Privacy PolicyLane Labs AB · Website and Apex

1. Who we are

Lane Labs AB, Swedish company number 559525-7436, c/o Wågert, Törnrosvägen 74 A, 181 61 Lidingö, Sweden. Contact rufus@lanelabs.ai. We are the controller for the processing described here.

2. Information we use

Your Apex

• Your phone number or Apple ID address, your name, the invite you joined with, and your yes to the tester terms with the version you agreed to.
• Your settings, reminders and watches, and the tasks Apex is working on for you.

Conversations with Apex

• What you write or send to Apex in iMessage, or in Telegram if you choose it, including photos and files you share, and what Apex replies.
• Short notes Apex keeps so it remembers your preferences and the things it is handling for you. Ask Apex what it knows about you, and ask it to forget anything.

Google, if you connect it

• Your Gmail, Google Calendar, Google Tasks and the Drive files Apex made, used only as section 5 describes. Apex reads only what a request needs, and your busy times for Circle if you choose to share them.
• The key Google gives Apex for your account, stored encrypted on your own Apex server.

Web pages and files

• Web pages Apex reads or opens for you, and what you ask it to fill in there. Apex never asks for your password in the chat. You sign in yourself on a secure page, and if you choose Remember, the password is stored encrypted on your own Apex server.
• Files Apex makes for you, such as a summary, a list or a table, on files.lanelabs.ai. Only you can open them.

Circle

• The people you add to your Circle, their phone numbers, the name you give each one, and who shares with whom. Others in your Circle see your number masked.
• If you choose to share your times with someone, your own Apex sends only the start and end of each busy time, your time zone and whether your calendar could be read. Never what, where or with whom. Section 5 says where they go.

Website

• Waitlist and contact forms. Your name, email address, phone number if given, and what you write.
• Try Apex. Your first name, your phone number, and when you agreed to our terms, which confirm you are 18 or older. Our switchboard at Fly.io keeps them with your place on the list. Before your code is checked, your IP address is used to limit how often codes can be asked for and for the robot check, Cloudflare Turnstile checks that you are a person, your number is sent to Linq to check that it has iMessage, and Twilio sends you the code by SMS.
• Basic technical logs and error reports. We store a few settings in your browser, such as light or dark mode. We do not use advertising or tracking cookies. Fonts load from Google Fonts, so your browser contacts Google.

3. Why we use it and our legal basis

• To provide Apex, such as understanding requests, doing what you ask and asking you before steps that reach other people. Basis is our agreement with you.
• To train Apex's own models on what you write to Apex, what Apex replies and how you reply, unless you turn it off. Basis is our legitimate interest in making Apex write better. Your yes to the tester terms is not the basis, and you can object at any time with no reason needed.
• People who are not Apex users, such as the people in your mail, your calendar or your Circle. Basis is our legitimate interest in letting you plan and communicate with them, limited to that purpose.
• Security, abuse prevention and fixing problems. Basis is our legitimate interest in a safe, working service.
• Waitlist and enquiries. Basis is steps you ask for and our legitimate interest in replying.
• Legal obligations, such as bookkeeping and answering your privacy requests.

Where something needs consent, such as your yes to the tester terms on our website, connecting your Google account, sharing your times in Circle or a new permission, we ask first and you can withdraw it at any time. Messages and mail can contain sensitive information. We use it to do what you asked. A filter of code and our own model tries to take such conversations out before anything goes to training, and it is not reliable.

4. Apex is an AI

You are always talking to an AI, never a person pretending to be one, and it can get things wrong. Our own models run on servers in the EU at Modal, at Amazon Web Services in Stockholm or at Google Cloud. All three are US companies. Your chat goes there when Apex replies. The text, files and instructions a request needs are sent there so Apex can answer you.

We train Apex's own models on what you write to Apex and what Apex replies, unless you turn it off. Write träna inte or no training to Apex and it stops at once. No reason is needed and Apex works just as well. We do not sell your messages.

Only lines written after you said yes to the tester terms tester-v2 are used, and none until 7 days after they were written. We also learn from how you reply, such as whether and when you reply, reactions, corrections and whether you come back. Mail, calendar and everything else from Google are never part of it, nor what is written after Apex has read something from there in the same conversation, files, images, what Apex reads on the web, Apex's notes about you, codes, cards, passwords, Circle or groups. Apex's replies can build on what you have told it yourself. Apex is for adults. We do not check age, and if you say you are under 18 all your training lines are removed and you are out of training for good. Before anything is saved, our own model reads what you write and tries to remove conversations about health, sex, faith, politics, origin, unions and crime, and code removes names, numbers and addresses. This is not reliable, and it can miss things, also about sex, sexual orientation and what you write about others. The filter also reads what you write when it is not saved, so that it notices if you say you are under 18. A model that is already trained cannot be cleaned, and everyone with Apex uses it.

Nobody at Lane Labs reads your chat unless you ask us to, to keep the service safe and working, when the law requires it, or when Rufus Wågert reads training lines, without name or number, to check that they are right.

5. Google user data

If you connect your Google account, Apex asks Google for five permissions. It uses them for the requests you make in your chat with Apex, and to read your new mail by itself from the moment you connect, so that Apex can tell you when one seems important. It also uses them for your busy times if you choose to share them, as this section says.

• Gmail read to search and read the messages a request needs, and to read the sender, subject and start of each new mail so that Apex can tell you when one seems important. Apex never deletes, archives or labels mail.
• Gmail drafts to write a draft in your own Gmail Drafts folder. Apex never sends it. You open the draft in Gmail and send it yourself.
• Calendar events to read your primary calendar and to add, move or cancel the events you ask for. When you write to Apex it also looks at today and tomorrow so its reply fits your day. When an event has guests, Google emails them, so Apex makes that change only after your ok on that exact change.
• Google Tasks to list, add, change and complete your tasks.
• Drive files Apex creates to make private documents and sheets for you. Apex cannot see any other file in your Drive, and it never shares or deletes a file.

The text of the messages, events, tasks and files a request needs goes to our models only to produce Apex’s reply. Your own Apex server at Fly.io stores your chat with Apex and Apex’s notes, and both can quote what Apex read. Your Google key is stored encrypted on that same server. Apex’s replies reach you in iMessage through Linq and can quote parts of a mail you asked about.

A file Apex makes for you on files.lanelabs.ai can hold parts of your Google data, is stored at Lovable Cloud (Supabase), can be opened only by you, and is kept for at most 90 days.

Circle. If you choose to share your times with someone, your own Apex reads only the times from your Google Calendar by itself, without a request from you, and at most every 30 minutes sends the start and end of each busy time, your time zone and whether your calendar could be read to our switchboard at Fly.io. Only the people you chose can get them, through their own Apex, which sends them to our models to answer them and on to their phone through Linq. Nothing else from your Google account goes to Circle, never what, where or with whom.

Apex keeps no copy of your mailbox, calendar or Drive, only the parts described in this section. It keeps your chat with Apex, which can hold parts of what it read for you, and short notes about your preferences, and the chat stays at most 90 days after you erase everything or ask us. It keeps the files it made for you, which can hold parts of what it read too. Our switchboard keeps your busy times at most 48 hours. Section 9 says how long.

You can stop at any time at myaccount.google.com/permissions, by writing radera allt to Apex, or by writing to rufus@lanelabs.ai, and we then revoke Apex’s access and delete its key. Section 11 says how to erase.

We never sell Google user data, never use it for advertising, never use it to train AI models and never use it for credit or lending decisions. Nobody at Lane Labs reads it unless you ask us to, for security, or when the law requires it.

Lane Labs’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, and this data is never used to develop, improve or train generalized AI or machine learning models.

6. Payments

Apex can finish a purchase for you, but only after your ok on the amount. If you link a card on our website, it is stored encrypted by Crossmint, not by Lane Labs, and Apex’s AI never sees it. Apex never holds your money, and Lane Labs holds no payment card details. Never send card details or a code in the chat.

Without a linked card, Apex gets things ready and you pay the last step yourself on the seller’s own site. The seller and its payment provider handle your payment under their own terms.

7. Who receives information

These service providers process personal data for us, under contract and only on our instructions.

• Modal can run our own models on servers in the EU, and your chat goes there when it does. It also trains our models there on the lines section 4 describes, and the finished model can be kept at Modal in the United States.
• Amazon Web Services can run our own models on servers in Stockholm, and your chat goes there when it does. It keeps the training lines encrypted there.
• Google Cloud can run our own models on servers in the EU, and your chat goes there when it does.
• Linq runs Apex’s iMessage number and passes messages between you and Apex. Apple delivers iMessage.
• Telegram, only if you choose to reach Apex there.
• Fly.io runs your own Apex server, where your chat with Apex, Apex’s notes, your Google key, reminders and settings are stored encrypted, and our message switchboard, which keeps your Circle, on servers in Stockholm with encrypted disks.
• Lovable and Supabase run our website, its database and the files Apex makes for you on files.lanelabs.ai, which can contain parts of your Google data.
• Google runs your own Google account if you connect it, and Google Fonts on our website.
• Cloudflare runs the robot check (Turnstile) on our Try Apex page and sees your IP address.
• Twilio sends and checks the sign in codes from our website by SMS, and sees your phone number.
• Crossmint stores the payment card you link on our website, encrypted, and gives it to your Apex only for a purchase you said ok to.
• People in your Circle see your number masked. Only the people you choose to share with see when you are free or busy, your time zone and whether your calendar could be read, never what, where or with whom.

Web pages Apex opens or reads for you see our server, not who you are. Web searches go to Brave or DuckDuckGo, which see the search and our server, not who you are. When you finish an order on a seller’s site, the seller handles it under its own policies.

We may disclose information when the law requires it, to protect security or to defend legal claims, and only as much as needed. We never sell personal data.

8. International transfers

Amazon Web Services, Google Cloud and Modal, which can run our own models, are US companies, and your chat goes to the one that runs them when Apex replies. Linq, Fly.io, Cloudflare, Supabase, Twilio and Crossmint are also based in the United States, and some of them process information there. Such transfers rely on an adequacy decision, such as the EU US Data Privacy Framework, or on the European Commission’s standard contractual clauses. US law can require a US provider to hand over data, also data kept in Sweden. Write to rufus@lanelabs.ai for details.

9. How long we keep it

We keep information only as long as its purpose needs.

• Your own Apex server keeps your chat with Apex until you erase everything or ask us to delete it, and at most 90 days after that. It keeps Apex’s notes about you until you ask Apex to forget them or erase everything.
• Fly.io holds your own Apex server with your reminders, watches, settings, Google key and your yes, until you erase everything. Fly.io takes no snapshots or backups of your server, so when we remove it nothing is left there. Server logs hold no message text and are kept 7 days.
• Linq keeps a copy of the messages between you and Apex. Today that copy has no fixed end date. When you erase everything, we ask Linq to delete it.
• Lovable Cloud (Supabase) holds your invite and account details until you ask us to delete them, and files Apex made for you for 30 days or the time you chose, at most 90 days. You can delete one at any time. Lovable keeps backups of that database for up to 7 days, so a deleted row leaves the backups within 7 days.
• Your Circle, who is in it and the names you give them, is kept on our switchboard at Fly.io until your place in the test ends or you ask us to delete it. Your busy times are kept there at most 48 hours, and a record of who looked at them 30 days.
• Disconnecting Google stops new access. Originals at Google are not deleted. Your chat with Apex, which can quote what it read, is deleted within 90 days after you erase everything or ask us.
• Secure links Apex sends you expire within minutes or hours and can be used once.
• Codes from our website are made, sent and checked by Twilio and expire after 10 minutes. The IP address counts toward a limit for at most one day. The first name, number and the time you agreed to the terms (which confirm you are 18 or older) from Try Apex stay on our switchboard at Fly.io until your place in the test ends or you ask us to delete them.
• Waitlist and contact messages are kept until we no longer need them to reply or give access.
• Training lines are kept at most 30 days on your server and at most 12 months in storage, and are removed before the next training if you turn training off or erase everything.

After you erase everything, what stays is the messages on your own phone, drafts in your own Gmail, what a friend’s Apex already told them, and any model already trained. Your invite and account on our website, the files Apex made for you and your Circle stay until you ask us to delete them, as our Terms of Service section 10 says. Bookkeeping records are kept as Swedish law requires.

10. Security

We use encryption in transit and on disk, a separate server for each tester’s Apex, single use links, strict access controls, and we collect only what a feature needs. Apex asks you before steps that reach other people, and pays only after your ok on the amount.

11. Your rights

You can ask for access to your data, correction, deletion or a copy, and you can restrict or object to processing. This applies to people who are not users too. Write to rufus@lanelabs.ai. We reply within one month. To erase your Apex, write radera allt to Apex or write to us. While Apex is paused it reads nothing else you write, except radera allt, which still erases everything.

You can complain to the Swedish Authority for Privacy Protection, IMY, or the authority where you live.

12. Age and invites

Apex is for people aged 18 or older, by invite only. We do not knowingly let anyone younger use it.

13. Not part of early access

Some features we have shown, such as pages you share with others, and connecting other email providers or your own AI accounts, are not part of early access. We will update this notice before any of them starts.

14. Changes

We update this notice when Apex or the law changes. Material changes are announced on this page and, where required, directly to you.