PRIVACY POLICY

Lathe Studio LLC

Last Updated: October 8, 2026

Introduction

Lathe Studio LLC (“Lathe Studio,” “we,” “us,” or “our”) operates Lathe Studio, a hosted test management platform for software engineering teams, together with the website at https://lathe.studio, the signed-in application, and the application programming interface (collectively, the “Service”). The present Privacy Policy explains which personal data we collect when individuals visit our website, sign in to the Service, contact us, or pay for a subscription, why we use that data, with whom we share it, how long we keep it, and which rights individuals may exercise. Capitalized terms not defined here have the meanings given in our Terms of Service at https://lathe.studio/terms.

1. Who We Are and How to Reach Us

The controller responsible for the processing described in this Privacy Policy is Lathe Studio LLC, a Wyoming limited liability company, 1309 Coffeen Ave STE 1200, Sheridan, Wyoming 82801, United States. Questions, requests, and complaints concerning personal data may be sent to privacy@lathe.studio, which is the dedicated channel for every privacy matter, including the exercise of the rights described in Sections 10 and 11. General correspondence unrelated to privacy may be addressed to hello@lathe.studio.

2. Our Two Roles

2.1 Where We Act as Controller

We decide the purposes and means of processing for the personal data needed to run our business: account and sign-in data of Users, billing data of the individuals who manage subscriptions, support communications, messages sent through our website contact form, security and operational logs that we generate, and analytics data about visits to our marketing website. The present Privacy Policy governs that processing.

2.2 Where We Act as Processor

Customers use the Service to store test cases, test runs, results, comments, attachments, and other material that may contain personal data (“Customer Content”). For Customer Content, the Customer that owns the Organization is the controller (or, where it acts for its own clients, a processor), and we process the data only on its documented instructions under our Data Processing Addendum at https://lathe.studio/dpa. Individuals whose personal data appears in Customer Content should direct their questions and requests to the relevant Customer, whose own privacy notice governs; when such a request reaches us, we pass it on to the Customer and assist it as the Data Processing Addendum requires.

2.3 Business Context

The Service is offered only to businesses and professional organizations. Most individuals whose data we process as controller are employees or contractors of our Customers, acting in a professional capacity.

3. Personal Data We Collect

The categories below describe the personal data we process as controller, where each category comes from, and where it is stored.

Screenshots and recordings captured on a tester’s device to file a defect travel directly from that device to the Customer’s own issue tracker and are not stored by us. We do not intentionally collect special categories of personal data, and we ask Customers and Users not to submit such data to the Service.

4. Purposes and Legal Bases

4.1 Purposes

We use the personal data described in Section 3 to create and administer accounts and Organizations, authenticate Users, provide the features of the Service, send the transactional messages the Service depends on, process payments and manage subscriptions, answer support requests and messages sent through our website contact form, keep the Service secure, investigate abuse and enforce rate limits, diagnose and repair faults, meet accounting, tax, and other legal obligations, establish or defend legal claims, and, with consent, understand how visitors use our marketing website.

4.2 Legal Bases Under the GDPR and the UK GDPR

Where the General Data Protection Regulation (EU) 2016/679 (the “GDPR”) or the United Kingdom General Data Protection Regulation (the “UK GDPR”) applies, each processing activity rests on one of the following legal bases.

4.3 Legitimate Interests

Where we rely on legitimate interests, we have weighed those interests against the rights and freedoms of the individuals concerned, taking account of their professional relationship with our Customers, the limited nature of the data, and the safeguards described in Sections 7, 8, and 9. Details of the balancing assessment are available on request to privacy@lathe.studio.

4.4 Whether Providing Data Is Required

Account data is necessary to enter into and perform the contract under which the Service is supplied; without it, an account cannot be created. Billing data is required only once a subscription begins. Consent to analytics is entirely optional, and refusing it has no effect on access to the website or the Service.

4.5 No Automated Decision-Making

We do not make decisions producing legal or similarly significant effects about any individual based solely on automated processing, including profiling.

5. Cookies and Similar Technologies

Our marketing website loads Google Analytics only after a visitor accepts analytics cookies, and Google Analytics is never loaded inside the signed-in application. Inside the application, essential cookies set by our authentication provider keep Users signed in. The consent choice itself is recorded in the browser’s local storage rather than in a cookie, and it can be changed at any time through the “Cookie settings” link in the footer of our website. Our Cookie Policy at https://lathe.studio/cookies describes each technology and its duration.

6. How We Share Personal Data

6.1 Service Providers

We rely on the vendors listed below, each bound by contractual obligations to process personal data only for the services it provides to us and to protect it appropriately.

6.2 Other Recipients

Personal data may also be disclosed to the following recipients, in each case only to the extent necessary: Admins and other Users of the same Organization, who can see the names, roles, and activity of their colleagues within the Service; Third-Party Services that a Customer connects through an Integration, such as Jira, Azure DevOps, Slack, or Microsoft Teams, which receive data at the Customer’s direction and under the Customer’s own agreement with their providers; professional advisers such as lawyers and accountants, under duties of confidentiality; public authorities, courts, and other parties where disclosure is required by law or is necessary to protect our rights, our Customers, or the public; and a successor entity in the event of a merger, acquisition, reorganization, or sale of assets, subject to the commitments of the present Privacy Policy.

6.3 No Sale and No Advertising

We do not sell personal data, we do not share it with advertisers, and we do not use it for cross-context behavioral advertising.

7. International Data Transfers

Lathe Studio is established in the United States, and the Service is hosted there, in a single region used for every Customer. Personal data that individuals in the European Economic Area, the United Kingdom, or elsewhere provide to us is therefore processed in the United States, and some of our vendors may access it from other countries in which they or their personnel operate. The European Commission has recognized the United States as offering an adequate level of protection only for organizations certified under the EU-U.S. Data Privacy Framework, under Commission Implementing Decision (EU) 2023/1795, and the United Kingdom has extended that recognition to the corresponding UK Extension; Lathe Studio itself is not certified under the framework. Where personal data is transferred to vendors that participate in the EU-U.S. Data Privacy Framework and its UK Extension, that participation provides the safeguard for the transfer; where it is not available, we rely on the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 and, for the United Kingdom, the International Data Transfer Addendum issued under section 119A of the Data Protection Act 2018, as incorporated in our vendors’ data processing terms. A copy of the relevant safeguards may be requested at privacy@lathe.studio.

8. Retention

We keep personal data only for as long as the purpose for which it was collected requires, after which it is deleted or, where stated, irreversibly pseudonymized. The periods below are enforced by the Service.

Correspondence held in our company mailboxes has no fixed period: it is kept while the matter it concerns remains open and afterwards only for as long as it may be needed to establish, exercise, or defend legal claims.

9. Security

We protect personal data with technical and organizational measures proportionate to the risk. Data is encrypted in transit using Transport Layer Security and encrypted at rest; OAuth tokens and webhook URLs for Integrations receive a second layer of encryption using AES-256-GCM. Access is checked within the application on every request, by Organization, project, and role. Our support personnel can view a Customer’s Organization only through support sessions, opened solely to resolve a support request, to investigate a fault, to meet a legal obligation, or to respond to a security incident; each session begins with a recorded reason, ends automatically after no more than thirty (30) minutes, and is shown in the Organization’s audit log as “Lathe support.” Error reports are scrubbed inside the application before they reach our error-monitoring provider. No method of transmission or storage is entirely secure; should a personal data breach occur, we will notify the affected individuals and the competent authorities where the law requires.

10. Your Rights Under the GDPR and the UK GDPR

10.1 Rights Available

Individuals whose personal data is subject to the GDPR or the UK GDPR may, within the limits those laws set, request access to their personal data (Article 15), rectification of inaccurate data (Article 16), erasure (Article 17), restriction of processing (Article 18), and portability of data they have provided to us where processing relies on consent or contract and is carried out by automated means (Article 20). Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal (Article 7(3)).

10.2 Right to Object

Each individual may object at any time, on grounds relating to their particular situation, to processing based on legitimate interests under Article 21 of the GDPR and of the UK GDPR, in which case we will stop that processing unless we demonstrate compelling legitimate grounds that override the individual’s interests, rights, and freedoms, or need the data for the establishment, exercise, or defense of legal claims. Objections may be sent to privacy@lathe.studio.

10.3 How to Exercise Your Rights

Requests should be sent to privacy@lathe.studio from the email address associated with the account, or with enough information to allow us to verify the requester’s identity. We answer within one month of receipt; where requests are complex or numerous, that period may be extended by two further months, in which case we will explain the reason within the first month, as Article 12(3) of the GDPR provides. Under the UK GDPR, the same periods run from the latest of the receipt of the request, the receipt of any information reasonably needed to confirm the requester’s identity, and the payment of any fee that may lawfully be charged, and, for access requests only, they are suspended while we await information we have reasonably requested to identify the data or processing concerned. No fee is charged for a request unless it is manifestly unfounded or excessive. Rights relating to Customer Content must be exercised with the Customer acting as controller, as explained in Section 2.2.

10.4 Complaints

Any individual may lodge a complaint with a supervisory authority, in particular in the Member State of the European Union or the European Economic Area of their habitual residence, place of work, or place of the alleged infringement, as Article 77 of the GDPR provides; the European Data Protection Board publishes the list of national authorities at https://www.edpb.europa.eu/about-edpb/our-members_en (opens in a new tab). Individuals in the United Kingdom may complain to us directly under section 164A of the Data Protection Act 2018 by writing to privacy@lathe.studio or by post to the address in Section 14; we acknowledge each such complaint within thirty (30) days of receipt, take appropriate steps to respond without undue delay, and inform the complainant of the outcome. A complaint may also be made at any time to the Information Commission, the United Kingdom supervisory authority, under section 165 of that Act, through https://ico.org.uk (opens in a new tab). We welcome the opportunity to address any concern before it is taken to an authority, although doing so is never a precondition.

11. Notice to Residents of the United States

11.1 State Privacy Laws

Several states have adopted comprehensive privacy statutes, including the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. Apart from the California statute, most of those statutes do not extend to individuals acting in a commercial or employment context, and each applies only to businesses meeting the thresholds it sets. To the extent any of them applies to our processing, the disclosures in the present Section, read together with Sections 3, 4, 6, and 8, describe our practices, and we will honor the rights it confers.

11.2 Categories, Sources, and Purposes

The categories of personal information we collect, as those categories are described in the California statute, are identifiers (such as names, email addresses, IP addresses, and account identifiers), commercial information (such as subscription and billing history), internet or other electronic network activity information (such as request logs, audit logs, API usage records, and, with consent, website analytics), and professional or employment-related information (such as an individual’s role within a Customer’s Organization). Sections 3, 4, and 6 set out the sources of that information, the business purposes for which we use it, and the categories of recipients to which we disclose it. Account log-in credentials, which the California statute treats as sensitive personal information, are used solely to authenticate Users, and we do not use any sensitive personal information to infer characteristics about individuals.

11.3 No Sale or Sharing

In the terms of the California statute, no personal information has been sold, or shared for cross-context behavioral advertising, in the preceding twelve (12) months. We have no actual knowledge of selling or sharing the personal information of consumers under sixteen (16) years of age.

11.4 Rights and Requests

Subject to the conditions and exceptions of the applicable statute, residents may request to know the personal information we have collected about them, to receive a copy of it, to correct inaccuracies, and to have it deleted, and they will not receive discriminatory treatment for exercising those rights. Requests may be sent to privacy@lathe.studio. We confirm receipt within ten (10) business days, verify the requester’s identity by matching the request with information already held about the account, and respond within forty-five (45) calendar days; where reasonably necessary, we may extend that period by a further forty-five (45) calendar days after notifying the requester of the extension and its reason. An authorized agent may submit a request on a resident’s behalf upon providing written permission signed by the resident, and we may ask the resident to verify their identity directly. Where a statute grants a right to appeal our decision, the appeal may be submitted to the same address.

11.5 Nevada

We do not sell covered information as defined in Nevada Revised Statutes 603A.320 and 603A.333. Nevada residents may nevertheless submit a verified request directing us not to sell such information, under NRS 603A.345, by writing to privacy@lathe.studio, and we will respond within sixty (60) days of receipt. Covered information may be reviewed and corrected as described in Section 11.4, material changes to the present Privacy Policy are notified as described in Section 13, and the only third party that may collect information about a visitor’s online activities over time and across websites through our marketing pages is Google, through Google Analytics, and only after the visitor has consented.

12. Children

The Service is intended for professional use and is not directed to children. Users must be at least eighteen (18) years old. We do not knowingly collect personal data from children; should we learn that such data has been provided to us, we will delete it.

13. Changes to This Privacy Policy

We may update the present Privacy Policy to reflect changes in the Service, in our vendors, or in the law. The “Last Updated” date at the top shows the most recent revision. Material changes will be announced by email to Admins or by notice within the Service before they take effect.

14. Contact

Lathe Studio LLC

1309 Coffeen Ave STE 1200

Sheridan, Wyoming 82801

United States

Privacy matters and data subject requests: privacy@lathe.studio

General inquiries: hello@lathe.studio