Privacy Policy

Laminaro provides a governed endpoint that lets agents reach the tools and skills a workspace has granted. In this policy, "Laminaro", "we", "us" and "our" mean the Laminaro business, and "you" means the person or organisation using the service.

We are the controller of account and workspace data. For payments, Creem acts as the merchant of record and processes payment data under its own privacy policy.

We collect only what the service needs to operate:

• Account data: your name, email address, hashed password, two-factor authentication secret and backup-code hashes, and account timestamps.
• Workspace data: workspace and member names, roles, invitations, connection and source names, API descriptions you import, skills and bundles you author, policies, approvals, and comments.
• Credential references: connection credentials are stored as encrypted references in the secret broker. We do not return plaintext secrets to the browser or logs.
• Usage data: which endpoint and capability was invoked, caller identity and key identifier, status, latency, token and byte counts, a SHA-256 digest of the arguments, and redacted request/response traces.
• Technical data: IP address, user agent, session identifiers, request paths, timestamps, and error details used for security and reliability.
• Support data: the contents of messages you send to support, including attachments you choose to include.
• Billing data: plan and subscription status. Card and bank details are collected and stored by Creem, not by Laminaro.

We do not store the arguments of MCP calls. Runs keep a digest so a repeated call can be recognised, never the payload itself. Traces are redacted and capped before storage.

We do not run advertising trackers, sell personal data, or use your workspace content to train models. We do not ask for more data than the feature you are using requires.

We use the data above to:

• Create and secure your account, verify your email, and sign you in.
• Provide the console, execute granted capabilities, enforce policies and quotas, and record run receipts.
• Send transactional email such as verification, password reset, invitations, and security notices.
• Investigate abuse, fraud, security incidents, and failed calls.
• Provide support and answer your requests.
• Measure aggregate reliability and improve the product.
• Comply with legal obligations and enforce our Terms.

Where the GDPR or similar law applies, we rely on: performance of a contract for account and workspace data; legitimate interests for security, abuse prevention, and service reliability; consent for optional communications; and legal obligation for records we must keep.

You can withdraw consent at any time for processing that relies on consent, without affecting processing that already happened.

We share data only with providers that help us run the service, under contracts that limit their use of it:

• Cloudflare for DNS, CDN, and edge security.
• Our application host and managed PostgreSQL and Valkey providers for compute, database, and queue storage.
• Resend for transactional email delivery.
• Creem as merchant of record for payments, tax, invoicing, and refunds, once paid plans are live.
• Our observability stack for logs, metrics, and error tracking.
• Professional advisers and authorities when required by law or to protect rights and safety.

Laminaro operates from Mexico and uses providers in the United States and the European Union. Where data leaves your country, we use appropriate safeguards such as standard contractual clauses or an adequacy decision, and we keep the transfer limited to the service.

Account and workspace data are kept while the workspace is active. When you ask us to delete them, we remove or anonymise them within 30 days, except records we must keep for legal, tax, security, or dispute purposes.

Run metadata and audit records are kept for the life of the workspace so the trail remains useful, then deleted with it. Backups rotate out within 30 days. Support messages are kept for up to 24 months.

We use TLS in transit, encryption at rest, per-workspace encryption for credential references, hashed passwords, optional two-factor authentication, scoped API keys, least-privilege access, and append-only audit records. No system is completely secure, but we investigate and notify affected users of incidents as required by law.

Depending on where you live, you may have the right to access, correct, delete, restrict, object to, or port your personal data, and to withdraw consent. You can exercise these rights by emailing [email protected] with the subject “Privacy request”. We respond within 30 days.

You may also complain to your local data protection authority, including Mexico's INAI or the supervisory authority where you live. We would appreciate the chance to resolve your concern first.

We use a first-party session cookie to keep you signed in, and browser local storage for your theme and the workspace this browser last opened. These are required for the console to work. We do not use advertising cookies or third-party analytics that profile you across sites.

The service is for people aged 18 and over and is not directed to children. If you believe a child created an account, contact [email protected] and we will remove it.

We may update this policy as the service changes. Material changes are announced by email or in the console at least 14 days before they take effect. The date at the top always shows the current version.

Privacy questions and requests: [email protected]. Postal address: available on request for legal and privacy notices.