Privacy Policy

We collect five kinds of data, and nothing beyond them:

• Account data — your email address and sign-in credentials.
• Chat prompts — the messages you send the builder describing your app.
• Project code and content — the apps the builder creates for you, including their code, assets, and settings.
• Usage metrics — which features you use and basic diagnostics, so we can fix problems and improve the product.
• Payment metadata — your plan, invoices, and payment status, received from our merchant of record. We never see or store your card number.

We use your data to provide the service: to build, preview, and host your apps, keep your projects in sync, bill correctly, and support you.

To power the builder, your chat prompts and project code are sent to third-party AI model providers for inference. Where such terms are offered, these providers are contractually barred from training their models on your data.

We also use data for abuse prevention and for analytics of our own funnel — measuring our own sign-up and upgrade flows. We use no third-party ad trackers, and we do not sell your data. Ever.

We process personal data on three legal bases:

• Contract — most processing happens because you asked us to build and host your apps.
• Legitimate interest — securing the platform, preventing abuse, and improving the product.
• Consent — anything optional, such as product update emails, which you can withdraw at any time.

We share data only with the vendors below, and only for the purpose listed:

• Hetzner Online GmbH — compute for the platform and deployed apps — Germany and Finland.
• Cloudflare — R2 object storage and DNS — global network.
• Backblaze — B2 archival backups — United States.
• Brevo — transactional email such as account verification, receipts and alerts — European Union.
• Dodo Payments — merchant of record: payments, tax, and card data — United States.
• LLM inference providers — AI model inference for the builder; barred from training on your data where such terms are offered — various locations.

Your account data, projects, and apps are kept for as long as your account exists and are deleted when you delete your account. Backups of deleted accounts purge within 30 days. Invoicing records are kept as long as tax law requires.

You can export all of your data as JSON and delete your account entirely — both are self-serve in Settings, with no email required. You also have the right to access, correct, restrict, or object to the processing of your data: write to hello@lazyai.dev and we will respond within 30 days.

Our infrastructure runs primarily in the EU (Germany and Finland), with some vendors in the United States. Where your data leaves your jurisdiction, we rely on appropriate safeguards, such as standard contractual clauses with our subprocessors.

We use only functional cookies: a session cookie that keeps you signed in and a preference cookie that remembers your theme. No tracking cookies and no third-party advertising cookies — which is why you do not see a cookie banner.

lazyai is not for children under 16, and we do not knowingly collect data from anyone under 16. If you believe we have, email hello@lazyai.dev and we will delete it.

If you are in the EEA, the UK, or Brazil, the rights above apply to you under the GDPR and the LGPD: access, rectification, erasure, portability, and objection, plus the right to complain to your local supervisory authority (the ANPD in Brazil). The self-serve export and deletion in Settings exist to make these rights practical, not just legal.

We will update this policy as the service evolves. Material changes are announced by email or in-product at least 14 days before they take effect, and the date at the top always tells you when it last changed.

Questions or requests about your data? Email hello@lazyai.dev.