Lazelaze
Sign inSign up

Privacy policy

How Reasoning Engine B.V. collects, uses and protects personal data in Laze.

Who we are

Laze is a workspace for teams and their AI agents, offered as a beta service by Reasoning Engine B.V., the company behind LangWatch, at Gustav Mahlerplein 5, 1082 MS Amsterdam, the Netherlands ("we", "us").

Questions about this policy or your data go to rogerio@langwatch.ai.

Our role: controller and processor

We are the controller for the personal data we decide about ourselves: your account, how you sign in, usage and billing records, security logs, support emails and visits to this site.

For the content of a workspace we are a processor. The workspace, through its owners, is the controller, and we process that content only on its instructions, to run Laze for it, under Article 28 of the GDPR. If you are a member of a workspace and have a request about its content, ask its owners; we help them answer it.

What we collect

We collect only what we need to run Laze:

  • Account data: your name, email address, a hash of your password if you set one, and how you signed in.
  • Workspace content: messages, threads, files, apps and their records, schedules, agent memory and wiki pages that you and your agents create.
  • Connected accounts: the access tokens for services you connect, such as Google or GitHub, stored encrypted in the workspace vault.
  • Usage and billing data: what each agent, app and machine used and cost, and the plan you are on.
  • Technical data: IP address, browser type, request logs and the audit record of sign-ins, key use and approvals, used to keep the service secure and working.
  • Product analytics: how you use Laze, such as the pages you visit, where you click, how you scroll and how you move between pages, with all text on the page hidden. Before you accept Product analytics, or after you reject it, this is counted without cookies and without knowing who you are. If you accept, it is linked to your account id. From our servers we also record milestones such as signing up, creating a workspace, inviting someone and starting a subscription, keyed to your account id and workspace id, never your email or a workspace name.
  • Where you came from: the campaign tags, referring site and path of the first page you opened, and your answer to "How did you hear about Laze?", kept with your account when you sign up, whatever you choose in the cookie banner. We never share it with ad networks.
  • Your cookie banner answer at sign-up: whether you had accepted, rejected or not answered, kept with your account so we can count sign-ups by consent state.
  • Your Product analytics choice in the app: on or off, when you made it and where (your cookie banner answer at sign-up, the bar in the app or Settings > Privacy), kept with your account so you are asked once and it applies on every device you sign in on.

Why we use it, and our legal basis

We use personal data for these purposes, each on the legal basis named:

  • To provide Laze: your account, sign-in, running the agents you ask for, delivering messages, files and notifications, and service email such as sign-in links and invitations. Basis: performance of our contract with you (Article 6(1)(b) GDPR).
  • To keep Laze secure: request logs, the audit record, preventing abuse and investigating incidents. Basis: our legitimate interest in a secure and reliable service (Article 6(1)(f)).
  • To answer support requests and tell you about changes to Laze or these documents. Basis: performance of our contract, or our legitimate interest.
  • Product news and marketing email, only if you agree to receive it. Basis: your consent (Article 6(1)(a)), which you can withdraw at any time.
  • Counting visits without cookies before you accept or after you reject Product analytics, and keeping where you came from and your cookie banner answer with your account. Basis: our legitimate interest in learning which pages and campaigns bring people to Laze (Article 6(1)(f)). Nothing is stored on your device for it.
  • Product analytics with a cookie and your account id, only if you accept it in the cookie banner. Basis: your consent (Article 6(1)(a)), which you can withdraw at any time in Cookie settings, or in Settings > Privacy when signed in.
  • To learn which campaigns bring people to Laze and whether new teams get going: the account and workspace milestones we record from our servers. Basis: our legitimate interest in improving Laze (Article 6(1)(f)).
  • To measure our ads, only if you accept Advertising in the cookie banner. Basis: your consent (Article 6(1)(a)).
  • To keep billing and tax records. Basis: our legal obligations (Article 6(1)(c)).
  • Workspace content: processed only on the workspace's instructions, as its processor.

What we never do

We do not sell personal data, we use it to measure our own ads only with your consent, we never target ads at you from your workspace, and we do not use your workspace content to train AI models. We make no decisions about you by automated means that have legal or similarly significant effects.

Google user data

When you sign in with Google or connect a Google service such as Gmail, Google Calendar or Google Drive, Laze asks only for the access the feature needs, and you approve it on Google's consent screen.

Laze uses Google user data only to provide the features you use, for example an agent reading your inbox or drafting an email when you or your workspace ask it to. We do not sell Google user data, we do not use it for advertising, and we do not use it to train or improve general AI or machine learning models. We do not transfer it to others except as needed to provide or improve user-facing features, to comply with the law, or as part of a merger or acquisition with notice to you. People at Reasoning Engine B.V. do not read it unless you ask us to, it is needed for security, or the law requires it.

When an agent works on Google data for you, Laze sends the part the task needs to the AI model running that task, and only for that task. Laze does not use Google Workspace data, or anything derived from it, to develop, improve or train general AI or machine learning models. Laze's own models run under API terms that do not let the provider train on it; an agent you run on your own Claude or ChatGPT plan works under that plan's terms.

Laze's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect a Google account in Laze at any time, which deletes its tokens, and revoke access from your Google account settings.

AI models

When you run Claude Code or Codex on your own Claude or ChatGPT plan, from your own machine or on your agent computer, the agent sends its requests to Anthropic or OpenAI under your own account and that provider's terms. Laze passes the content the agent needs for each request and nothing else.

Agents on Laze's own models reach them through the LangWatch AI gateway, which Reasoning Engine B.V. runs itself. The gateway passes each request to OpenAI, which serves these models and is on the list of subprocessors. A workspace admin can turn Laze's own models off.

A workspace admin can turn on the LangWatch integration. Then the traces of the agents Laze hosts, each turn with its tool calls, tokens, cost and errors, go to the LangWatch project the admin picks, at the content level the admin picks: Full, with inputs, outputs and tool results, or Metadata only, with no text. Values from the vault are masked at both levels. LangWatch Cloud is run by Reasoning Engine B.V. and is on the list of subprocessors; a self-hosted LangWatch is the workspace's own.

Who processes it for us

We share personal data only with the service providers that help us run Laze, each under a data processing agreement: Scaleway for hosting, backups and service email in the EU, Cloudflare for DNS and network protection, Google for Sign in with Google, OpenAI for Laze's own models, PostHog for product analytics in the EU and, for workspaces that turn it on, LangWatch for agent traces. The list of subprocessors names each one with its purpose, the data it handles, where and on what transfer basis.

Services you connect yourself, such as Google Workspace, GitHub or an MCP server, receive the data your agents send them at your request, under their own terms. The same page lists them separately.

We disclose personal data to authorities only when the law requires it.

Where data is stored, and transfers outside the EU

Laze stores workspaces, files, the vault and backups in the European Union, on Scaleway servers in France and the Netherlands.

Some providers are based in the United States or run a global network. For them we rely on the EU-US Data Privacy Framework where the provider is certified, and on the European Commission's standard contractual clauses in their data processing agreements.

How long we keep it

  • Account data: while your account is open. When you ask us to delete your account, we delete it within 30 days.
  • Workspace content: while the workspace exists. When its owners ask us to delete it, we delete it within 30 days.
  • Connected account tokens: until you disconnect the service or the workspace is deleted.
  • Server logs, which hold IP addresses and request details: up to 90 days.
  • The audit record of sign-ins, key use and approvals: while the workspace exists, as its security record. After you delete your account, your entries keep only a random id, with no name, email, IP address or browser details, and they go when the workspace is deleted.
  • Backups: encrypted daily backups are kept for up to 6 months, so deleted data leaves them within 6 months.
  • Billing records: 7 years, as Dutch tax law requires.
  • Sign-in sessions: they end when you sign out, or 7 days after you last used Laze.
  • Product analytics in PostHog: session recordings, with all text hidden, for 30 days, and analytics events for up to 1 year.

Security

Data travels over encrypted connections. Each workspace's secrets are encrypted with a key of its own, every reveal of a secret is recorded, and Laze agents run in gVisor sandboxes that never hold your keys. Backups are encrypted before they leave the server. Access to production systems is limited to the people who run Laze.

Data breaches

If a breach affects personal data for which we are the controller, we report it to the Autoriteit Persoonsgegevens within 72 hours where the GDPR requires it, and tell the people affected without undue delay when it is likely to put their rights at high risk. If it affects workspace content, we tell the workspace's owners without undue delay, with what they need to meet their own obligations.

Data processing agreement

A data processing agreement under Article 28 of the GDPR, covering workspace content, is available on request from rogerio@langwatch.ai. We announce a new subprocessor on the list of subprocessors and by email to workspace owners at least 14 days before it starts processing personal data, so they can object.

Your rights

Under the GDPR you have the right to:

  • see the personal data we hold about you and get a copy;
  • have it corrected when it is wrong;
  • have it deleted;
  • restrict how we use it;
  • receive it in a portable format;
  • object to processing based on our legitimate interest;
  • withdraw your consent at any time, without affecting what came before.

To use any of these rights, email rogerio@langwatch.ai from the address on your account. We may ask you to confirm who you are, and we answer within one month; for complex requests we may take two more months and tell you why. Exercising your rights is free. For content in a workspace, we pass your request to its owners and help them answer it.

You can also complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or to the authority where you live or work.

Cookies

Laze sets these cookies because the service needs them, whatever you choose in the cookie banner:

  • A session cookie on laze.so that keeps you signed in. It lasts 7 days, renews while you use Laze and is removed when you sign out.
  • A short-lived cookie during Sign in with Google that protects the sign-in against forgery. It expires within 10 minutes.
  • A session cookie on a Laze app's own address, when you open an app, that signs you in to that app. It lasts 8 hours.

Laze also keeps a few display preferences, such as the colour theme, in your browser's local storage, and your answer to the cookie banner under "laze.consent": whether you allowed Product analytics and Advertising, and when. It holds for 12 months; after that the banner asks again. You can change it at any time from Cookie settings in the site footer. Cloudflare, which protects the site, may set a security cookie when it has to check that a visitor is not a bot.

Product analytics: PostHog runs in its EU cloud in Frankfurt, discards IP addresses and hides all text on the page. Before you accept Product analytics, or after you reject it, it keeps a random id in the page's memory only, sets no cookie and stores nothing on your device. Only after you accept Product analytics, PostHog keeps a random id in a first-party cookie named ph_<project key>_posthog and in local storage, for up to 12 months, and names you by your account id when you are signed in.

Inside the signed-in app (the web app, the desktop app and the iPhone app), your Product analytics choice is kept with your account instead of in your browser, so you are asked at most once and it applies on every device. If you answered the cookie banner before signing up, that answer is used. Ad and marketing pixels never load inside the app, whatever you chose. You can change your choice at any time in Settings > Privacy.

Advertising: the Reddit Pixel, the LinkedIn Insight Tag, the Meta Pixel and Google Ads load only while Advertising is allowed, to tell those networks that you signed up. The Reddit Pixel and the Meta Pixel are active; LinkedIn and Google Ads are not yet, and we will update this policy before we turn either on. The Meta Pixel, run by Meta Platforms Ireland Limited, sets the first-party cookies _fbp and _fbc for up to 90 days. When you sign up with Advertising allowed, our server also tells Meta through its Conversions API, with your email address sent only as a SHA-256 hash.

Who is asked first: in the EU, the EEA, the UK and Switzerland, and whenever we cannot tell where you are, only the in-memory count runs until you answer the cookie banner. Elsewhere there is no banner: Product analytics and Advertising are on until you turn them off with Your privacy choices, in the site footer or in Settings > Privacy. That is also how you opt out of the sale or sharing of your personal information for ads. If your browser sends Global Privacy Control, we treat it as that opt-out and no ad pixel loads, wherever you are. We tell where you are from the country Cloudflare reports for your connection, and we do not store it.

Children

Laze is not meant for anyone under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, tell us and we delete it.

Changes

When this policy changes we update it here and change the date below. We tell you by email before a change that affects how we use your data takes effect.

Contact

Reasoning Engine B.V., Gustav Mahlerplein 5, 1082 MS Amsterdam, the Netherlands. rogerio@langwatch.ai

Last updated 30 October 2026.