Privacy Policy

Last updated: October 1, 2026

This Privacy Policy explains how Tiny Lab Inc (“we,” “us,” or “our”), which operates the LMTY competitive intelligence service, collects, uses, and shares information in connection with lmty.com and the Service.

If you have questions, contact us at contact@lmty.com or 3013 Seabrook Court, Redwood City, CA 94065.

1. Who this policy covers

This policy applies to our users: people who create an account, receive our briefings, or otherwise interact with the Service. When we say “you,” we mean our users. Section 7 explains separately how we handle the public company information we monitor.

2. Information we collect from users

Account information. Name, email address, company, and role when you sign up or are added by your organization.

Configuration data. The competitors, products, and markets you choose to track, your tier and in-tier ordering, and your delivery preferences across web app, Slack, and email.

Billing information. For paid plans and partner agreements, we use Stripe to process payments. We do not store full card numbers. Stripe collects and processes payment details under its own privacy policy.

Usage data. How you interact with the Service, including briefings opened, features used, and log data such as IP address, browser type, and timestamps.

Communications. Messages you send us and, if you enable Slack delivery, the Slack workspace and channel information needed to deliver briefings, along with related delivery logs.

3. How we use information

We use user information to operate and deliver the Service, authenticate accounts, process payments, send briefings and What’s Changed updates through the web app and email and, where enabled, Slack, respond to support requests, improve the product, detect abuse, and meet legal obligations.

We do not sell your personal information. See Section 10 for California-specific rights.

4. AI processing and subprocessors

The Service uses large language models to generate briefings and structured analysis. To produce a briefing or respond to a request, we may send model providers the public monitored content we track for you, your Service configuration (such as your company, competitors, products, markets, and delivery preferences), and any instructions or questions you send. We do not train, fine-tune, or build models using your information.

We use OpenRouter to route these requests to model providers. For production requests, we configure OpenRouter to avoid provider endpoints that may use submitted prompts or outputs to train models, and we do not enable prompt logging. Model providers may retain request data for a limited period for purposes such as abuse and security monitoring, in accordance with their data retention terms, before deleting it. OpenRouter and the providers it routes to may also process request metadata, and any tools or plugins we enable, such as web search, may have their own data practices.

We also use OpenAI’s API directly to generate vector embeddings for search and similarity. Embeddings are not used to train models, and request data may be retained for a limited period before deletion.

We use the following subprocessors:

5. Cookies and analytics

We use Google Analytics, Amplitude, and Crazy Egg on our marketing site to understand how people find and use the site and to improve its content and design. We do not use these analytics tools in the LMTY web app.

These providers may use cookies or similar technologies to collect information such as pages viewed, links or buttons selected, referral source, device and browser details, approximate location derived from an IP address, and a pseudonymous browser or device identifier. Crazy Egg may also help us understand interactions through heatmaps and session recordings. We configure Crazy Egg to mask form fields and other potentially sensitive content.

We use this information only for our own site measurement and improvement. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use analytics information for advertising. We configure Google Analytics without Google Signals, advertising personalization, or sharing with advertising products.

If your browser sends a Global Privacy Control signal, we treat it as an instruction not to run non-essential analytics in that browser. You can also limit or delete cookies through your browser settings. To prevent Google Analytics from collecting information about your visits, you can use Google’s opt-out browser add-on.

Where applicable law requires consent for a particular technology or use, we will request consent before enabling it.

6. How we share information

We share information with the service providers and subprocessors described above (who are bound to protect it and to use it only to provide services to us), with the administrators of your account or organization, when required by law or valid legal process, and in connection with a merger, acquisition, or sale of assets. We may share aggregated or de-identified information that cannot reasonably identify you. Our subprocessor list may change as the Service evolves; we will update this policy to reflect material changes.

7. Monitoring of public information

We continuously collect publicly available information from company websites, public profiles, press, and structured metadata to detect and report changes for our users.

The information we monitor concerns companies and their products: pricing, positioning, messaging, features, integrations, and similar public-facing signals. We do not intentionally collect public information to build profiles of individuals. Personal information (such as an executive’s name, title, or quote) may appear incidentally within the public business content we process, but it is not our object of collection and we do not organize monitored data around individuals.

We collect only from sources that are publicly accessible, and we do not attempt to circumvent authentication, paywalls, or technical access controls. We do not seek to collect special categories of sensitive personal data.

If this changes, we will update this policy before doing so.

8. Data retention

We retain your account and configuration data for as long as your account is active and as needed to provide the Service. When you close your account or organization, we delete or de-identify the personal information associated with it, subject to legal, security, billing, backup, and operational retention needs. We may retain the remaining account and configuration data in de-identified form, and we retain billing records where required by law. We keep operational and error logs to run, secure, debug, and improve the Service. These logs may contain limited personal information, such as identifiers indicating which account or user an event relates to, and some are retained by our infrastructure and monitoring tools for as long as those systems keep them.

We retain monitored snapshots of public company information for as long as needed to support change detection and historical reporting. These snapshots capture public company and product content and are not organized around your personal information as a user.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, and to object to or restrict certain processing, subject to applicable exceptions. To exercise these rights, contact contact@lmty.com. We may need to verify your identity before acting on a request, particularly for deletion or export. For accounts tied to an organization, some requests (such as deleting an organization’s data) may need to come from an account administrator. We will respond within the timeframe required by applicable law.

You can unsubscribe from briefing emails using the link in any message. Account and billing messages (including those sent through our payment processor) are transactional and not subject to unsubscribe.

10. California privacy rights

If you are a California resident, the rights described in Section 9 apply to you to the extent required by applicable California law. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. If we become subject to additional California privacy disclosure requirements, we will update this policy to describe those rights and disclosures.

11. European and UK privacy rights

Where GDPR or UK GDPR applies, our lawful bases for processing user personal data are performance of a contract (delivering the Service), legitimate interests (operating, securing, and improving the Service), consent where required, and legal obligation. You may have rights to access, correct, delete, port, object to, or restrict certain processing of your personal information, subject to applicable exceptions. You also have the right to lodge a complaint with your local data protection authority or supervisory authority.

To exercise privacy rights, contact us at contact@lmty.com.

12. International transfers

Your information may be processed in the United States and other countries where our subprocessors operate. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

13. Security

We use reasonable technical and organizational measures to protect information, including encryption of data in transit, access controls, and least-privilege practices for who on our team can reach production data. No system is perfectly secure, so we cannot guarantee absolute security.

To report a security concern, contact contact@lmty.com.

14. Children

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

15. Changes to this policy

We may update this policy from time to time. We will post the new version here and update the “Last updated” date. Material changes will be communicated as required by law.

16. Contact

Tiny Lab Inc (operator of the LMTY service)
3013 Seabrook Court, Redwood City, CA 94065
contact@lmty.com