Is Lattice safe with your data?

Named rights portals

Lattice publishes dedicated request URLs for privacy requests and for the CCPA opt-out, and names a Data Protection Officer contact address, so access, deletion, correction, portability and objection all have a route to exercise them.

No retention period

The policy keeps Personal Information "for as long as is necessary" and names no number of days, months or years. It also reserves the option to retain data longer for a legitimate business interest, and it sets no deletion timeline after an account closes.

Training-data use unaddressed

The policy says usage and interactions may be analyzed "using AI-powered tools" but never states whether user inputs train models, offers no opt-out mechanism, draws no distinction between paid and free tiers, and says nothing about who owns generated outputs.

Strongest protections are region-gated

Standard Contractual Clauses for international transfers and the purpose-by-purpose legal bases both apply only to residents of the EEA, UK or Switzerland, and the advertising-sharing opt-out is framed for California residents, so the global default disclosure is thinner than it first appears.