Lath is a backend you run your product on, so it holds two different kinds of data: yours, and your customers’. They are treated differently and the distinction runs through everything below.
An email address, a name if you give one, your workspace and projects, your API keys as hashes, and a record of the operations you performed. Billing details are held by the payment processor; Lath stores an identifier and the amounts.
Whatever your product provisions through Lath: customer identifiers, plans, entitlements and usage counters. Lath is a processor for this data and you are the controller. It is used to run the service you asked for and for nothing else.
Your data is not sold, not shared with advertisers, and not used to train models. There is no analytics pixel on this website and no third-party script on any page you are reading.
Lath runs on infrastructure it does not own — managed Postgres, object storage, edge compute, an email relay and a payment processor. The categories are published; the specific list is available to customers on request. Publishing vendor names on a marketing page tells an attacker where to look, and tells you nothing you cannot get by asking.
Operational records are append-only and kept for as long as the account exists, because an audit log that can be edited is not one. Ask at support@trylath.com to export or delete an account and it will be done within thirty days.
Access, correction, export and deletion, exercised by mailing the address above. Lath is pre-launch and small enough that this is a person reading a message rather than a workflow.