Version 2026-10-06
The privacy of your data, and your lab's data, is a big deal to us. This policy lays out what we collect and why, who we share it with, and your rights with respect to it. We do not sell your data: not to advertisers, not to anyone.
Identity and access
When you create an account, we ask for your name, email address, and a password (stored as a salted hash, never in plain text - see “How we secure your data” below). That is so you can sign in and so we can send you account-related email: invitations, review digests, and similar notices you or your lab's admin have enabled.
Product interactions
We store the content you upload or create in your lab's account: photographs of chemical containers, the fields extracted or corrected from those photographs (chemical name, brand, grade, quantity, location, and similar), and the locations and users you set up. This is so the App can do what it is for - keeping your inventory. We keep this content as long as your account is active.
Website interactions and cookies
We use a session cookie to keep you signed in, and, where configured, an analytics provider's cookie to understand which pages and features are used, how long requests take, and where errors occur - this is first-party usage data, not ad tracking, and we run no advertising of our own. You can block cookies in your browser, though the App will not function without the session cookie.
Voluntary correspondence
When you contact us for support or send feedback through the App, we keep that correspondence, including your email address, so we have a record if you reach out again.
Photographs are stored to serve your lab's own inventory pages and are not used to train models outside of the extraction request itself. Extraction, classification, and chemistry-chat requests are sent to a third-party AI provider (below) only as needed to process them; raw image bytes are never sent to our analytics or observability providers, only prompt text and an attachment placeholder.
We use a small number of infrastructure and API providers to run the App, each processing only what it needs to perform its own function, under its own terms:
The App links out to supplier product pages and Safety Data Sheets hosted by third parties (for example, a chemical's catalog page or SDS PDF). We are not responsible for the privacy practices of those sites, and your use of them is governed by their own policies, not this one.
Beyond the service providers above, we disclose information only: to comply with a legally binding order from a government authority; to investigate a report of abuse or a security incident; or in aggregated, de-identified form that cannot be tied back to you or your lab. We do not otherwise share your data with third parties, and no one at Lot looks at your lab's content except with your express permission - for example, to help you with a support request.
You may request a copy of the personal data associated with your account, ask that inaccurate data be corrected, ask that your account or your lab's entire dataset be deleted, or object to how your data is processed, by contacting us as described below. We apply the same rights to every user regardless of location. Fulfilling a deletion request may mean closing your account, since the App may no longer be able to function for you without the data it depends on.
Data is encrypted in transit between your browser and our servers. Passwords are hashed, never stored in plain text. Access to a lab's inventory is scoped to that lab's own members and enforced at the database query level, not only in the interface - so a bug in one page cannot leak another lab's data.
Removing or archiving a bottle in the App is reversible and keeps its record (see the App's own Removed/Archived distinction). Deleting your account or your lab's entire dataset is not: content becomes inaccessible immediately and is purged from our active systems and backups within 60 days. We cannot recover it once that period has passed.
We keep your information for as long as your account or lab remains active, and for the time necessary afterward to comply with legal obligations or resolve disputes.
Our infrastructure is operated in the United States. If you are located elsewhere, any information you provide will be transferred to and stored in the United States.
The App is not directed at, and is not knowingly used by, children under 16.
This policy may be updated from time to time. A material change will be reflected in a new version date at the top of this page, and a new signup will be asked to accept the current version.
Questions about this policy, or a request described above, can be directed to the Lot founders through the contact page.
Portions of this document are adapted from the Basecamp open-source policies, licensed under CC BY 4.0.