Privacy Policy

Lasso Tech ("Lasso", "we", "our", "us") makes Lasso, a Chrome extension and web app for commenting on web pages (together, the "Service"). This policy explains what we collect, why, who we share it with, and the choices you have. If anything here is unclear, email us at founder@lasso.team.

The short version

We collect what you put into Lasso (comments, screenshots, collections) and what we need to run your account.
The extension only sends page information to Lasso when you comment, or while the Lasso side panel is open.
We do not sell your data, show ads, or share it with advertisers.
You can export your comments at any time, and delete your account and data.

What we collect

Information you give us

Account details: your name, email address and password (stored only as a secure hash). If you sign in with Google, we receive your name, email address and profile picture from Google.
Your content: comments, replies, @mentions, collections, collection settings and anything else you type into Lasso.
Team and billing details: your team's name, its members and roles, invitations you send, and your plan and seat count. Payments are handled by Stripe. We never see or store your full card number.
Messages to us: anything you send when you contact us or book a demo.

Information captured when you comment

When you place a comment on a web page, the extension records what is needed to show that comment in the right place later:

the page's address (URL) and title;
a screenshot of the area of the page you commented on, taken at the moment you click;
information about the element you clicked: its position, a technical description of where it sits on the page, up to 300 characters of its visible text and a short snippet of its code.

Screenshots capture whatever is visible in that area of your screen. If the page shows personal or confidential information, it can end up in the screenshot, so check what is on screen before you comment.

Information collected automatically

Page lookups: while the Lasso side panel is open, the extension sends the address of the page you are viewing to Lasso so it can load the comments for that page. We use it only to answer that request. We do not build a browsing history from it, though addresses can appear in short-lived server logs.
Technical and usage data: IP address, browser and device type, pages of the Lasso web app you visit, and similar log information.
Error reports: when something breaks, a report goes to our error-tracking provider (Sentry) to help us fix it.
Analytics: the Lasso web app and extension use Google Analytics and PostHog to understand how they are used, such as which features are used. They never record what you type into comments or the pages you browse.

Cookies

On lasso.team: we use analytics cookies (Google Analytics and PostHog) to understand how visitors use the site, only if you accept them in the cookie banner. If you reject them, no analytics cookies are set. You can change your choice at any time with "Cookie Settings" at the bottom of every page.
In the Lasso app: we use cookies and local storage that are needed to keep you signed in and remember your preferences, plus Google Analytics and PostHog to understand how the app is used.

What the extension can access, and why

Chrome asks you to approve these permissions when you install Lasso:

Read and change data on all websites: needed so you can comment on any page and so your pins appear on the pages you annotated. Lasso does not read or send page content except as described above.
Tabs and active tab: to know which page you are on, so the right comments are shown, and to take the screenshot when you comment.
Scripting: to show the commenting tools and pins on the page.
Side panel: to show Lasso next to the page.
Storage: to keep you signed in and remember settings such as your last collection.

Lasso does not record your keystrokes or the contents of forms you fill in.

Chrome Web Store Limited Use. Lasso's use of information received from the extension complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. We use that information only to provide and improve Lasso's commenting features, never for advertising, and we do not sell it or transfer it except as described in this policy.

How we use your information

to provide the Service: show your comments, sync them across devices and share them with the people you choose;
to send the emails you would expect, such as invitations, replies, @mentions and new comments (you control these in Settings);
to run billing, plans, free trials and seats;
to keep the Service secure, prevent abuse and fix problems;
to understand how Lasso is used and improve it;
to tell you about important changes to the Service or these terms.

If you are in the European Economic Area or the UK, we rely on these legal bases: performing our contract with you (providing the Service), our legitimate interests (security, product improvement, analytics), your consent where we ask for it, and legal obligations.

Who can see your content

Collaborators: a collection is private to its owner until it is shared. Everyone you share it with, and anyone they are allowed to add from your team, can see its comments and screenshots.
Your team: team owners and admins can see team membership and billing details.
Links you share: anyone who opens a link to a comment sees a preview of that comment's text and screenshot, even without an account, so link previews work in Slack, Teams and email. If you turn on a public AI link for a collection, anyone with that link can read the collection's comments and screenshots until you turn it off or rotate it.
Integrations: if you connect Slack or Asana, the comments you send there are shared with that service under its own privacy policy.

Service providers we use

We share information only with trusted providers that help us run Lasso (hosting, file storage, payments, email, error reporting, sign-in and analytics), and only what they need. Your data is stored and processed in the United States and Europe.

We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger or sale of the business, in which case this policy continues to apply to your data.

We never sell your personal information, and we do not share it with advertisers.

How long we keep data

Account data is retained until you delete your account.
Annotations remain until explicitly removed.
Deleted data is permanently removed within 30 days.

Security

End-to-end encryption.
Screenshots and files are kept in private storage and served through links that expire.
Passwords are stored as secure hashes, never in plain text.
Access to your content is limited to you and the people you share it with.
We back up the database regularly, including before every update to the Service.

No system is perfectly secure, but we work to protect your data and will notify you as required by law if a breach affects it.

Your rights and choices

Depending on where you live (for example under the GDPR in Europe or the CCPA in California), you may have the right to:

access the personal information we hold about you;
correct it;
export it (you can export any collection yourself as Markdown, PDF or CSV);
delete it;
object to or restrict some uses of it;
not be discriminated against for using these rights.

You can manage notification emails in Settings, and every notification email has an unsubscribe link. To make any other request, email founder@lasso.team. We will respond within 30 days.

International users

Lasso is run from the United States. By using Lasso you understand that your information is processed and stored in the United States and Europe, where data protection laws may differ from your own.

Children

Lasso is not meant for children under 13, and we do not knowingly collect their information. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. If we make significant changes, we will tell you by email or in the app before they take effect. The date at the top shows when it last changed.

Contact

Lasso Tech, Grand Rapids, Michigan, USA founder@lasso.team