Privacy Policy

Who we are

Lannzo is operated by Crossmedia Software SL, a company registered in Spain with CIF B72817661, registered address Avenida Finisterre 275 2º IZ, 15008, A Coruña, Spain, and entered in the Commercial Registry under T 3800, F 9, S 8, H C 62640, I/A 1.

Crossmedia Software SL is the data controller for the personal data described in this policy. You can reach us at legal@lannzo.com for any question about this policy or about your data.

What we collect

We collect the data needed to run your account and the deployments you connect to it:

• Identity data from your sign-in method: your name, email address and profile identifier from GitHub or Google when you sign in with one of them, or the name, email and password you provide if you register directly.
• Organization and team data: the organizations you belong to, your role, and who owns each organization.
• Deployment data: the repositories you connect through the GitHub integration, the project and environment configuration you create, and the environment variables you provide for your own projects.
• Access tokens: the personal, CLI, MCP, automation and service tokens you create, scoped to what you granted them.
• Usage and log data: sign-in events, deployment activity, and the records kept in our audit log.
• Cookies and local storage described in the Cookies section below.

We do not knowingly collect data from children under 16.

Why we use it

We process your data on these legal bases:

• Performance of a contract: to create and run the account, organizations and deployments you ask for.
• Legitimate interest: to keep the platform secure, investigate abuse, and maintain the audit log that lets you and us see who changed what.
• Consent: where we ask for it separately, for anything not covered by the two bases above.

We do not use your data for advertising, and we do not sell personal data.

Cookies and similar technologies

Lannzo uses only the technical cookies needed to run the service:

• A session cookie, opaque and HttpOnly, that keeps you signed in. It cannot be read or copied by scripts running in your browser.
• A cookie that remembers your language choice once you set one explicitly.

Your theme preference (light or dark) is stored in your browser's local storage, not in a cookie, and never leaves your device.

We do not use advertising or third-party tracking cookies, and we do not run analytics scripts that identify you individually.

Who we share it with

We share data only where it is needed to provide the service:

• GitHub or Google, as the identity provider you chose to sign in with.
• Infrastructure and hosting providers who process data on our behalf, under contract, solely to run Lannzo.

We do not sell your personal data, and we do not share it with advertisers or data brokers.

International transfers

Some of the providers described above may process data outside the European Economic Area. Where that happens, we rely on the safeguards recognised under the GDPR, such as the European Commission's Standard Contractual Clauses, to keep your data protected to the same standard.

How long we keep it

We keep data for as long as your account or organization needs it, and for as long as the law requires afterwards. Retention periods are configurable per resource and organization; audit log entries are kept immutably, since their purpose is to preserve an accurate record of privileged actions. When you delete a project, organization or account, we remove the associated data within the periods configured for that resource, except where we must keep it to meet a legal obligation.

Your rights

Under the GDPR, you can ask us to:

• Access the personal data we hold about you.
• Correct it if it is inaccurate.
• Erase it, where the law allows.
• Restrict or object to how we process it.
• Receive a copy in a portable format.

To exercise any of these rights, write to legal@lannzo.com. If you are not satisfied with our response, you can lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es).

Security

Your session is held in an opaque, HttpOnly cookie that browser scripts cannot read. Access tokens are scoped and never grant more than the account that created them. Privileged actions are written to an audit log that cannot be rewritten after the fact. Builds run isolated from the network while your project is being prepared, so nothing unexpected can reach it during that process.

Changes to this policy

We may update this policy as Lannzo evolves. If we make a material change, we will update the date at the top of this page; continued use of Lannzo after a change means you accept the updated policy.

Contact

For anything related to this policy or your personal data, write to legal@lannzo.com or to Crossmedia Software SL, Avenida Finisterre 275 2º IZ, 15008, A Coruña, Spain.