Privacy notice
Last updated: September 30, 2026
About this notice
This notice explains how Latten handles information when you use our website, console, SDK integrations, and Discover. For privacy questions or requests, contact hello@latten.io. If you use Latten through an organization, that organization also determines what information its integrations send to us.
Information we receive
We receive account details such as your email address, sign-in information, team membership, and subscription status. We also receive information you submit in forms or support requests. Our servers process request information needed to operate and protect the service, including IP addresses, request times, and errors. Session cookies keep you signed in.
Application connections and telemetry
The installer scans supported source files locally. Its audit sends connection categories, destination identifiers, model and provider names, call-site counts, and configuration flags. The console stores this inventory. SDK instrumentation sends the metadata your application supplies, such as actor and target identifiers, actions, timing, token usage, cost, and detected personal-data categories and counts. Do not place secrets or personal data in identifiers or labels. Coverage depends on the code scanned and the paths instrumented.
Connected databases and services
When you configure a connection, Latten processes its address and credentials to access the service you selected. Connection credentials are encrypted in storage. Depending on the integration, queries and scans may process records from that service. Only connect systems and data you are authorized to use.
Discover and AI providers
The anonymous Discover check fetches public MCP tool definitions without creating a saved scan or making a model request. Server request logs may still be generated. Signed-in benchmarks store the endpoint, tool definitions, product description, generated requests, results, and recommendations. Authorization headers are encrypted in storage. Cancelling a scan removes its saved authorization header. Completed scans retain credentials so you can run description experiments.
What a benchmark sends to a model
Discover sends tool definitions, your product description, test requests, and model conversation content to the configured AI provider, currently OpenAI. If you permit tool execution, returned tool data can also be sent to that provider to continue the test and evaluate the result. Dry runs do not execute your tools. Stored result text is checked for supported personal-data patterns; this does not identify every kind of sensitive information. Use test data and narrowly scoped credentials. Provider processing is subject to its own terms and privacy practices.
Why we process information
We use this information to provide the features you request, manage accounts and billing, investigate errors and abuse, respond to support requests, and maintain the service. Where data protection law requires a legal basis, these activities rely on performing our agreement with you, our legitimate interests in operating and securing the service, or legal obligations, as applicable. Where consent is required, you may withdraw it.
Who receives information
Service providers process information needed for hosting, email delivery, payments, and AI features. Stripe processes payment information; Latten stores subscription and customer identifiers. A sign-in provider processes your sign-in when you choose that option. Information may also be disclosed when required by law or necessary to investigate abuse or protect legal rights. Providers may process information in countries other than your own; applicable transfer requirements depend on the service and your agreement with us.
Retention and deletion
Account information and saved reports remain available while needed to provide the service. The console does not currently apply an automatic expiry to Discover reports. Discover authorization headers expire after 24 hours and are cleared when a scan completes, fails, or is cancelled. You can delete your account in settings after cancelling active subscriptions or contact hello@latten.io with a deletion request. Account deletion removes associated application records; billing records, security logs, and backups may be retained where needed for legal obligations, security, or recovery. Contact us for retention details relevant to your deployment.
Your choices and rights
You can stop sending SDK telemetry, disconnect integrations, revoke credentials at their source, and cancel a Discover run or remove its stored credentials after it finishes. Cancellation cannot recall a request already sent. Depending on your location, you may have rights to access, correct, delete, restrict, object to processing, or receive a copy of your personal data. Contact hello@latten.io to exercise these rights. We may need to verify your identity. You may also complain to your local data protection authority.
Updates
We will update the date on this notice when it changes and provide additional notice of material changes where required. Contact us if you need an explanation of how a change affects your use of Latten.