Privacy Policy

Laterite BV ("Laterite", "we", "our", or "us") operates LateriteAI, including www.laterite.ai and related LateriteAI service domains (the "Service"). LateriteAI is an invitation-based platform for business and institutional users, including research organizations, NGOs, universities, foundations, governments, and other professional users.

Laterite recognizes the significance of data privacy and the protection of personal data. We are committed to treating personal data with respect, integrity, and in compliance with applicable data protection laws, including the GDPR and similar laws in the countries where Laterite operates.

Laterite BV is registered in the Netherlands, KvK number 69759103, VAT number NL858000118B01. Our address is Herengracht 221, 1016 BG Amsterdam, The Netherlands.

For account, access, billing, support, and platform administration data, Laterite BV is generally the data controller. For chats, prompts, uploaded files, research data, and outputs submitted by users on behalf of their organization, Laterite generally acts as a processor and handles that data only to provide the Service.

"Service Data" means the content and related information submitted to or generated through LateriteAI. This includes:

• chats, prompts, and conversation history
• user-uploaded documents, datasets, and files
• generated outputs and related metadata
• selected agent, task status, timestamps, support messages, and error information

We collect and store Service Data so users can access their own chats, documents, and outputs, and so the selected LateriteAI application can process the user's request.

Laterite processes Service Data only to provide, secure, support, and administer LateriteAI. Laterite does not use Service Data to:

• train AI models
• fine-tune AI models
• improve Laterite workflows
• create internal benchmarks or datasets
• conduct unrelated research
• build unrelated products or services

Laterite does not review Service Data except where needed to provide support requested by the user, investigate a technical or security issue, comply with law, or follow the customer organization's instructions.

Where external AI providers are used by a selected agent, Laterite uses approved providers under settings or agreements that prohibit using Service Data for model training.

We collect the minimum information needed to operate the Service, including:

• account and organization information, such as name, email address, organization, role, invitation status, agent permissions, plan, billing status, and usage limits
• interest registration information, such as name, work email, organization, role, expected users, and research use case
• support, security, and technical information, such as support messages, error reports, timestamps, session data, audit logs, and information needed to secure the Service
• billing references, invoices, plan information, and usage information needed to manage subscriptions and payments

Payment details are handled by Stripe. Laterite does not store full card details.

We use data only to provide, secure, support, and administer LateriteAI. This includes authenticating users, enforcing organization access controls, showing users their own chats and documents, processing user requests, managing billing and plans, providing support, investigating errors, protecting the Service, and complying with legal obligations.

LateriteAI is designed to follow the GDPR. We process personal data only where there is a valid legal basis, such as performing a contract, complying with legal obligations, protecting the security of the Service, pursuing legitimate interests that do not override user rights, or acting on customer instructions.

Depending on where you are located, you may have rights to access, correct, delete, restrict, object to the processing of, or request portability of your personal data. If processing is based on consent, you may withdraw consent.

Chat histories and user-uploaded documents are automatically deleted after 3 months. Users or customer organizations may request earlier deletion.

We will respond to deletion requests in line with GDPR requirements. In some cases, we may need to retain limited information for legal, billing, security, audit, backup, or dispute-resolution purposes. If the data belongs to a customer organization, we may need to coordinate the request with that organization.

We do not sell personal data. We share data only where needed to operate the Service, with Laterite group entities, authorized customer administrators, service providers, or where required by law.

Service providers may include hosting, database, authentication, storage, billing, support, security, and approved AI-processing providers. These providers are required to protect data and use it only for the services they provide to Laterite.

We use reasonable technical and organizational measures to protect data. These include authenticated access, organization-level permissions, role-based controls, private storage, time-limited access links where applicable, audit logs, staff confidentiality obligations, and security monitoring.

This policy applies to LateriteAI. Separate Laterite research projects may be governed by separate research contracts, consent forms, ethics approvals, data processing agreements, or joint-controller arrangements. Those documents may set different rules for anonymized research datasets, retention, and permitted research uses.

The LateriteAI commitment remains: Service Data from the platform is not used for training, fine-tuning, workflow improvement, benchmarks, unrelated research, or unrelated product development.

For privacy questions or deletion requests, contact us at services@laterite.com with "Privacy Inquiry" in the subject line.

For customer organizations, our Data Processing Agreement template describes our processor commitments for LateriteAI Service Data.