Legal
Privacy policy
Last updated:
Lazos exists because people only use a wellbeing service they trust. This policy describes what we do with personal data on this website and inside the Lazos app, in plain language and without hiding the parts that matter.
What data we process
We separate two very different contexts, and we treat them differently.
- This website: if you submit the demo form, we process the work email address you provide, plus any details you send us afterwards. Our hosting provider also processes standard technical data such as your IP address and browser type in its server logs, for security and to serve the page.
- The Lazos app: account data needed to give you access, the content you choose to share with Lazos (context about your relationships, your goals, your conversations), and technical usage data such as whether the app was opened.
- Employer relationship: the contact details of the people who manage the benefits programme at the company that contracts Lazos.
Why we process it, and on what legal basis
- To provide the service you asked for, including personalised advice and benefit recommendations, on the basis of performing our contract with you or with your employer.
- To reply to your demo request and other enquiries, on the basis of your request and our legitimate interest in answering it.
- To keep the service secure, prevent abuse and fix problems, on the basis of our legitimate interest in a safe, working service.
- To produce anonymous, aggregated statistics about how much the service is used, on the basis of our legitimate interest in measuring and improving it. This output is not personal data.
- To comply with legal obligations, such as accounting and tax duties.
What your employer never receives
This is the core commitment of the product, so it deserves to be stated precisely. The company you work for does not receive your identity, your conversations, the content you share with Lazos, which benefits you used, when you used them, or any individual profile, score or timeline.
The only thing an employer receives from Lazos is a count of how many people opened the app in a month, and it is always reported in ranges (for example, between 200 and 225) so that it can never be combined with other information to single anyone out.
This is enforced by how the system is built, not by an internal rule someone could decide to bend. We do not offer individual-level reporting to employers under any plan or price.
Artificial intelligence and zero retention
Lazos uses AI to generate advice and answer questions. It runs on infrastructure contractually configured for zero data retention: your interactions are processed to produce a response and are not stored by the AI provider, are not written to its logs, and are never used to train or improve models.
Our contracts with those providers legally guarantee that no human on their side can read employee interactions. If a provider cannot commit to that in writing, we do not work with them.
Who else processes data for us
We rely on a small number of service providers acting as data processors under written agreements: cloud hosting and storage, AI processing under the zero-retention terms described above, and email delivery for the messages we send you.
They may only process data to provide their service to us, following our instructions, and they can never use it for their own purposes.
What we will never do
Some commitments deserve to be stated without hedging, because they are the reason anyone trusts Lazos enough to use it in the first place.
- We will never sell your personal data. Not to advertisers, not to data brokers, not to anyone, at any price. Selling data is not a business model we have, and it is not one we will ever have.
- We will never share your personal data with anyone beyond the service providers listed above, except where the law obliges us to.
- We will never run advertising inside Lazos, and we will never profile you in order to sell your attention.
- We will never use your personal content to train AI models, ours or anyone else's.
- We will never give your employer individual-level reporting. No exceptions, and no premium tier that unlocks it.
If a feature would require breaking any of these, we do not build the feature. That constraint is not negotiable, because the moment it bends, nothing else on this page is worth reading.
International transfers
We prioritise infrastructure that meets European data protection standards. Where a provider processes data outside the European Economic Area, we rely on the safeguards allowed by the GDPR, such as an adequacy decision or the European Commission's standard contractual clauses, together with the technical measures described in this policy.
How long we keep it
- Demo requests and enquiries: for as long as needed to handle the conversation and, if it does not go ahead, for a reasonable period afterwards for our records.
- App account and content: while your account is active. If your account is closed, or your employer's contract ends, we delete or irreversibly anonymise the personal data within a reasonable period, keeping only what the law requires us to keep.
- Aggregated, anonymous statistics: these are kept indefinitely, because they no longer identify anyone.
Security
Data is encrypted in transit and at rest. Identity data and usage data are kept strictly separated, internal access follows least-privilege principles with audit trails, and we practise data minimisation: we do not collect what we do not need.
The practical consequence matters more than the list of measures: not even the Lazos team can read the personal content of an employee. There is no admin panel into private conversations and no support backdoor.
Your rights
You can ask us to access, correct, delete or port your data, and to restrict or object to a given processing activity. Where processing is based on consent, you can withdraw it at any time without affecting what was done before. Write to contact@lazos.care and we will respond within the legal deadline.
If you believe we have not resolved your request properly, you can complain to your national data protection authority. In Spain, that is the Agencia Española de Protección de Datos (www.aepd.es).
Children
Lazos is a workplace benefit intended for adults. We do not knowingly process the data of anyone under 16. If you believe a minor has provided us with data, contact us and we will delete it.
Changes to this policy
If this policy changes, we will update this page and the date at the top. When a change materially affects how we handle your data, we will tell you directly rather than relying on you noticing it here.
Contact
For anything related to this policy, including exercising your rights, write to contact@lazos.care and a person will read it.