Home / Privacy
Privacy policy.
Effective 2026-07-02. This policy covers the lians.ai website and the Lians managed console. Self-hosted deployments of the open-source engine run entirely on your infrastructure; no data reaches us at all.
1 · What we collect
Account data. When you sign in, our authentication provider (Clerk) processes your name, email address, and avatar from Google or GitHub. We store a workspace record keyed to that identity, plus the answers you give during onboarding (role, use case, tooling).
Billing data. Paid plans are processed by Stripe via Clerk Billing. Card numbers never touch our servers; we store only your plan tier and subscription status.
Service telemetry. We log API and console requests (route, timestamp, status, coarse IP for rate-limiting) and use Sentry for error reports. We do not run advertising trackers, and the only cookies we set are the session cookies required to keep you signed in.
Memory content. Facts your agents write to the managed engine are processed on your behalf as a data processor. Content is encrypted at rest with per-subject AES-256-GCM keys; erasure is available at any time via crypto-shred (POST /v1/erase), which destroys the subject key and renders the content permanently unrecoverable (including in backups) while the hash-only audit trail survives.
2 · What we never do
We do not sell personal data. We do not use your memory content to train models. We do not share data with third parties except the subprocessors below, each bound by their own data-processing terms.
3 · Subprocessors
Vercel (website + console hosting) · Fly.io (managed engine hosting) · Clerk (authentication & billing) · Stripe (payments) · Sentry (error monitoring) · Google Workspace (email). Self-hosted deployments use none of these.
4 · Retention & erasure
Account data is retained while your account is active and deleted on request. Memory content follows the retention policy you configure per namespace; crypto-shred erasure takes effect immediately and issues a signed erasure certificate. Audit rows are hash-only and are retained to satisfy regulatory record-keeping (e.g. SEC 17a-4); they contain no recoverable content.
5 · Your rights
Depending on your jurisdiction (GDPR, UK GDPR, CCPA), you may have rights of access, rectification, erasure, portability, and objection. Write to privacy@lians.ai and we will respond within 30 days. For content your organisation stores about its own users, contact that organisation; we act on their instruction as processor.
6 · Security
Encryption in transit (TLS) and at rest, per-subject envelope encryption, row-level security for information barriers, and an append-only tamper-evident audit chain. Full details in the security architecture. Report vulnerabilities to security@lians.ai.
7 · Changes
We will post material changes here and update the effective date. Questions: privacy@lians.ai.