Last modified: 18/12/2024

Purpose

This Privacy Policy explains how information about you is collected, used and disclosed by Lakera AI (collectively, “Lakera AI”, “we” or “us” includes Lakera AI AG and Lakera Inc) when you use our website https://lakera.ai (“Website”), online games at https://gandalf.lakera.ai and https://grt.lakera.ai (“Games”), online products and monitoring services at https://platform.lakera.ai (“Platform”) or use our API https://api.lakera.ai (“API”) (collectively, “Services”). This Privacy Policy also describes your choices regarding use, access and correction of personal information collected about you through our Services (“Personal Data”). Please read this Privacy Policy carefully and ensure that you understand it before you start to use our Services.

These Services are owned and operated by, or on behalf of, Lakera AI (“we”, “our” or “us”).

By accessing and using the Services, you acknowledge that you have read and understood the content of this Privacy Policy. We reserve the right to update this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of the Privacy Policy and, in some cases, we may provide you with additional notice (such as adding a statement to our homepage or sending you a notification). We encourage you to review the Privacy Policy whenever you access the Services or otherwise interact with us to stay informed about our information practices and the ways you can help protect your privacy.

Information You Provide to Us through the Services

We collect and process information you provide directly to us via the Services. Personal Data submitted through the Services include the details you submit when you create an account, participate in any interactive features of the Services, fill out a form, pay for subscriptions, apply for a job, communicate with us via third party social media sites, request customer support or otherwise communicate with us. The types of information we may collect include your name, email address, company name, postal address, phone number and any other information you choose to provide.

Information We Collect Automatically When You Use the Services

When you access or use the Services we automatically collect information about you, including:

• Log Files: We gather certain information about your use of the Services, including the type of browser you use, access times, pages viewed, your IP address, the page you visited before navigating to the Services, and any form of input you provide on the Services and store it in log files. We do not monitor or log data collected from your servers when using the Services, but we may log or monitor information about your access to our Services.
• API Logs: We gather certain information about your use of the API, including but not limited to: the number of requests, certain metainfo of each request (e.g. timestamp, length, etc), configuration options, the results of our analysis of your requests (e.g. does it contain a prompt injection attack) and other such info that we deem necessary to provide and improve the Services.
• Information Collected by Cookies and Other Tracking Technologies: We use various technologies to collect information, including cookies and web beacons.

Use of information

We may use information about you to:

• Enable you to have full access to the Services;
• Provide, maintain and improve the Services;
• The development of new Services;
• Research on AI Safety and Security;
• Provide and deliver the products and services you request, process transactions and send you related information, including confirmations and invoices;
• Send you technical notices, updates, security alerts, and support and administrative messages;
• Respond to your comments, questions and requests, and provide customer support;
• Create your Lakera AI account and identify you when you sign-in to your account in accordance with your agreement with us;
• Communicate with you about products, services, offers, promotions, rewards, and events offered by Lakera AI and others, and provide news and information we think will be of interest to you;
• Monitor and analyze trends, usage and activities in connection with the Services;
• Detect, investigate and prevent fraud and other illegal activities and protect the rights and property of Lakera AI and others;
• Personalize and improve the Services and provide advertisements, content or features that match user profiles or interests;
• Notify you about important changes to the Services, including changes or updates to this Privacy Policy;
• Link or combine with information we get from others to help understand your needs and provide you with better service;
• Consider you for possible employment at Lakera AI in connection with an application that you submit; and
• Carry out any other purpose described to you at the time the information was collected.

Sharing of information

We may share your Personal Data as follows or as otherwise described in this Privacy Policy:

• With vendors, consultants and other service providers we have vetted and approved who need access to such information to carry out work on our behalf only to the extent necessary for the performance of any agreement we enter into with you. This includes companies providing the following services for our Website and/or Platform: hosting services, authentication services, cyber security and anti-fraud services, and advertising;
• In response to a request for information if we believe disclosure is permitted by, in accordance with, or required by, any applicable law, regulation or legal process such as to comply with a subpoena or applicable court order;
• With any person to whom disclosure is necessary to enable us to enforce our rights under this Privacy Policy or under any agreement we enter into with you or to protect the rights, property and safety of Lakera AI or third parties;
• In connection with, or during negotiations of, any merger, sale of Lakera AI assets, financing or acquisition of all or a portion of our business by another company;
• Between and among Lakera AI and all companies affiliated with Lakera AI who may act for us for any of the purposes set out in this Privacy Policy, including our current and future parents, affiliates, subsidiaries and other companies under common control and ownership;
• With analytics and search engine providers that assist us in the improvement and optimization of our Website, subject to our Cookies Policy; and
• With your consent or at your direction.

We may also share aggregated or de-identified information, which cannot reasonably be used to identify you.

Lawful Basis For Processing Your Information

We are required to state the lawful basis under which we process the Personal Data of our users from the European Union. Accordingly, the lawful bases upon which we process your Personal Data are as follows:

• Where it is necessary to obtain your prior consent to the processing concerned in order for us to be allowed to do it, for instance in relation to direct marketing, we will obtain and rely on your consent in relation to the processing concerned.
• Otherwise, we will process your Personal Data only where the processing is necessary for compliance with a legal obligation to which we are a subject; or
• For the purposes of the legitimate interests pursued by us in promoting our business, providing the Platform to our business customers pursuant to our legal agreements with them, and in ensuring the security, accessibility and improvement of our Website and Platform and the development of new technology and services.

External Links

The Website may, from time to time, contain links to external sites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for these policies. Please check these policies before you submit any Personal Data to these websites. We are not responsible for the privacy policies or the content of such sites.

Social Sharing Features

The Website may offer social sharing features and other integrated tools (“Third-Party”), which lets you share information you find on our website with other media, and vice versa. When you visit one of our pages the plugin establishes a direct connection between your browser and the third-party server. Thus, the Third-Party receives information from your browser as set out in the Third-Party's privacy policy. Please note that we, as provider of the pages, have no knowledge as to the contents of the submitted data or its use by the Third-Party. For more information about the purpose and scope of data collection and processing in connection with social sharing features, please visit the privacy policies of the entities that provide these features.

Log-in Features

We may allow you to sign up and log in using SSO via a third-party Social account (e.g. Google or GitHub) . If you sign up using a Social account, the third-party account provider may ask your permission to share certain information from your account with us. This may include your first name, last name, gender, general location, your timezone and birthday. This information is collected by the third-party Social account provider and is provided to us under the terms of their privacy policy. You can control the information that we receive from third-party Social account using the privacy settings in that account..

Advertising and Analytics Services Provided by Others

We may allow the following companies to serve advertisements on our behalf across the Internet and in applications: Google AdWords, Google analytics, Marketo, Twitter, Facebook, Adroll, Quora, Bing ads, Linkedin, Terminus, Demand base, Instagram, and Reddit using email address and cookies that are collected. These entities use technologies including cookies, web beacons, device identifiers and other tools to collect information about your use of the Services and other websites and applications, including your IP address, web browser, pages viewed, time spent on pages or in apps, links clicked and conversion information. This information may be used by Lakera AI and Lakera AI service providers to, among other things, analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on our Services and other websites and better understand your online activity. For more information about cookies, please see below and for further information about interest-based ads, or to opt out of having your web browsing information used for behavioral advertising purposes, please see Lakera AI’s Cookie Policy.

Information Collected on Behalf of Customers in providing our Platform

In the case of Personal Data we handle or receive on behalf of a customer in connection with their access to, and use of, our Platform (“Customer PI”), we have no direct relationship with the customer’s employees or other individuals with whom that customer may interact with respect to the Platform. If you are such an employee or individual and are seeking access to, or would like to correct, amend or delete, Customer PI, you should direct your query to the applicable customer. We will respond within a reasonable timeframe to a customer’s request to remove Customer PI. Please note that the foregoing will not limit EU individuals from making certain requests relating to their Personal Data as provided in Your Rights below. We will not use Customer PI except for the purpose of providing and supporting the Services for the applicable customer. Customer PI will be retained for as long as needed for that purpose and as necessary to comply with our legal obligations, resolve disputes and enforce our agreements.

Marketing

Where permitted in our legitimate interest or with your prior consent, we may use your Personal Data for marketing and to provide you with promotional update communications by email about our products/services. You can object to further marketing at any time by selecting the “unsubscribe” link at the end of all our marketing and promotional electronic communications to you, or by contacting us using the contact details set out in the Your Choices and Your Rights sections of this Privacy Policy.

As part of the registration process for events hosted by Lakera AI which you register to attend, we may request Personal Data such as: your name, address, email address and telephone number, and details relevant to your occupation or employer. This information is required to process your registration for the event and to provide you with relevant event materials. This data may be shared with third party service providers engaged by us as more fully explained in the Sharing of Information section of this Privacy Policy. If you show an interest in an exhibitor at an event hosted by Lakera AI, such as by consenting to have your attendee badge scanned, we will provide your data to such exhibitors who may contact you for their own direct advertising and marketing purposes. In that case, the exhibitors’ use of your information would be subject to the exhibitors’ privacy policies. For events sponsored by Lakera AI, the event host may provide your Personal Data to Lakera AI, subject to your consent. Lakera AI will use the data as set forth in the Use of Information section of this Privacy Policy.

Security

We take reasonable steps to protect your Personal Data from unauthorized access and against unlawful processing, accidental loss, destruction and damage. In particular, Lakera follows SOC2 Type II requirements and reviews its controls annually with qualified and impartial independent external auditors. SoC2 Type II controls include but are not limited to:

• Physical and environmental controls.
• Human resource and organisational controls.
• Access Controls.
• Intrusion Detection and Prevention.
• Vulnerability management.
• Incident Management.
• Security Awareness training.
• Risk management.
• Third-party risk assessments.

Unfortunately, transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Data, we cannot guarantee the security of your Personal Data submitted to us. Your Personal Data will be retained by Lakera AI for the duration of your account and may be retained for a period after this time as necessary and relevant to our legitimate interests, our terms of agreement with you and in accordance with applicable legal obligations. This may include retention necessary to meet our tax reporting requirements as well as time required to enforce the relevant terms of agreement or to identify, issue or resolve legal proceedings. We may retain a record of your stated objection to the processing of your data, including in respect of an objection to receiving marketing communications, for the sole legitimate purpose of ensuring that we can continue to respect your wishes and not contact you further, during the term of your objection.

Transfer of Information to the U.S. and Other Countries

Lakera AI is based in Switzerland but its servers are hosted in the EU and the United States. By accessing or using the Services or otherwise providing information to us, you understand that your information will be subject to processing, transfer and storage in and to the EU and U.S., where you may not have the same rights and protections as you do under local law.

Your Rights

EU individuals have rights in relation to their Personal Data which is processed by Lakera AI. If you are an EU data subject, you may, by emailing us at privacy@lakera.ai :

• Request access to the Personal Data concerned.
• Request that any incorrect Personal Data about you that we are processing be rectified.
• Request that we erase the Personal Data concerned.
• Withdraw your consent at any time where we are processing Personal Data relating to you on the basis of your prior consent to that processing, after which we shall stop the processing concerned.
• Lodge a formal complaint with  your local EU supervisory authority if you have a complaint about any processing of your Personal Data being conducted by us.

If the requested EU Data is Customer PI, please include the name of the applicable customer in your request; we will refer the request to that customer to respond directly to you and will support them as needed to respond to your request.

California Resident Rights

If you are a California resident, you have the rights outlined in this section. Please see the “Exercising Your Rights” section below for instructions regarding how to exercise these rights. If there are any conflicts between this section and any other provision of this Privacy Policy and you are a California resident, the portion that is more protective of Personal Data shall control to the extent of such conflict. If you have any questions about this section or whether any of the following applies to you, please contact us at privacy@lakera.ai (using the subject line “California Privacy Request”).

Access

You have the right to request certain information about our collection and use of your Personal Data over the past 12 months. We will provide you with the following information:

• The categories of Personal Data that we have collected about you.
• The categories of sources from which that Personal Data was collected.
• The business or commercial purpose for collecting or selling your Personal Data.
• The categories of third parties with whom we have shared your Personal Data, if any.
• The specific pieces of Personal Data that we have collected about you.

If we have disclosed your Personal Data for a business purpose over the past 12 months, we will identify the categories of Personal Data shared with each category of third-party recipient.

If we have sold your Personal Data over the past 12 months, we will identify the categories of Personal Data purchased by each category of third-party recipient.

Deletion

You have the right to request that we delete the Personal Data that we have collected from you. Under the CCPA, this right is subject to certain exceptions: for example, we may need to retain your Personal Data to provide you with the Services or complete a transaction or other action you have requested. If your deletion request is subject to one of these exceptions, we may deny your deletion request.

Correction

You have the right to request that we correct any inaccurate Personal Data we have collected about you. Under the CCPA, this right is subject to certain exceptions: for example, if we decide, based on the totality of circumstances related to your Personal Data, that such data is correct. If your correction request is subject to one of these exceptions, we may deny your request.

Cookies Data Sales and Sharing Opt-Out

In this section, we use the terms “selling” and “sharing” as they are defined in the CCPA. We may incorporate cookies from certain third parties on the Lakera website. These cookies allow those third parties to receive certain information about your interaction with the website that is associated with your browser or device. Those third parties may use that data to serve you relevant ads on our services or on other websites you visit. Under the CCPA, our sharing your personal information (specifically, Device/IP Data and Web Analytics) obtained through third party cookies for online advertising (“Cookie Data”) may be considered a “sale” of information and may also constitute “sharing” for cross-context behavioral advertising under the CCPA. You can opt out of our selling and sharing of your Cookies Data by following the instructions in this section.

We may sell and/or share (and, over the past 12 months, we have sold and/or shared) your Cookies Data to and/or with Advertising Partners for the following business or commercial purposes:

• Marketing and selling our services.
• Showing you advertisements, including interest-based or online behavioral advertising.

You have the right to opt-out of the sale and/or sharing of your Cookies Data. You can opt-out using the following methods:

By implementing the Global Privacy Control or similar control that is legally recognized by a government agency or industry standard and that complies with applicable laws. Note that this must be initiated through your browser and applies to your specific device and browser used at the time you cast the signal. Please note this does not include Do Not Track signals.

Once you have submitted an opt-out request, we will not ask you to reauthorize the sale and/or sharing of your Cookies Data for at least 12 months.

To our knowledge, we do not sell or share the personal information of minors under 16 years of age.

Exercising Your Rights

To exercise the rights described above, you must send us a request that (1) provides sufficient information to allow us to verify that you are the person about whom we have collected Personal Data, and (2) describes your request in sufficient detail to allow us to understand, evaluate, and respond to it. Each request that meets both of these criteria will be considered a “Valid Request.” We may not respond to requests that do not meet these criteria. We will only use Personal Data provided in a Valid Request to verify you and complete your request. You do not need an account to submit a Valid Request.

We will work to respond to your Valid Request within 45 days of receipt. We will not charge you a fee for making a Valid Request unless your Valid Request(s) is excessive, repetitive, or manifestly unfounded. If we determine that your Valid Request warrants a fee, we will notify you of the fee and explain that decision before completing your request.

You may submit a Valid Request using the following methods:

Emailing us at: privacy@lakera.ai (with the subject line “California Privacy Request”)

We Will Not Discriminate Against You for Exercising Your Rights Under the CCPA

We will not discriminate against you for exercising your rights under the CCPA. We will not deny you our goods or services, charge you different prices or rates, or provide you a lower quality of goods and services if you exercise your rights under the CCPA.

California “Shine the Light” Law

California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us at privacy@lakera.ai (with the subject line “California Privacy Request”).

Other State Law Privacy Rights

Nevada Resident Rights

If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties. You can exercise this right by contacting us at privacy@lakera.ai with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account. Please note that we do not currently sell your Personal Data as sales are defined in Nevada Revised Statutes Chapter 603A.

‍Account Information

‍Our customers may access, update or change personal information they have provided by logging into the Services or emailing us at privacy@lakera.ai. Subject to the terms of their agreements with us, Customers may deactivate their accounts by emailing us at support@lakera.ai, but note that we may retain certain personal information as necessary to comply with our legal obligations or for legitimate business purposes, such as to resolve disputes or enforce our agreements. We may also retain cached or archived copies of personal information for a certain period of time.

If you are an individual with whom one of our customers interacts with respect to the Services (e.g., an employee of a customer), as noted above, you should direct any requests regarding access, modification or deletion of personal information to the applicable customer.

‍Cookies‍

Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove or reject browser cookies. Please note that if you choose to remove or reject cookies, this could affect the availability and functionality of our Services.

Promotional Communications‍

You may opt out of receiving promotional emails from Lakera AI by following the instructions in those emails or by emailing support@lakera.ai. If you opt out, we may still send you non-promotional emails, such as those about your account or our ongoing business relations.

Contact us

In case of questions or concerns about this Privacy Policy, you can contact Lakera AI at privacy@lakera.ai or by letter at Lakera AI AG, Werdstrasse 21, 8004 Zürich, Switzerland or at 282 2nd Street, Ste 100, San Francisco, CA, 94105.

‍