LEGAL
Privacy Policy
Last updated June 16, 2026
The short version. We don't use tracking cookies, ad pixels, or third-party analytics. Your account data is stored in Singapore by default. The data you upload to train models stays yours — we process it only to run the service, and deleting a project removes it. Below is exactly what we collect, why, who we share it with, and the rights you can exercise by emailing privacy@langsat.ai.
1. Who we are
This Privacy Policy explains how Langsat — a service operated as a sole proprietorship based in Thailand ("Langsat", "we", "us") — handles personal data across our marketing site (langsat.ai), our web application, and our API (together, the "Service").
You can reach us about anything in this Policy at privacy@langsat.ai.
2. Our two roles: controller and processor
Langsat plays two different roles depending on the data involved:
- Controller — for the data we collect to run our business: your account details, billing information, the messages you send us, and technical and usage data. We decide why and how this data is processed, and this Policy governs it.
- Processor — for the datasets you upload and the models we train from them. We process that content only on your instructions, to deliver the Service. You own your datasets and your trained models; we claim no rights over them beyond what is needed to operate the Service.
Business customers can also request a Data Processing Agreement (DPA) covering our processing of any personal data contained in their datasets — email privacy@langsat.ai.
3. Information we collect
We collect personal data in three ways: directly from you (for example when you create an account or contact us), automatically as you use the Service (for example logs and usage records), and from the files you choose to upload.
Account data
When you create an account (through our identity provider):
| Category | Examples |
|---|---|
| Identity | Email address, display name |
| Credentials | Password (stored only as a one-way hash by our identity provider), email-verification status |
| Preferences | Time zone, language, interface preferences, subscription tier |
| Account metadata | Account identifiers, last-login time, created and updated timestamps |
Billing data
Payments are handled by Lemon Squeezy, our merchant of record. They collect and process your payment details; we never receive or store full card numbers. We keep only what we need to manage your subscription — billing name, billing email, billing country, the card brand and last four digits, and your subscription status.
Customer data you upload
To train models you upload datasets — CSV or Parquet files, or extracts from your database. Files are uploaded directly to our cloud storage through short-lived, single-use upload links, stored in a private location scoped to your account and project, cleaned, and used to train a model; the resulting model is stored alongside them. We treat this content as confidential and process it only to provide the Service to you.
Technical and usage data
- Local storage: after you sign in, your browser keeps an access token, a refresh token, a cached copy of your profile, and your theme choice in
localStorage. These are functional — they keep you signed in and remember your settings. They are not cookies and are not used for tracking. - Service logs: we keep operational records of jobs, credit usage, and API calls, plus standard server and security logs, to run, secure, and bill the Service.
Communications
If you email us (for example sales@langsat.ai or privacy@langsat.ai) or sign up for our newsletter, we receive your email address and whatever you choose to send.
You can opt out of newsletter and other non-essential emails at any time using the unsubscribe link in the email, or by contacting privacy@langsat.ai. We will still send you essential service messages — for example security, billing, and account notices.
4. How we use your data, and our legal bases
| Purpose | GDPR legal basis |
|---|---|
| Create and operate your account; deliver the Service | Performance of a contract |
| Process payments and manage subscriptions | Performance of a contract |
| Train models and run predictions on the data you upload | Performance of a contract / your instructions (as processor) |
| Secure the Service, prevent abuse, keep logs | Legitimate interests |
| Send product and newsletter emails | Consent (unsubscribe anytime) or legitimate interests |
| Meet legal and regulatory obligations | Legal obligation |
5. AI processing
To help detect your data's schema, classify the prediction task, and generate insights, parts of your dataset are sent to a third-party AI provider. Specifically, we send each column's metadata (name, type, basic statistics) together with a small number of sample values from that column — typically a handful of cells per column. This is used only to analyze and describe your data within the Service. It is not used to train the models we build for you, and under that provider's terms it is not used to train their models.
6. Cookies and local storage
Langsat does not use tracking cookies, advertising pixels, or third-party analytics, and
we do not show a cookie banner because there is nothing to consent to beyond what is strictly
necessary. The only browser storage we use is the functional localStorage described in
§3, which keeps you signed in and remembers your preferences.
7. Who we share data with
We do not sell your personal data. We share it only with the service providers ("sub-processors") that help us run Langsat — our cloud infrastructure, our AI provider, our payment processor, and our email provider. Each is bound to protect your data and to use it only to provide its service to us. The current list is on our Sub-processors page.
We may also disclose data where required by law (for example a valid legal request), to protect our rights or the safety of our users, or in connection with a merger, acquisition, or sale of assets — in which case we will require the recipient to honor this Policy.
8. International transfers
Your account data is hosted in Singapore by default; US or EU hosting is available for eligible plans on request. Some service providers (for example our AI and payment providers) may process data in other countries. Where data leaves a region with transfer rules — such as the EEA or the UK — we rely on an appropriate safeguard, such as the European Commission's Standard Contractual Clauses or an adequacy decision.
9. How long we keep data
We keep personal data only as long as we need it to provide the Service:
- You can delete your uploaded datasets and trained models at any time by deleting the project, which removes them from our storage.
- We delete your account data within 12 months after you close your account, and uploaded data within 12 months after your subscription ends — unless the law requires us to keep certain records longer.
- Operational and security logs, and rolling backups, are kept for up to 12 months and then deleted or overwritten.
10. How we protect your data
- Your data is encrypted in transit and at rest.
- Passwords are stored only as a one-way hash by our identity provider — we never see them in plain text.
- Our systems run inside private, network-isolated environments with strict, least-privilege access controls; databases are not exposed to the public internet.
- Each customer's data is logically separated and access-scoped to that account and project, and uploads use short-lived, single-use links.
- Access to systems and credentials is restricted, monitored, and audit-logged.
- Card payments are handled by a PCI-compliant payment processor and are not stored by us.
- If a security incident affects your personal data, we will notify you and the relevant authorities where the law requires.
11. Your rights
Depending on where you live, you have rights over your personal data. To exercise any of them, email privacy@langsat.ai; we will verify your request and respond within the time the law allows. If your personal data sits inside a customer's dataset, please contact that customer (the controller) — we will assist them as their processor.
EU / UK (GDPR) rights
You can request access to your data; correction of inaccurate data; erasure; restriction of processing; portability (a machine-readable copy); and you can object to processing based on legitimate interests. You can withdraw consent at any time, and you have the right to lodge a complaint with your local supervisory authority.
California (CCPA / CPRA) rights
You can request to know what personal information we collect and how we use it; request its deletion or correction; and opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information as those terms are defined under California law, and we will not discriminate against you for exercising your rights.
Thailand (PDPA) rights
You can request access to and correction of your personal data, object to or restrict certain processing, and withdraw consent to our use of it. We handle personal data in line with Thailand's Personal Data Protection Act (PDPA).
12. Automated decisions
We do not make decisions about you by automated means that produce legal effects or similarly significant effects on you. The predictive models built on our platform are created and operated by our customers for their own purposes. Where a customer uses a model to make decisions about you, that customer — not Langsat — is the controller responsible for those decisions, and you should contact them to exercise your rights.
13. Third-party links
Our website and Service may contain links to third-party websites or services that we do not operate. We are not responsible for the privacy practices of those third parties; we encourage you to review their privacy policies before providing them any personal data.
14. Children
Langsat is a business tool and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us data, contact privacy@langsat.ai and we will delete it.
15. Changes to this Policy
We may update this Policy from time to time. We will post the new version here and update the "Last updated" date above; for material changes we will give prominent notice, for example by email or an in-app message.
16. Contact us
Privacy questions or requests — and our data-protection contact — privacy@langsat.ai.
Langsat is operated as a sole proprietorship based in Thailand.