Skip to main content

Legal

Privacy Policy

A plain-language view of the data Lanternfish needs, what it does with it, and the controls your team keeps.

Last updated · October 17, 2026

Questions about this document? Use Lanternfish's private contact form

01

What Lanternfish processes

Lanternfish processes account details, workspace configuration, and the telemetry you send through the SDK. Telemetry may include model calls, tool activity, timing, identifiers, and attributes configured by your team. You control what your instrumentation sends.

02

How data is used

We use workspace data to provide trace views, briefings, investigations, support, security, and usage reporting. Lanternfish does not sell customer data. Hosted AI features send only the context required for the requested operation to the configured model provider.

03

Retention

Managed Cloud applies a rolling retention window based on the active workspace plan.

  • Free: 14 days of trace history.
  • Pro: 90 days; Team: 365 days.
  • Enterprise: defined in your contract.

04

Service providers

Lanternfish relies on managed infrastructure, email delivery, hosted AI, and—when paid checkout is enabled—Paddle for payment processing. These providers process only the data needed to perform their service.

05

Product analytics

On Lanternfish Cloud we use PostHog to understand how the website and the app are used: which pages are visited and which setup steps people complete (account created, organization created, first API key, checkout opened). Analytics sets no cookies. Signed-in users are identified only by an internal user ID, never by name or email. Session recordings mask every form field, and your agents' run data is never sent. Browsers that send Do Not Track are not tracked. The self-hosted Community edition contains no analytics and makes no outbound calls.

06

Your choices

Workspace owners can manage membership, API keys, and project data. You may request access, correction, export, or deletion of personal information by contacting us. Some records may be retained where required for security, fraud prevention, or legal obligations.

07

Protecting sensitive data

Do not place passwords, payment details, private API keys, or unnecessary personal data in trace attributes. The SDK can leave out prompt and completion text (capture_content=False) and function arguments (capture_args=False) before telemetry leaves your environment.