Privacy policy

What this website and the Lapsus account do with your data.

Last updated 27 September 2026.

Who is responsible

The controller for the data described here is:

Write to that address about anything on this page, including the requests under Your rights.

What this covers

This policy covers this website and the account behind it: signing in, licence keys, test payments and the settings you change in the cabinet. It does not describe the Lapsus app itself, which runs entirely on your own computer — what you type never reaches us and is never used for training, and the app needs no account at all.

What we store, why, and for how long

Everything below is stored because the account cannot work without it, or because leaving it out would make the account less safe. Nothing here is collected for advertising. Separately, Google Analytics measures use of this site only after you opt in.

Email address and password: Kept for as long as you have an account, so you can sign in and so we can send what the account requires. The password itself is never stored — only an irreversible hash of it. Legal basis: performance of our contract with you.
Two-factor secrets and passkeys: Stored only if you turn them on, and deleted the moment you remove them. Legal basis: performance of our contract, and our legitimate interest in keeping accounts from being taken over.
Licence keys and orders: The keys you issue, with their edition, seat count and label. Kept while the account exists and deleted together with it; a deleted key can no longer be activated. Legal basis: performance of our contract.
Payments: Amount, currency, status and date. Kept while the account exists and deleted together with it. Legal basis: performance of our contract.
Organisations and membership: The name of an organisation you create or join, and your role in it. Kept while the organisation exists. Legal basis: performance of our contract.
Sign-in history: The time, the IP address, the browser and operating system, and whether the sign-in came from the website or the app. This is what lets you notice a session that was not yours, and it is deleted automatically after 90 days. Your IP address is not sent to anyone outside this service — we do not look up your location. Legal basis: our legitimate interest in the security of your account.
Activated machines: An identifier for each computer where a licence key is in use, so seat limits can be enforced. Kept until you release the seat, or the key is revoked or reissued. Legal basis: performance of our contract.
Email preferences: Which messages you agreed to receive. Product news is off until you switch it on, and you can switch it off again at any time; billing and security messages are part of the service and are not marketing. Legal basis: your consent for product news, performance of our contract for the rest.
Website analytics: Only after you agree, Google Analytics receives the pages you visit, general browser and device data, and pseudonymous cookie identifiers to produce aggregate usage statistics. We do not send form contents or data that directly identifies you. Legal basis: your consent; Google keeps the data under the retention settings of this analytics property.

Who else touches this data

We run no servers of our own. Five companies process data on our behalf, under contract and on our instructions only:

Supabase: The database, the sign-in system and the functions that issue licence keys. The database is hosted in the European Union.
Cloudflare: Serves these pages and runs Turnstile on protected forms. Turnstile processes the IP address and browser or device signals needed to distinguish people from automated traffic; it does not receive form contents. Outside the European Union it also measures how fast pages load (Cloudflare Web Analytics): no cookies or other stored identifiers, only the page address, load timings and the general type of browser and device. Visitors in the EU are not measured.
Resend: Delivers confirmation, recovery and notification email. It receives your address and the contents of that message, nothing else.
Google Analytics: Produces aggregate website-usage statistics, but only if you accept analytics. Google receives the analytics data described above.
YouTube: Plays the passkey explanation in account settings, and only after you open that hint. YouTube then receives your IP address and the browser data needed to show the video. It does not receive your password or anything else from your account.

Account data is held in the EU, but the providers above are companies based in the United States, so access from outside the EU is possible for support purposes. If you opt in to analytics, or open the passkey video, Google may process that data outside the EU. Their standard data processing agreements and the transfer safeguards in them apply.

Your rights

Under the GDPR you may:

ask for a copy of the data we hold about you
have anything inaccurate corrected
have your account and its data deleted
object to processing we base on legitimate interest, such as the sign-in history
ask us to restrict processing while a dispute is settled
withdraw consent for product news at any time, without affecting anything else
withdraw consent for website analytics at any time

Downloading a copy of your data, deleting the account, changing your email address and turning off product news can all be done in the account settings, immediately and without asking us. For anything else, write to the address above; we answer within one month. If you believe we have handled your data badly, you may also complain to the data protection authority of the country you live in.

Cookies and local storage

Your browser stores the language and theme you picked and — once you sign in — the token that keeps you signed in. It also stores your analytics choice. The first two never leave your browser; the third is what an account is made of. Only if you agree, Google Analytics may set analytics cookies for measurement. You can change that choice below at any time.

The Lapsus app

The app on your computer has its own privacy policy, which lists every time it goes online. The one record it leaves with us — the computer a licence key is activated on — is described under Activated machines above.

Changes

If this policy changes in a way that affects you, we will say so in the account before the change takes effect. The date at the top always shows the current version.