Privacy Policy
Last updated: August 2026
1. Introduction
This Privacy Policy explains how Lagora ("we", "us", or "our") collects, uses, and protects your personal information when you use our service.
2. Operator (Data Controller)
Lagora is operated by Lagora Pte. Ltd., a private limited company incorporated in Singapore (UEN: 202554924D). Lagora Pte. Ltd. is the data controller and service provider responsible for processing your personal data, handling your payments, and serving as the contracting counterparty under this Privacy Policy. References to "we", "us", and "our" refer to Lagora Pte. Ltd.
3. Information We Collect
We collect: account information (email, username, display name); content you create (conversations, posts, comments, imported conversations, and documents you add to your workspace); usage data (features used, interaction patterns); and technical data (IP address, browser type, device information). If you accept analytics cookies we also collect product-analytics events, where enabled replays of your interface sessions, and limited advertising-measurement data such as a Reddit ad click ID, a Reddit-generated pseudonymous browser identifier, page URL, browser and screen information, and named conversion event. We store a small amount of data even if you never create an account — see the section on visitors without an account below.
4. How We Use Your Information
We use your information to provide and improve the Service, personalize what you see, measure advertising, process subscriptions and payments, send service-related messages, keep the platform safe, and comply with legal obligations. Each purpose rests on a legal basis. Performance of our contract with you covers running the Service, routing your AI requests, processing payments and sending service messages. Our legitimate interests cover preventing abuse, fraud and spam, securing accounts, and understanding in aggregate which features work — balanced against your rights, and objectable at any time. Consent covers analytics, session replay and advertising measurement, optional profiling and matching features, and any marketing email, and can be withdrawn at any time without losing access to the core Service. Legal obligation covers tax, accounting, and lawful requests from authorities.
5. AI Conversations and Data
Conversations you have with AI models are processed through third-party AI providers (such as OpenRouter). Published conversations are visible according to your chosen visibility settings. We do not use your private conversations to train AI models.
6. Visitors Without an Account
You can try a conversation from a published post without signing up. That trial is not anonymous in the sense of leaving nothing behind: the messages you type and the model's replies are stored on our servers, because every turn is rebuilt server-side from the post and the stored transcript — accepting a browser-supplied history would turn the endpoint into an open AI proxy for anyone. We also store a keyed one-way fingerprint (HMAC) of your IP address, never the address itself, so we can limit how many trials one visitor starts, and a signed cookie that identifies the trial for up to 7 days. Trial transcripts are deleted 7 days after the trial if you never create an account. If you do create one, the conversation is copied into your account — where the rest of this policy governs it — and the trial copy is deleted within 1 day. These records are readable only by our servers; no user account, including yours, can query them. Legal basis: our legitimate interest in letting you evaluate the Service before registering, and in preventing abuse of a free, unauthenticated endpoint.
8. Sub-processors
We use a small set of providers to run Lagora. Each processes data only on our instructions and under a data processing agreement: Supabase (database, authentication and file storage), Vercel (application hosting and request logs), OpenRouter (routing your AI requests, and through it the provider serving the model you chose — including Anthropic, OpenAI, Google, xAI and DeepSeek), Stripe (subscription payments; card details go to Stripe directly and never reach our servers), PostHog (product analytics and session replay, used only if you accept analytics cookies), Reddit (advertising measurement for consented visitors; it receives page URL, Reddit ad click ID, a Reddit-generated pseudonymous browser identifier, browser and screen information, connection data such as IP address, and named conversion events, never conversation content, prompts, email or Lagora account ID), Expo (delivering push notifications to the mobile app), and search and page-reading providers that receive only the query or link involved when you run a web search inside a conversation. If we add or replace a provider that handles your content, we update this section.
9. International Data Transfers
Lagora Pte. Ltd. is established in Singapore and the providers above operate in the United States and the European Union, so using the Service involves transferring personal data across borders. Where data leaves the EEA or the UK we rely on the European Commission's Standard Contractual Clauses in our agreement with each provider, together with the EU-US Data Privacy Framework where that provider is certified under it. AI requests are routed to whichever provider serves the model you selected, which may be in another country; the same contractual safeguards apply. We do not operate the Service in mainland China and store no user data there.
10. How Long We Keep Data
We keep each category of data only as long as it is needed. Account data: for as long as your account exists — deleting your account hides it immediately and erases it permanently after a 30-day grace period, during which logging back in restores it. Conversations, posts and uploads: until you delete them, or until your account is erased. Guest trial transcripts: 7 days, or 1 day after they have been copied into a new account. Anti-abuse fingerprints recorded at signup: 14 days. Analytics and advertising-measurement cookies and their identifiers: up to 12 months, and only while your consent stands. Payment, subscription and tax records: kept after your account is erased for as long as Singapore accounting and tax law requires (currently 5 years); this is a legal obligation and is therefore exempt from erasure requests, and the rows are stripped of the link to your identity and are not visible to any user. Operational and security logs, including IP addresses: up to 90 days.
11. Data Security
We implement industry-standard security measures including encryption in transit (TLS) and at rest, secure authentication, and regular security reviews.
12. Your Rights
You may: access the personal data we hold about you; correct inaccurate data; delete your account and its data; export your conversations and posts in a machine-readable format; object to processing that rests on our legitimate interests; and withdraw any consent you have given, including for analytics and advertising measurement. Most of this is available directly in your account settings; for anything else, write to contact@lagora.ai and we will respond within 30 days. You may also complain to your local data protection authority, or to Singapore's Personal Data Protection Commission.
14. Children's Privacy
The Service is not intended for children under 13. We do not knowingly collect personal information from children under 13.
15. Changes to This Policy
We may update this policy from time to time. We will notify you of significant changes via email or in-app notification.
16. Contact Us
For privacy-related inquiries, please contact Lagora Pte. Ltd. at contact@lagora.ai.