Privacy Policy

This Privacy Policy explains how Data Tiles Ltd, a company incorporated in England and Wales ("Data Tiles", "we", "our" or "us"), collects, uses and protects personal information when you access or use the Data Tiles corporate website, the Latttice website and product, Lenz, our AI Factory, and other products and services we may introduce in the future (together, the "Services").

We are committed to protecting your privacy and handling personal data responsibly and transparently in accordance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and, where it applies, the EU General Data Protection Regulation (EU GDPR).

For its own business purposes, including operating its websites, managing business contacts, responding to enquiries and administering licensing and support information provided to it, Data Tiles acts as a data controller and determines how and why that personal information is processed.

Data Tiles uses synthetic data in its own product demonstrations and illustrative website experiences. We do not use actual customer datasets for those purposes. This synthetic demonstration data is distinct from personal information voluntarily submitted by website visitors and from real business or client data processed by licensed customers within their own customer-controlled Latttice or Lenz environments. The use of synthetic demonstration data does not make visitor submissions anonymous.

Latttice and Lenz are independently licensed containerized applications deployed using single-click deployment into customer-controlled environments, not Data Tiles-hosted SaaS. Processing within that software is not processing undertaken by Data Tiles. Customers control their environments and are responsible for the lawful processing of personal data within them.

Data Tiles does not access customer environments or private Customer Data during normal operations or standard support. A customer’s use of Latttice or Lenz does not itself make Data Tiles a processor of that customer’s data. If an exceptional, separately agreed arrangement involves Data Tiles actually processing personal data on the customer’s behalf, the relevant roles and any processing terms required by applicable law must be agreed before that processing begins.

For its own website and business activities, Data Tiles may collect the following information provided to it or generated through interaction with its websites:

Contact, Licensing and Enquiry Information — information you voluntarily provide when you contact us, submit an enquiry or arrange a licence, such as your name, email address, organisation, job title or role, country or region, enquiry topics and priorities, preferred contact method, timeline, message and related correspondence. The Contact page prepares an email in your email application; Data Tiles receives that message only if you choose to send it. Other website enquiry forms submit the details you provide to our website systems.

Support Information — information you provide in support correspondence. Standard support does not involve Data Tiles accessing customer environments or private Customer Data; do not send private Customer Data unless separate written arrangements have been agreed.

Assessment Information — answers and results submitted through website assessments, including scores, result categories, assessment identity and any role, industry or company size you provide, together with campaign-source information, browser information and submission time. Assessment responses and results may be recorded even if you do not request follow-up. If you request emailed results or a review, we also collect the contact details and message you provide and associate them with your assessment and requested action. Assessment information is visitor-submitted information, not synthetic demonstration data, and should not be assumed to be anonymous merely because a name is not provided.

Website Assistant Information — questions and messages you voluntarily submit to the public website executive assistant. These may contain personal information if you include it and are sent to the external AI service used to generate a response. Synthetic data used in our demonstrations does not anonymise your messages or remove personal information you provide. Do not submit private Customer Data, confidential business information or personal information that is not necessary for your enquiry.

Website Usage and Technical Information — information about website access and interaction, such as IP address, browser type, device type, operating system and website activity, where collected by the relevant website functionality.

These categories do not mean Data Tiles receives product prompts, customer records, model inputs, metadata or application activity logs from customer-controlled Latttice or Lenz deployments.

Data Tiles uses personal information it handles for its own business purposes, including:

operating and maintaining its websites;

administering licensing and business relationships;

responding to enquiries and support correspondence;

processing website assessment responses and results, providing requested results and handling review requests, and answering questions submitted to the public website executive assistant;

maintaining the security of its own systems and preventing misuse;

complying with legal obligations.

Customers retain ownership and control of data and metadata connected to or processed within customer-controlled software ("Customer Data"), subject to applicable third-party rights. Customers remain responsible for lawful processing and the necessary rights and permissions, including for data belonging to third parties.

Data Tiles does not access customer environments or private Customer Data during normal operations or standard support. Product use alone does not authorise Data Tiles to receive, store, export, delete or otherwise process private Customer Data.

When licensing ends, Customer Data remains in the Customer’s environment. Latttice metadata can be exported by the Customer before the application is removed; Data Tiles does not provide an automatic export, backup recovery or deletion service under this policy.

Where Data Tiles separately agrees to process personal data on a customer’s behalf, any required processing terms and return, retention or deletion duties are governed by those written arrangements and applicable law.

Data Tiles platforms may use automated systems, analytics or artificial intelligence technologies to assist users in analysing data, generating insights or supporting decision-making workflows. In this policy, "Outputs" means content, insights, recommendations or other results generated through automated or AI-assisted features.

AI models used by Latttice and Lenz are hosted within the Customer’s environment. Neither product sends information to external AI model providers as part of the current architecture, and neither product uses Customer Data to train AI models.

Data Tiles does not receive prompts, customer records or model inputs from customer-controlled deployments as part of this architecture. Lenz customers determine agent actions and configure permissions and governance arrangements.

Users remain responsible for evaluating and validating Outputs and for decisions and agent actions within their organisation. Organisational accountability does not imply mandatory human review or approval of every individual automated action.

The public website executive assistant is separate from customer-controlled Latttice and Lenz deployments. Questions and messages submitted to that assistant are sent through Lovable AI Gateway to the configured OpenAI model to generate a response. Those messages may contain personal information supplied by the visitor; the use of synthetic demonstration data does not make them anonymous. This website processing does not mean Data Tiles receives customer records, prompts, model inputs or other product data from customer-controlled Latttice or Lenz environments.

Data Tiles implements appropriate technical and organisational measures designed to protect personal information it handles for its own business purposes and maintains its own internal security policies. No system can guarantee absolute security.

Customers are responsible for infrastructure security, updates, backups, operational monitoring and incident response in customer-controlled deployments.

Latttice provides role-based access control (RBAC), attribute-based access control (ABAC), fine-grained access controls, data sensitivity controls and audit logging. Its governance capabilities operate at build time and runtime, but the Customer is responsible for configuring and applying its policies. These controls are not automatically configured for every Customer and do not replace the Customer’s infrastructure security responsibilities.

Data Tiles retains personal information it handles for its own business purposes for as long as necessary for the relevant purpose, contractual obligations and applicable legal requirements. Appropriate periods depend on the information category, purpose and legal requirements.

Personal information no longer required is to be deleted or anonymised as appropriate, subject to applicable legal retention requirements. Customer-hosted data retention, backups and removal are controlled by the Customer, not by Data Tiles under this policy.

Where Data Tiles transfers personal information it handles for its own business purposes outside the United Kingdom or the European Economic Area, it must comply with applicable data protection law, including requirements for appropriate safeguards where required.

Lawful mechanisms may include applicable adequacy decisions, Standard Contractual Clauses or other mechanisms permitted by applicable law. This does not describe transfers of product data from customer-controlled deployments.

Depending on applicable law and the circumstances, you may have rights to access and correct personal data, request erasure, restrict processing, object to processing, receive portable data, withdraw consent where processing relies on consent, and complain to a competent supervisory authority. These rights are subject to applicable legal conditions and exceptions; withdrawing consent does not affect the lawfulness of processing before withdrawal.

Requests concerning personal data handled by Data Tiles for its own purposes may be made using the contact details below. Requests relating to customer-controlled product data should normally be directed to the organisation responsible for that data.

Where external service providers handle personal information for Data Tiles’ own website or business activities, their roles and applicable data protection obligations depend on the relevant arrangements.

For the public website executive assistant, Lovable AI Gateway and the configured OpenAI model service process the questions and messages submitted by visitors to generate responses. This is external AI processing for the website, not transmission of customer-hosted Latttice or Lenz product data. The applicable provider arrangements must be considered separately from the synthetic data used in Data Tiles demonstrations.

This is distinct from systems a Customer chooses to connect within its own environment. Customers are responsible for assessing the terms and privacy practices of systems they independently use; this policy does not assert unconfirmed data flows or practices for those integrations.

Website cookies and similar technologies may support essential website functionality. Optional website analytics and media can involve different information and providers from customer-controlled products.

Any use of non-essential cookies or similar technologies must comply with applicable consent requirements. The technologies and purposes must be accurately disclosed for each website; this policy does not assume the Data Tiles website, Latttice website and customer-controlled deployments use identical technologies.

We may update this Privacy Policy from time to time to reflect changes in our Services, legal obligations or business practices. Where material changes are made, we will provide notice through the Services or by other appropriate means.

If you have questions about this Privacy Policy or about how personal data is handled, please contact:

Data Tiles Ltd — Email: letstalkdata@data-tiles.io — Website: https://www.data-tiles.com