Privacy Policy

Last updated: September 2, 2026

This Privacy Policy explains how Tiny Lab Inc ("we," "us," or "our"), which operates the LMTY competitive intelligence service, collects, uses, and shares information in connection with lmty.com and the Service.

If you have questions, contact us at support@lmty.com or 3013 Seabrook Court, Redwood City, CA 94065.

1. Who this policy covers

This policy applies to our users: people who create an account, receive our briefings, or otherwise interact with the Service. When we say "you," we mean our users. Section 6 explains separately how we handle the public company information we monitor.

2. Information we collect from users

Account information. Name, email address, company, and role when you sign up or are added by your organization.

Configuration data. The competitors, products, and markets you choose to track, your tier and in-tier ordering, and your delivery preferences across web app, Slack, and email.

Billing information. For paid plans and partner agreements, we use Stripe to process payments. We do not store full card numbers. Stripe collects and processes payment details under its own privacy policy.

Usage data. How you interact with the Service, including briefings opened, features used, and log data such as IP address, browser type, and timestamps.

Communications. Messages you send us and, where applicable, Slack workspace details needed to deliver briefings to your channels, such as workspace and channel identifiers, information about the members of channels where briefings are delivered, and delivery logs.

3. How we use information

We use user information to operate and deliver the Service, authenticate accounts, process payments, send briefings and What's Changed updates across your chosen surfaces, respond to support requests, improve the product, detect abuse, and meet legal obligations.

We do not sell your personal information. See Section 9 for California-specific rights.

4. AI processing and subprocessors

The Service uses large language models to generate briefings and structured analysis. To produce a briefing or respond to a request, we may send model providers the public monitored content we track for you, your Service configuration (such as your company, competitors, products, markets, and delivery preferences), and any instructions or questions you send. We do not train, fine-tune, or build models using your information.

We use OpenRouter to route these requests to model providers. For production requests, we configure OpenRouter to avoid provider endpoints that may use submitted prompts or outputs to train models, and we do not enable prompt logging. Model providers may retain request data for a limited period for purposes such as abuse and security monitoring, in accordance with their data retention terms, before deleting it. OpenRouter and the providers it routes to may also process request metadata, and any tools or plugins we enable, such as web search, may have their own data practices.

We use the following subprocessors:

5. How we share information

We share information with the service providers and subprocessors described above (who are bound to protect it and to use it only to provide services to us), with the administrators of your account or organization, when required by law or valid legal process, and in connection with a merger, acquisition, or sale of assets. We may share aggregated or de-identified information that cannot reasonably identify you. Our subprocessor list may change as the Service evolves; we will update this policy to reflect material changes.

6. Monitoring of public information

We continuously collect publicly available information from company websites, public profiles, press, and structured metadata to detect and report changes for our users.

The information we monitor concerns companies and their products: pricing, positioning, messaging, features, integrations, and similar public-facing signals. We do not intentionally collect public information to build profiles of individuals. Personal information (such as an executive's name, title, or quote) may appear incidentally within the public business content we process, but it is not our object of collection and we do not organize monitored data around individuals.

We collect only from sources that are publicly accessible, and we do not attempt to circumvent authentication, paywalls, or technical access controls. We do not seek to collect special categories of sensitive personal data.

If this changes, we will update this policy before doing so.

7. Data retention

We retain your account and configuration data for as long as your account is active and as needed to provide the Service. When you close your account or organization, we delete or de-identify the personal information associated with it, subject to legal, security, billing, backup, and operational retention needs. We may retain the remaining account and configuration data in de-identified form, and we retain billing records where required by law. Security and operational logs are retained for a limited period for security, debugging, and abuse-prevention purposes.

We retain monitored snapshots of public company information for as long as needed to support change detection and historical reporting. These snapshots capture public company and product content and are not organized around your personal information as a user.

8. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing, subject to applicable exceptions. To exercise these rights, contact support@lmty.com. We may need to verify your identity before acting on a request, particularly for deletion or export. For accounts tied to an organization, some requests (such as deleting an organization's data) may need to come from an account administrator. We will respond within the timeframe required by applicable law.

You can unsubscribe from briefing emails using the link in any message. Account and billing messages (including those sent through our payment processor) are transactional and not subject to unsubscribe.

9. California privacy rights

If you are a California resident, the rights described in Section 8 apply to you to the extent required by applicable California law. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. If we become subject to additional California privacy disclosure requirements, we will update this policy to describe those rights and disclosures.

10. European and UK privacy rights

Where GDPR or UK GDPR applies, our lawful bases for processing user personal data are performance of a contract (delivering the Service), legitimate interests (operating, securing, and improving the Service), consent where required, and legal obligation. You may have rights to access, correct, delete, port, object to, or restrict certain processing of your personal information, subject to applicable exceptions. You also have the right to lodge a complaint with your local data protection authority or supervisory authority.

To exercise privacy rights, contact us at support@lmty.com.

11. International transfers

Your information may be processed in the United States and other countries where our subprocessors operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

12. Security

We use reasonable technical and organizational measures to protect information, including encryption of data in transit, access controls, and least-privilege practices for who on our team can reach production data. No system is perfectly secure, so we cannot guarantee absolute security.

To report a security concern, contact support@lmty.com.

13. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

14. Changes to this policy

We may update this policy from time to time. We will post the new version here and update the "Last updated" date. Material changes will be communicated as required by law.

15. Contact

Tiny Lab Inc (operator of the LMTY service)
3013 Seabrook Court, Redwood City, CA 94065
support@lmty.com