Privacy policy

This policy explains what personal data Lodwave and the lodwave.com website process, why, with whom, for how long, and how to exercise your rights.

1. Who is responsible

XLAB LLC, a limited liability company organized in the State of New Mexico (United States), no. 0008080354, 1209 Mountain Road Pl NE, Ste R, Albuquerque, NM 87110, United States. Contact for your data: hello@lodwave.com.

Representative in the European Union (Article 27 GDPR): name and address to come.

XLAB LLC has two roles:

• Controller for the data of your account, your subscription and the security of the service;
• Processor for the data of your store's customers (orders, customer support requests). The controller is then the store operator, who gives us instructions.

A data processing agreement (Article 28 GDPR) is available on request at privacy@lodwave.com.

Paddle, our reseller and Merchant of Record, processes payment data as an independent controller, under its own policy: paddle.com/legal/privacy.

2. The data we process

3. Why, and on what basis

For the data of your store's customers, we act on your instructions: as the store operator, you need a legal basis and must inform your customers.

XLAB LLC does not sell a store's data, does not share it and does not use it to train an artificial intelligence. Only the processors listed in section 6 receive it, to run the service, and your Claude assistant when you allow it.

4. Lodwave AI

To answer, Lodwave AI sends the model provider only the information the request needs. That provider is Anthropic PBC, our processor. Lodwave uses Anthropic's standard API, without a zero data retention agreement.

On retention, Anthropic writes:

For Anthropic API users, we automatically delete inputs and outputs on our backend within 30 days of receipt or generation, except:

When you use a service with longer retention under your control (e.g. Files API)

When you and we have agreed otherwise (e.g. zero data retention agreement)

If we need to retain them for longer to enforce our Usage Policy (UP)

In compliance with the law

Anthropic therefore deletes Lodwave AI's requests and answers within 30 days. It may keep them longer to enforce its usage rules, or when the law requires it.

On training its models, Anthropic writes:

By default, we will not use your inputs or outputs from our commercial products (e.g. Claude for Work, Anthropic API, Claude Gov, etc.) to train our models.

5. The Claude connector

From the Pro plan, you can connect your own Claude assistant to a store. Nothing is sent without your permission, given store by store on the "Connect to Lodwave" screen. Once allowed, Lodwave sends your assistant that store's data: sales, profit, ads, orders, customer support and products, without the name, email, phone number or address of the store's customers.

Your Claude assistant is a service you use under your own Anthropic account: Anthropic processes the data under the terms between you and Anthropic. If your account lets Anthropic use your chats to improve its models, turn that setting off or use a business plan of Claude.

Lodwave keeps proof of your permission and a log of the connector's calls, without their content. You can withdraw your permission at any time from your Lodwave account.

6. Who receives your data

Our processors, only for the needs of the service:

Independent controller:

The services you connect yourself (Shopify, Meta, Google Ads, TikTok, Klaviyo, and depending on your use Google Drive, Gemini, Notion, GitHub or others) exchange data with Lodwave under your account and their own terms. Lodwave only sends them what the action you request requires, for example publishing an ad or updating a product page.

Data may also be disclosed to the authorities when the law requires it.

7. Transfers outside the European Union

XLAB LLC is a US company, and some processors handle data in the United States. These transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's standard contractual clauses. Transfers to the United Kingdom rely on the European Commission's adequacy decision. You can get a copy of the safeguards by writing to hello@lodwave.com.

8. Retention periods

9. Security

All connections use HTTPS. Passwords are stored as hashes, and service keys and tokens are encrypted in the database. Each store is isolated and each member only sees what has been opened to them. Login attempts are rate limited.

10. Cookies

The lodwave.com website sets no cookies and stores nothing in your browser. The Lodwave application uses a single cookie, strictly needed to stay logged in (30 days), and browser storage only keeps display preferences. There are no advertising cookies and no audience measurement tools, so no consent is requested. Payment happens in Paddle's checkout, which applies its own policy.

11. Your rights

You can access your data, correct it, delete it, restrict its processing, object to processing based on legitimate interest, and get it back in a readable format (portability). Write to hello@lodwave.com; we answer within one month.

If you are a customer of a store that uses Lodwave, contact that store first; if you write to us, we pass your request on to it.

You can also contact the data protection authority in your country, in France the CNIL (cnil.fr).

12. Changes

We update this policy when the service changes. Any significant change is announced to you by email.