Privacy Policy

Who we are

Lanlan ("we", "us", "our") is an AI-native website builder. Our website is lanlan.site and our dashboard is at app.lanlan.site.

What data we collect

Account information

When you sign up, we collect your email address. This is used for authentication (magic link login), transactional emails (domain setup, team invitations), and billing communications. We do not collect your name, address, or phone number.

Site content

Files you upload or create through Lanlan (HTML, CSS, images, etc.) are stored in Cloudflare R2. These files are the content of your websites and are accessible at your site's public URL.

Analytics

We use PostHog for product analytics. We track usage events (tool calls, page views, feature usage) tied to your anonymous user ID. We do not send your email address or other personally identifiable information to PostHog. PostHog may set cookies for session tracking on the dashboard.

Site visitor analytics

If you use Lanlan's built-in analytics, we collect aggregated, anonymous data about visitors to your sites: page views, referrers, countries (derived from IP), and device types. Visitor IP addresses are hashed and never stored in raw form. No cookies are set on your visitors.

Form submissions

If you add contact forms to your site, submission data is stored in our database and forwarded to your notification email. IP addresses of form submitters are hashed for spam prevention and never stored raw.

On paid plans, submissions that our heuristic spam filter scores as borderline are sent to Anthropic for an automated spam verdict (model: Claude Haiku). The submission's fields are included in that request. Anthropic processes API inputs to return a result and does not use them to train its models. This step is rate-limited per form and is skipped entirely if the API is unavailable.

Product lifecycle data and service emails

We record product milestones tied to your account — signing up, connecting an AI assistant, creating a site, deploying, and making your first edit — along with when they happened. We use this to understand where you are in setup and to send a small number of service emails about your own account (for example, a reminder with the next setup step if you stall partway). Every automated email includes a one-click unsubscribe link; unsubscribing stops all automated email immediately and permanently. We never send more than one automated email to you in a day.

Leads (a feature for site owners)

Site owners can enable Leads, which organizes contacts for their site — form submissions, notes they add, and emails their pipeline sends — into a simple pipeline. If you submit a form on a Lanlan-hosted site whose owner has enabled Leads, your email address and the fact of your submission are stored in that owner's pipeline; the owner is responsible for that data and for any email they send you, which always includes an unsubscribe link. Pipeline activity records are retained for approximately 12 months; contact deletion removes the contact's activity records and pending automations with it.

What we never do: the contents of form submissions on your sites belong to you and your visitors. Lanlan may record that a form received a submission (an operational event) but never reads submission contents into our own systems for our own purposes.

AI image generation

When you ask Lanlan to generate an image, logo, or brand graphic, your request (including any reference material you provide) is sent to OpenAI (model: gpt-image-1.5) to produce it. OpenAI does not use API inputs to train its models. This happens only when you explicitly request image generation.

Payment information

Payments are processed by Stripe. We do not store credit card numbers. Stripe collects payment details directly. We store your Stripe customer ID and subscription status in our database.

Domain registration

If you purchase a domain through Lanlan, we register it on your behalf via Cloudflare Registrar, an ICANN-accredited domain registrar. The following applies:

• WHOIS privacy: WHOIS privacy protection is enabled by default on all domains registered through Lanlan.
• Data sent to Cloudflare Registrar: The domain name you purchase and DNS record configurations. Cloudflare's privacy policy is available at cloudflare.com/privacypolicy.
• ICANN requirements: Domain registrations are subject to ICANN policies. See ICANN Registrant Rights & Responsibilities.
• Cloudflare is the sponsoring registrar for all domains purchased through Lanlan.

Third-party services

We share data with the following services to operate Lanlan:

• Cloudflare (hosting, CDN, DNS, database, domain registration) — your site files, database records, request metadata, and domain registration data
• Stripe (payments) — your email address and payment details
• Resend (transactional email) — your email address and email content
• PostHog (product analytics) — anonymous usage events, no PII
• Unsplash (stock photos) — search queries when you use the image search feature
• Anthropic (automated spam classification, paid plans only) — the fields of borderline contact-form submissions, sent for a spam verdict; not used to train models
• OpenAI (AI image generation) — your prompt and any reference material you provide when you request an image, logo, or brand graphic; sent to produce the image; not used to train models

How we use your data

• To provide and maintain the Lanlan service
• To authenticate you and secure your account
• To process payments and manage subscriptions
• To register and manage domains on your behalf
• To send transactional emails (login links, domain setup, expiration reminders)
• To improve the product based on aggregate usage patterns

We do not sell your data. We do not use your data for advertising. We do not train AI models on your site content.

Data retention

• Account data: Retained while your account is active. Deleted upon request.
• Site content: Stored in R2 while the site exists. Deleted when you delete the site.
• Analytics events: Retained in PostHog per their retention policy.
• Domain registrations: Records retained for the life of the domain registration.

Your rights

You can:

• Access your data by logging into the dashboard
• Delete your account and all associated data by contacting support@lanlan.site
• Export your site files at any time through the dashboard or API
• Inquire about what personal data we hold by emailing support@lanlan.site

Cookies

We use essential cookies for authentication (session cookies on the dashboard). PostHog may set analytics cookies. We do not use advertising or third-party tracking cookies. Your published sites do not set any cookies unless you add them yourself.

Security

Data is encrypted in transit (HTTPS everywhere) and at rest (Cloudflare infrastructure). Authentication uses magic links — no passwords are stored. OAuth tokens are stored securely in our database.

Children

Lanlan is intended only for adults 18 and older. It is not directed at children, and we do not knowingly collect data from anyone under 18. If we learn that we have collected data from a person under 18, we will delete it.

Changes

We may update this policy. Material changes will be communicated via email or dashboard notification.

Contact

Questions about privacy? Email support@lanlan.site.