Privacy Policy
Last updated: 19 October 2026
1. Who is responsible
The controller for the personal data described here is Christoph Weiler, sole trader, Sonnberg 57, 4261 Rainbach im Mühlkreis, Austria, mail@chrisweiler.at ("Lacuno", "we").
This policy covers Lacuno Cloud: the dashboard at app.lacuno.io, the editors under *.editor.lacuno.io, the try editor, our emails, and lacuno.io.
Sites our customers publish (on *.lacuno.site or their own domains) belong to them. For the people who visit those sites, the customer is the controller and we process data only on their behalf (section 4). A data processing agreement under Art. 28 GDPR is available on request by email to mail@chrisweiler.at.
2. What we process, why, and on what legal basis
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Name, email, password (stored only as a hash), sign-in methods | To create and run your account | Art. 6(1)(b), contract |
| Name and email from Google, GitHub or Apple when you sign in with them | Same | Art. 6(1)(b) |
| Sessions (time, browser, IP address) and rate-limit counters per IP address | To keep you signed in, protect accounts and stop automated sign-ups | Art. 6(1)(b) and (f), our interest in a secure service |
| Two-factor authentication, when you turn it on: your authenticator key and backup codes, encrypted | To protect your account | Art. 6(1)(b) |
| Captcha (Cloudflare Turnstile, when switched on): IP address and browser signals | To tell people from bots at sign-up, password reset and abuse reports | Art. 6(1)(f) |
| Your workspaces and sites: documents, assets, settings, custom domains | To store, edit and publish them for you | Art. 6(1)(b) |
| AI connections you set up: which app, who in the workspace connected it, and its access tokens, in your workspace | To let the AI apps you choose work in your workspace | Art. 6(1)(b) |
AI apps you connect to your account at mcp.lacuno.io: which app, when you connected it and last used it, and its access tokens, in our database. Such an app reaches every site of the workspaces where you are the owner or an editor, with your role there, and we pass on its name so the editor and the workspace's activity show it | To let the AI apps you choose work on all your sites through one address | Art. 6(1)(b) |
| Files your AI apps import from a web address: our server downloads them for your workspace, keeps only the file as part of your site, and logs the address's host name | To let the AI apps you choose add images, videos and fonts to your sites | Art. 6(1)(b) |
| Setting up a new workspace, when you ask for a first draft: the address of your current website and of a website you name for inspiration, your answers, what our server reads from those websites (the home page and up to 8 pages linked from its navigation: their texts, headings, image addresses, colours and fonts; of the inspiration website only its home page), the pages, colours and directions we propose, and the draft's screenshots | To build your workspace's first site from your own content with an AI model (section 5) | Art. 6(1)(b) |
| Workspace members: who belongs to a workspace, their role and when they joined; invitations: the invited email address, the role and who sent it | To let owners share a workspace and decide who may do what | Art. 6(1)(b); for an invited person without an account, Art. 6(1)(f), delivering the invitation the owner sent |
| A workspace's activity: who joined, left or was removed, changed a role or transferred the workspace, opened the editor, connected an AI app, published from the editor or changed a domain, published or edited through an AI app (with the app's name, attributed to the person who connected it), and when; shown to the workspace's owner | To let the owner see who did what in their workspace | Art. 6(1)(b) and (f) |
| Workspace exports the owner asks for: a file with the workspace's sites, files and published releases, which includes the names and email addresses of its members and of the people who connected AI apps | To let you take your workspace to your own server (data portability) | Art. 6(1)(b), and Art. 20 |
| Bandwidth and builds per workspace and day; the size and content hash of each file your sites keep | To show your usage and apply fair use | Art. 6(1)(b) |
| The terms version you accepted and when | To document the contract | Art. 6(1)(b) and (f) |
| Emails we send you: verification, password reset, invitations to a workspace, usage warnings, takedown notices | To run the service and tell you what you need to know | Art. 6(1)(b), and (c) where the Digital Services Act requires a notice |
| Abuse reports: the reported address, description, reporter's name and email, and IP address | To handle illegal content and misuse | Art. 6(1)(c) and (f) |
| Takedown decisions about your sites | Same, and to show what we decided and why | Art. 6(1)(c) and (f) |
| A log of our administrators' access to account data: who viewed or did what, about which account and when, with the reason for actions that need one | To keep our own access accountable and secure | Art. 6(1)(f) and Art. 32 |
| Nightly encrypted backups of the above | To recover from failures | Art. 6(1)(f) |
We do not sell data, show ads or build profiles, and we make no automated decisions about you. The dashboard sets one cookie, the session cookie, which is strictly necessary for signing in. You need to give us your account data to use Lacuno; without it we cannot provide the service.
3. Paid plans are sold by Polar
Paid plans are sold by Polar Software, Inc. as Merchant of Record: Polar is the seller, takes your payment (through Stripe), charges VAT and issues your invoices. You give your payment and billing details to Polar, not to us, and Polar's privacy policy applies to them. From Polar we receive what we need to give your workspace its plan: which plan, its status and its period.
4. Visitors of customers' sites
When someone visits a site published on Lacuno, Bunny's CDN answers the request and logs the address requested, the time, the browser, the page that linked to it, the visitor's country, the bytes sent and the visitor's IP address, which we have Bunny anonymise. Bunny keeps these logs for 3 days. We read them every minute. From them we keep the total bandwidth per workspace and day and, for the site's owner, daily statistics per site: how often each page was viewed, from which websites, countries, device types and browsers, and an estimate of how many different visitors there were. For that estimate we compare the anonymised IP address and browser of each request in our server's memory while we count; they are never stored. No cookies and no scripts are used. The site's owner is the controller of this data. Where lacuno.io itself is a published Lacuno site, its visits are counted the same way, with us as controller, for our legitimate interest in knowing how it is used (Art. 6(1)(f)). Anything a site collects itself, for example through scripts its owner adds, is the owner's responsibility.
Forms. When a visitor sends a form on a site published on Lacuno, we email what they entered, the form's name and the page to the owner of the site's workspace, through Resend (section 5), and keep no copy. The visitor's IP address is held only in our server's memory, to limit how many messages one visitor can send in 10 minutes; it is never written to disk or emailed. We count the messages each site receives per month, without their content, to apply the plan's limit. For this data the site's owner is the controller and we are their processor.
5. Services we use
These services process personal data for us under data processing agreements:
| Service | What it does | Where | Transfers outside the EU |
|---|---|---|---|
| netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany | Our server: accounts, workspaces, their runtimes | Germany | None |
| BunnyWay d.o.o. (bunny.net), Dunajska cesta 165, 1000 Ljubljana, Slovenia | CDN that delivers published sites; storage for published sites and for our encrypted backups; DNS | Slovenia and Germany; the CDN answers visitors from the location nearest to them, worldwide | Under the safeguards of Bunny's data processing agreement |
| Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA | Object storage for workspace data, kept in the EU; the Turnstile captcha | EU (storage); USA (company) | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
| Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA | Sending our emails, including messages visitors send with your sites' forms | USA | EU-U.S. Data Privacy Framework and Standard Contractual Clauses |
AI model for setting up a workspace. When you ask for a first draft while setting up a workspace, we send your answers and what we read from the websites you named to one AI service in the USA: Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, which runs the model itself, or OpenRouter, Inc., 169 Madison Avenue, New York, NY 10016, USA, which passes each request to the company running the model, OpenAI or Microsoft (Azure), in the USA. Anthropic does not train on this data, and we ask OpenRouter to use only providers that do not. OpenRouter does not store the content of these requests; Anthropic, OpenAI and Microsoft may keep them for up to 30 days to detect misuse. We transfer this data to the USA because it is necessary to build the draft you ask for (Art. 49(1)(b) GDPR). Only the websites you name are read, and only for this; you decide whether to ask for a draft or start with the blank template instead.
These act as independent controllers under their own privacy policies:
Google Ireland Limited (Dublin), GitHub, Inc. (San Francisco) and Apple Distribution International Ltd. (Ireland), when you sign in with them.
Polar Software, Inc. (Dover, Delaware, USA) and its payment processor Stripe, for paid plans.
IndexNow (
api.indexnow.org) and the search engines that take part in it, to which we report the addresses of a published site's new, changed and removed pages (public URLs only).The AI apps you connect, which act with the access you give them. Apart from setting up a workspace (above), Lacuno never calls an AI model, and it sends your AI apps nothing on its own.
Authorities and courts receive data only where the law obliges us to share it.
6. Security
Each workspace runs in its own isolated runtime with its own database and keys. Connections use HTTPS; our database and the runtimes are not reachable from the internet; workspace data in object storage is private; backups are encrypted (AES-256-GCM) before they leave our server; a workspace export is kept in private, encrypted object storage and only the workspace's owner can download it, through a link that works for five minutes; passwords are stored only as hashes; sign-up, sign-in and reports are rate-limited.
Our administrators see account data in an admin panel that requires two-factor authentication: metadata such as your email, sign-up date, sign-in methods, workspaces, their plan, usage and state, and your custom domains, never the content of your sites. Every time an administrator views your account or acts on it, for example to suspend a site, export a workspace for its owner or delete an account you asked us to delete, a log records who, what and when, with the reason for actions that need one.
7. How long we keep data, and how it is deleted
Account. Your account data stays while the account exists. When you delete your account (Settings → Delete my account), you are signed out everywhere, your AI apps lose access, your memberships in other people's workspaces end, every workspace you own is deleted, and then the account with its sign-in methods and sessions. Sessions expire after 7 days without use; verification and password links expire; rate-limit counters expire within an hour, and the count of verification emails sent to an address is deleted the next day.
Workspaces and sites. A workspace's content, its published sites and its custom domains stay until you delete the workspace. Deleting it removes it from our server, from object storage and from the CDN's storage, and purges the CDN. For point-in-time recovery the workspace database's history is kept for 7 days. Usage figures are deleted with the workspace. The try editor keeps your site only in your browser until you sign up and move it.
Setting up a workspace. Your answers, what we read from the websites you named and what we proposed stay with the workspace until you delete it; the draft itself is a site in your workspace. How many proposals and drafts your account asked for, per day, stays with the account until you delete it, so that the limits hold. The draft's screenshots are deleted after 7 days. OpenRouter keeps no content of the requests; Anthropic, OpenAI and Microsoft may keep them for up to 30 days.
Exports. A workspace export is deleted 24 hours after it is ready, and at once when the workspace is deleted. What you downloaded is yours to keep safe.
Members, invitations and activity. A membership lasts until the member leaves or is removed, or their account or the workspace is deleted. An invitation is deleted when it is accepted or revoked, and 7 days after it was sent when it expires unused. A workspace's activity is kept for 12 months and deleted with the workspace; when a member's account is deleted, their entries stay without their name.
Backups. Every night we back up the Cloud database and each workspace, encrypted, and the Cloud database also every hour; hourly backups are kept for 48 hours. We keep the 14 newest nightly backups and the newest backup of each of the last 6 months, so data you deleted can remain in a backup for up to 6 months. A deleted workspace's own backups are deleted at once. Backups are used only to recover from failures.
Site visitors. Bunny keeps CDN logs for 3 days. We keep daily bandwidth totals per workspace and, per site, the daily statistics of section 4, for 30 days on Free and 12 months on other plans; they are deleted with the site or the workspace. We keep no copy of a form message once it is emailed, nor its sender's IP address; the monthly message counts are deleted with the workspace.
Abuse reports and takedowns. A reporter's IP address is cleared after one day. Reports and takedown decisions are kept for 3 years after the matter is closed, also after the workspace is deleted, so that we can show what we decided and why.
Administrators' access log. Entries are kept for 3 years, also after the account is deleted, so that we can show who accessed what.
Emails. Resend keeps its own delivery logs under its retention rules.
8. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). In the dashboard you can download your account data and delete your account yourself (Settings), and export each workspace you own (its Export page). For anything else, email mail@chrisweiler.at.
You can complain to a supervisory authority; in Austria that is the Datenschutzbehörde, Barichgasse 40–42, 1030 Wien, dsb@dsb.gv.at, dsb.gv.at.
9. Changes
When this policy changes in a way that matters, we tell you by email or in the dashboard before the change applies.