Privacy Policy

1.Who we are

Luzbase is operated by [COMPANY LEGAL NAME], registered at [REGISTERED ADDRESS]. For data protection purposes we are the controller of the personal data described here.

You can reach us about privacy through our contact form (choose “Privacy and your data”). [DATA PROTECTION OFFICER / REPRESENTATIVE, IF APPLICABLE]

This policy covers luzbase.com and the Luzbase editor, API and related services. It sits alongside the User Agreement.

2.What we collect

Account data. Your first and last name, email address, and a hash of your password. We never store your password itself — we cannot read it, and neither can anyone who obtains our database.

Content you create. LaTeX sources, project files, commit history, branch and discussion contents, snippets, and images you upload to the OCR service. This is yours; see Your content stays yours in the User Agreement.

Compilation data. Build logs and generated PDFs, which we keep so you can see why a document failed to compile and so we can diagnose faults in the toolchain.

Technical data. IP address, browser and device information, and timestamps, recorded in server logs and used for security, rate limiting and debugging.

Billing data. If you subscribe to a paid plan, Polar Software, Inc., our reseller and merchant of record, handles your payment and billing details as an independent controller. We receive your subscription status, plan, seat count and billing period, plus the notifications Polar sends us about them, which can include the name, email address and billing address you gave at checkout. We keep those notifications for 90 days, and delete them sooner if you delete your account. We never receive your full card number.

We do not knowingly collect special categories of data (health, political opinions, biometrics and similar). Please do not put such data into a public snippet.

3.Why we use it, and our lawful basis

Where we rely on legitimate interests, we have considered the effect on you and limited what we collect accordingly. You can object — see Your rights below.

4.Cookies, and what we do not do

Luzbase uses a small number of strictly necessary cookies to keep you signed in. They are httpOnly, which means JavaScript on the page cannot read them — a deliberate protection against session theft. Without them you could not stay signed in, so they are not optional.

We do not run advertising trackers, and we do not sell your personal data. We do not use your content to train machine-learning models.

[ANALYTICS — CONFIRM WHETHER ANY IS IN USE, AND WHETHER IT IS CONSENT-BASED]

5.Who we share it with

We share personal data only with service providers who process it on our instructions, and only so far as they need it to do their job:

• Cloud hosting and object storage — stores your account, content and compiled output. [PROVIDER — TO CONFIRM]
• Email delivery — sends verification and password-reset messages. [PROVIDER — TO CONFIRM]
• Payment processing — Polar Software, Inc. (United States), our reseller and merchant of record; it processes payments, tax and invoices, using Stripe for card payments.
• Error and performance monitoring, if in use — [PROVIDER — TO CONFIRM]

We may also disclose data where the law requires it, to enforce the User Agreement, or to protect the rights and safety of users and the public. If Luzbase is ever involved in a merger or acquisition, we will tell you before your data becomes subject to a different privacy policy.

Content you choose to make public — a public snippet — is shared with whoever views it. That is a decision you make, not a disclosure we make on your behalf.

6.How long we keep it

• Account data — for as long as your account exists, then deleted or anonymised within [RETENTION PERIOD] of closure.
• Your content — until you delete it. Deleted items may persist in backups for up to [BACKUP RETENTION] before those backups age out.
• Compilation logs — [RETENTION PERIOD].
• Server and security logs — [RETENTION PERIOD].
• Billing records — as long as tax and accounting law requires, typically [STATUTORY PERIOD].
• Consent records — the fact that you accepted, when, and which version, kept for as long as we may need to evidence it.

7.Your rights

Depending on where you live, you have some or all of the following rights:

• Access — get a copy of the personal data we hold about you.
• Rectification — correct data that is wrong or incomplete. Most of it you can edit yourself in account settings.
• Erasure — ask us to delete your account and data, subject to records we must keep by law.
• Portability — receive your content in a machine-readable form. Your LaTeX sources and project files are plain text and can be exported at any time.
• Restriction and objection — ask us to pause processing, or object to processing based on legitimate interests.
• Withdraw consent — where we rely on consent, withdraw it at any time without affecting processing already carried out.

To exercise any of these, write to us through our contact form. We will respond within [RESPONSE PERIOD, e.g. one month]. We may need to verify your identity first.

If you are unhappy with how we have handled your data you can complain to your local supervisory authority — [SUPERVISORY AUTHORITY]. We would appreciate the chance to put it right first.

8.International transfers

Our infrastructure and some of our service providers may be located outside your country. Where personal data is transferred across borders, we rely on an appropriate safeguard such as standard contractual clauses or an adequacy decision. [CONFIRM HOSTING REGIONS AND TRANSFER MECHANISM]

9.How we protect it

Passwords are stored only as salted hashes. Session cookies are httpOnly and, in production, transmitted only over HTTPS. Access to production systems is limited to people who need it. Compilation runs in an isolated worker rather than on the machine serving the site. No system is perfectly secure, so we also ask you to use a strong, unique password. If a breach affects your personal data and is likely to present a risk to you, we will notify you and the relevant authority as the law requires.

10.Children's privacy

Luzbase is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us personal data, tell us through our contact form and we will delete it.

11.Changes to this policy

We will update this policy as the service changes. The version identifier and effective date at the top of this page always tell you which version you are reading. If a change materially affects how we handle your personal data, we will give you reasonable notice by email or in the app before it takes effect.

12.Contact us

Privacy questions, or to exercise any right above: our contact form. Postal address: [REGISTERED ADDRESS].