when you book a product demo. It receives your name, email address and requested time. India.
• Functional Software, Inc. (Sentry)— error and crash reporting for the product app: stack traces, the failing request, browser details and the affected account id. European Union. No workspace content.
• PostHog, Inc.— product analytics inside the signed-in app: page views, feature events and performance metrics, associated with your user id, email, role, plan and team. United States. No workspace content.
• Google LLC (Google Analytics)— website analytics on lithora.app only. It is loaded only after you allow analytics cookies; if you decline, the tag is never downloaded and no analytics cookie is set. It has no access to workspace content.

Separately, the Service connects to third-party platforms youauthorise — GitHub, GitLab, Bitbucket, Jira, Linear, Slack, Discord, Notion, Figma, Google Drive, Microsoft Teams, Vercel, Cloudflare and others. Those are independent controllers governed by their own privacy policies, and data flows to them only for the integrations you switch on and only within the scopes you grant. You can revoke a connection at any time from Settings → Integrations.

7. Storage and Security

We apply technical and organisational measures appropriate to the risk:

• Customer data is stored in MongoDB Atlas; files are stored in Amazon S3
• Encryption in transit (HTTPS/TLS) and at rest
• Passwords are hashed with bcrypt and are never stored or logged in plain text
• Tenant isolation, role-based access control and audit logging
• Least-privilege internal access, reviewed periodically
• Encrypted, regularly verified backups

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a personal data breach affects you, we will notify you and the relevant supervisory authority as required by law.

8. Retention

We keep your data for as long as your account is active or as needed to provide the Service. When you delete your account we delete your personal data within 30 days, except where we must retain records for legal, tax or accounting purposes. Backups containing deleted data expire on their normal rotation.

9. Your Rights

You can ask us to:

• Access— give you a copy of your personal data
• Correct— fix inaccurate information
• Delete— erase your account and personal data
• Export— provide your content in a portable format
• Restrict or object— limit or object to a particular use
• Withdraw consent— for anything we do on the basis of consent, including website analytics and marketing email

Email support@lithora.io and we will respond within 30 days. Exercising these rights never costs you access to the Service.

10. Cookies and Website Analytics

This website sets two kinds of cookie, and only one of them needs your permission.

• Strictly necessary— keeping you signed in, security, load balancing, and remembering your cookie choice itself (lithora_consent, six months). These are exempt from consent because the site cannot work without them.
• Analytics— Google Analytics (_ga, _ga_*), used to count visits and see which pages help people understand the product.

Nothing analytics-related loads until you say yes.Until you accept, the Google tag is not downloaded at all — there is no request to Google and no analytics cookie. Consent Mode is set to deny storage by default for every visitor, with no region-based exception. We set no advertising cookies and run no ad networks.

If your browser sends a Global Privacy Control signal (or the older Do Not Track header), we treat it as a standing refusal and never ask again unless you opt in yourself.

You can change your decision whenever you like — from the “Cookie preferences” control in the footer of any page, or right here:

Declining, or withdrawing after accepting, also deletes the analytics cookies already stored on your device. Browser settings remain available to you as well, but they are not the mechanism we rely on for consent.

11. Children’s Privacy

The Service is not intended for anyone under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

12. International Transfers

Lithora’s core infrastructure is located in the United States (AWS us-east-1, MongoDB Atlas), so if you are in the EEA, the UK or Switzerland, using the Service transfers your information there. Two processors sit elsewhere: error reporting is handled in the European Union, and demo bookings are handled in India. All of it is set out per provider on the sub-processor page. These transfers are made under the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable), supported by encryption in transit and at rest and the access controls described in section 7. A copy of the relevant clauses is available on request. We do not offer a data-residency guarantee— there is no EU-only or region-pinned deployment of Lithora.

13. Changes to This Policy

We may update this policy. Every change ships with a new version string and date at the top of this page, and material changes are announced by email or in the Service before they take effect.

14. EEA and UK Rights (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland you also have the right to:

• Data portability
• Object to processing based on legitimate interests
• Withdraw consent at any time, without affecting processing already carried out
• Lodge a complaint with your local supervisory authority (or the UK Information Commissioner’s Office)

15. California Rights (CCPA/CPRA)

California residents have the right to:

• Know what personal information is collected and why
• Delete personal information
• Correct inaccurate personal information
• Opt out of sale or sharing — we do neither, and we honour Global Privacy Control as an opt-out signal
• Non-discrimination for exercising any of these rights

16. Contact

Questions about this policy, or a request to exercise any of the rights above: