Privacy notice

Last updated 9 November 2026 · Applies to the Lasoco app for Android and to lasoco.app

1. About this notice

1.1 This notice explains how IMPETIK LIMITED uses personal data when you use the Lasoco mobile application (the App) and the website at lasoco.app (the Website), together the Service. "We", "us" and "our" mean IMPETIK LIMITED. "You" means the person using the Service.

1.2 It is given under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and is also the privacy policy shown in the app store listing.

2. Who we are and how to contact us

2.1 The controller of your personal data is IMPETIK LIMITED, a company registered in England and Wales under company number 15229559.

2.2 For any question about this notice, to exercise your rights or to ask for your data to be deleted, email privacy@lasoco.app or write to us at the address above. We have not appointed a data protection officer, as we are not required to.

3. The personal data we use, why, and our lawful basis

3.1 The table below sets out each category of personal data we hold on our servers, the purpose for which we use it, the lawful basis under Article 6(1) UK GDPR, and how long we keep it. "Contract" means the processing is necessary to provide the Service you have asked for under our Terms of Use (Article 6(1)(b)). "Legitimate interests" means the processing is necessary for our legitimate interests, which we name, and those interests are not overridden by your rights (Article 6(1)(f)).

3.2 Special category data. We do not ask for information about your health, religion, ethnicity, sexual life or orientation, political opinions or similar matters. If you choose to include such information in a chat, we process it only to provide the feature you are using, and the memory feature is instructed to keep health details only if you ask it to remember them; where you ask the memory feature to remember such details, we rely on your explicit consent (Article 9(2)(a) UK GDPR), which you can withdraw by asking the assistant to forget them or by deleting your account.

3.3 Whether you must provide data. You must give an email address to create an account; without it we cannot provide the Service. Everything else is optional: you choose what to write, add, follow or post, and whether to connect a mailbox or turn on notifications.

3.4 Deleting a single chat. When you delete a chat, it is removed from your devices and from synchronisation at once, and the files attached to it are deleted from our storage. The messages themselves, and any reports you made on that chat, are kept in our database, marked as deleted, for 30 days and are then erased automatically. Usage records for that chat (which contain no message content) and memory facts already taken from it are not removed by deleting the chat; memory facts can be removed by asking the assistant to forget them. If you want a deleted chat erased now, email privacy@lasoco.app.

3.5 Consent. Apart from the explicit consent described in clause 3.2 (special category details you ask the memory feature to remember), we do not rely on consent as our lawful basis for the processing in this notice. Some features act only when you give permission in the App or in your phone's settings: notifications, camera, microphone, photos, and the assistant reading a website you have added to Lasoco. You may withdraw any such permission at any time, and the feature then stops.

4. Data kept on your phone and sent directly to others

4.1 Your mailbox. If you add a mailbox, your mail sign-in (access tokens, or a username and password) is stored only in your phone's secure storage and is never sent to our servers. Your phone fetches, searches and sends mail directly with your mail provider, and keeps your messages, drafts and attachments locally. These are removed from the phone when you remove the mailbox or sign out. Your mail provider processes your mail under its own terms, as a separate controller.

4.2 Mail permissions. When you add a mail account, your provider may ask you to allow Lasoco to read and send your mail and to read your people suggestions (used to suggest recipients as you type), together with your basic profile. Lasoco does not request access to your contacts or calendar. You can withdraw Lasoco's access at any time in your mail provider's account settings.

4.3 Other local data. A copy of your chats (removed when you sign out or choose "Clear this phone"), what you follow and save in News and Sports, social drafts and cached threads, websites you add to Lasoco with their cookies, and your app settings are stored on your phone. App settings such as theme and preferred model remain after sign-out until you uninstall the App or clear its data.

4.4 Direct requests from your phone. To display website icons beside sources the assistant cites, your phone requests them from a third-party icon service, which receives your IP address and the website's domain. When setting up some mailboxes, the domain of your email address is looked up through a public DNS service. If you load remote images in an email (the default is to ask you first), the sender's server receives your IP address. The App checks our app update service for updates, which receives your IP address but no content.

5. The AI assistant and memory

5.1 What is sent. The assistant is powered by AI models operated by third-party AI providers. Each time you use it we send, through an AI gateway operated by us, the information needed to produce the answer: your message and the earlier messages in that chat; files you have added; your memory facts; where you are in the App; and anything you ask the assistant to work with. In particular:

• Email. When you ask the assistant to draft or rewrite an email, attach an email to a chat, or ask about your mail, the text of the emails concerned (including senders' names, addresses and dates) is sent from your phone through our servers to an AI provider. We do not store that email text, but the assistant's reply (which may restate it), any draft it writes and the short references described in clause 3.1 are saved in your chat.
• Websites you add. Before the assistant first reads a page of a website you have added, the App asks your permission. The page text is then sent to an AI provider.
• Voice. When you dictate, the recording is sent to an AI provider for transcription. We do not store the recording.
• Images and search. Image requests, and web searches the assistant runs, are sent to an AI provider. News searches are sent, without your account identifier, to our news service, which uses an AI provider to match them to stories.

5.2 AI providers. We send requests through our own AI gateway to third-party AI model providers. We do not attach your email address or account identifier, although the content of a request may itself contain personal data (for example your name, if it appears in a chat or a memory fact). Each provider processes requests under its own terms. You may ask us at privacy@lasoco.app for the current list of providers.

5.3 Memory. About every 15 minutes, for users who have recently chatted, an AI model reads the new messages in your chats (excluding deleted chats, and, in chats that used your mail or a website, only your own words) together with your existing facts, and may add, update or delete facts. It is instructed to keep facts such as your name, where you live, your work, family, languages and how you like answers, never to keep passwords or codes, and to keep health details only if you ask it to. Up to 30 facts of up to 200 characters each are kept and added to every conversation with the assistant.

5.4 Your control over memory. The App does not yet provide a screen to view memory facts or a setting to switch the feature off. You may ask the assistant in a chat to forget something, and the next memory update will remove it. You may also email privacy@lasoco.app to obtain a copy of your memory facts, to have them corrected or erased, or to object to the feature (clause 11). Deleting a chat does not remove facts already taken from it.

5.5 Automated decision-making. We do not make any decision about you based solely on automated processing that produces legal effects concerning you or similarly significantly affects you. The assistant generates content in response to your requests, and the memory feature generates a short profile of facts to personalise that content; neither is used to decide whether you may use the Service or on what terms.

5.6 AI output can be inaccurate. See our Terms of Use.

6. Other people's data

6.1 Emails, chats and files you use with the assistant may contain personal data about other people, such as the senders and recipients of your emails. We process it only to provide the feature you have asked for, on the basis of our and your legitimate interests in helping you manage your own correspondence, and we keep only what is described in clause 3.1. Please share only what you are entitled to share.

7. Social features and public content

7.1 Lasoco's social features run on the AT Protocol, an open network that is also used by other applications. When you use them, we create an account for you on a social server (a "PDS") operated for us and hosted in Germany.

7.2 Your handle, display name, profile, comments, likes and blocks are public. They are distributed across the network and can be read, copied and stored by people, applications and services outside Lasoco that we do not control. Your email address is held by the social server but is not published.

7.3 When you delete a comment or your account, we remove the content from our social server and notify the network. Other services may nonetheless keep copies they have already made, and replies other people made to you remain in their accounts.

8. Who receives your data

8.1 We do not sell your personal data and do not share it for advertising. The App contains no advertising, no advertising identifier and no third-party analytics, tracking or crash-reporting tools. We do keep operational records to run the Service and to diagnose errors and performance problems: our server's request and error logs (kept for up to 30 days) and usage records of which AI model answered and how many tokens it used (no message content). The Website sets no cookies and uses no analytics tools.

8.2 We use the following categories of service providers. Most process personal data on our behalf and on our instructions (processors); AI model providers process requests under their own terms, as described in clause 5.2:

• Hosting and infrastructure: runs our servers, file storage, queues, image processing, request logs and network security;
• Database hosting: stores the data described in clause 3.1;
• AI model providers: produce the assistant's answers, chat titles, transcriptions, images, search results, news-search matching and memory updates (clause 5);
• Email delivery: sends sign-in codes to you and comment reports to our moderation inbox;
• Push notification delivery: delivers notifications to your phone through the phone platform's notification service;
• Social server hosting: hosts the server for your social account.

8.3 A current list of the providers we use, with their locations, is available on request from privacy@lasoco.app.

8.4 We also share data with the following, who act as separate controllers: your mail provider, chosen by you (clause 4.1); other participants in the AT Protocol network, for public content (clause 7); and, where the law requires, courts, regulators, law enforcement or other public authorities. If our business or the Service is sold or reorganised, personal data may be transferred to the new owner, who will be bound by this notice.

9. International transfers

9.1 Some of our providers process personal data outside the United Kingdom. Our database is hosted in the United States; files are stored in Western Europe; sign-in emails are sent from the European Union; our hosting provider operates a global network. Our AI model providers, our database provider and the push notification services process data in the United States. Our social server is in Germany, our file storage in Western Europe and our email delivery provider in Ireland.

9.2 Where personal data is transferred to a country that is not covered by UK adequacy regulations, we rely, where the provider offers them, on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or, for recipients in the United States certified under it, the UK Extension to the EU–US Data Privacy Framework, as set out in that provider's terms. Requests sent to AI model providers are transferred under those providers' own terms (clause 5.2). Transfers to the European Economic Area rely on UK adequacy regulations. You can obtain a copy of the relevant safeguards from privacy@lasoco.app.

10. Deleting your account and data

10.1 You can delete your account at any time in the App under Settings → Delete account, or without the App at lasoco.app/delete-account. If you cannot use either, email privacy@lasoco.app from your account's email address and we will delete it within one month.

10.2 Deletion takes effect immediately and cannot be undone. It erases your account, sessions, chats and messages (including deleted chats), files, memory facts, usage records, reports of AI answers, notification and device data, follows, likes and blocks, your Today settings, and your social account and its content on our social server.

10.3 The following are not erased immediately:

• reports you made about other people's comments, which are kept without your identifier for moderation;
• notification event records (up to 14 days) and records of failed deliveries (up to 30 days);
• expired sign-in code records linked to your email address, until they are erased one day after they expire;
• backups and restore history of our database and social server, and our hosting provider's request logs, which expire on their normal cycle: up to 30 days;
• copies held by AI providers, if any (clause 5.2);
• copies of your public content already made by other services on the AT Protocol network (clause 7.3);
• Lasoco's access to your mail account, which you can remove in your mail provider's account settings;
• data stored on a phone that is still signed in to your account, until the App is signed out, cleared or uninstalled on that phone; those phones lose access to your account immediately.

10.4 You may also ask us to erase particular data without deleting your account (for example a deleted chat or a memory fact) by emailing privacy@lasoco.app.

11. Your rights

11.1 Subject to conditions and exceptions set by law, you have the right to: access your personal data and receive a copy; have inaccurate data corrected; have your data erased; restrict how we use it; object at any time to processing based on our legitimate interests (including the memory feature); receive data you provided in a portable format; and withdraw any consent you have given, without affecting processing before withdrawal.

11.2 You can export your chats in the App (Settings → Chat). To exercise any other right, email privacy@lasoco.app. We may need to verify your identity, usually by confirming that you control your account's email address. We respond within one month, which may be extended by two further months for complex requests; we will tell you if so.

11.3 If you are unhappy with how we use your data, please contact us first so that we can try to resolve it. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk/make-a-complaint, 0303 123 1113), or to the data protection authority in the country where you live or work.

12. Children

12.1 The Service is not intended for children under 13, and you must be at least 13 to use it. Thirteen is the age at which a child in the United Kingdom may consent to an online service on their own (Article 8 UK GDPR; section 9 Data Protection Act 2018). If the law where you live sets a higher age, you must be that age or have the consent of a parent or guardian.

12.2 The App does not currently verify age. If you believe a child under 13 has an account, email privacy@lasoco.app and we will delete it.

13. Security

13.1 We use appropriate technical and organisational measures to protect personal data. Connections to the Service are encrypted in transit; sign-in codes are stored only in hashed form; social account credentials are stored encrypted; files can be downloaded only by their owner; and mail credentials are stored only in your phone's secure storage. No system is completely secure; please keep access to your email account safe, because it is used to sign in.

14. Changes to this notice

14.1 We may update this notice. We will change the date at the top and, where a change materially affects you, tell you in the App before it takes effect.