Privacy Policy

This Privacy Policy explains how Nestware Labs, LLC (“LotThread,” “we,” “us”) handles personal information when you visit lotthread.com, create an account, or use LotThread. We’ve tried to keep it clear and specific.

Controller vs. processor. For information about your own account and our website, we act as the controller. For the operational records you and your team enter into a workspace (your materials, lots, batches, customers, and similar business data), we act as a processor on behalf of your organization, which is the controller of that data.

1. Information we collect

We collect:

• Account information - name, email, username, organization name, and role, provided when you register or are added to a workspace.
• Workspace / operational data - the records you enter to run your operation (suppliers, materials, lots, batches, finished goods, shipments, events, and any notes or attachments). This may include the personal data of your own employees or contacts if you choose to enter it.
• Billing information - plan and subscription status. Card payments are processed by Stripe; we receive limited billing metadata (such as a customer and subscription identifier and status) but not your full card number.
• Usage and device data - IP address, browser type, pages viewed, and similar log data, collected automatically to operate and secure the service.
• Communications - messages you send us, including demo requests and support inquiries.

2. How we use information

We use personal information to:

• provide, maintain, and improve the service;
• authenticate users and secure workspaces and data isolation between tenants;
• process subscriptions and payments;
• respond to inquiries and provide support;
• send service and administrative messages (and, where permitted, occasional product updates you can opt out of); and
• detect, prevent, and address fraud, abuse, and security issues, and comply with law.

3. Legal bases (EEA/UK)

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (to provide the service you signed up for); our legitimate interests (to secure, operate, and improve the service); consent (where required, e.g., certain communications); and compliance with legal obligations.

4. How we share information

We do not sell personal information. We share it only:

• with service providers (subprocessors) who help us run the service, such as cloud hosting, payment processing, and email delivery - see our Subprocessors list;
• to comply with law or a valid legal request, or to protect rights, safety, and the integrity of the service;
• in a business transfer such as a merger, acquisition, or sale of assets, subject to this policy; and
• with your consent or at your direction (for example, integrations you enable).

5. Data retention

We keep account and workspace data for as long as your account is active and as needed to provide the service. After account closure we make data available for export for a limited period and then delete or anonymize it in the ordinary course, unless we must retain it to comply with legal, tax, or security obligations. Because the service is a traceability record system, your organization may be legally required to retain certain records; you are responsible for exporting anything you must keep.

6. Security

We use technical and organizational measures to protect personal information, including encryption in transit, access controls, tenant data isolation, and an append-only audit ledger for operational events. No system is perfectly secure, but we work to protect your data and to notify affected parties of incidents as required by law.

7. International transfers

We and our service providers may process information in countries other than yours. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing or withdraw consent. Workspace administrators can exercise the export and deletion rights directly in the product: Organization settings → Your data offers a complete export (ZIP of CSVs) and a permanent-deletion request that we honor within 30 days. For anything else, contact us at privacy@lotthread.com. If your data lives in a workspace controlled by your organization, we may refer your request to that organization. You also have the right to complain to your local data-protection authority.

U.S. state privacy rights. If you are a resident of California or another U.S. state with a privacy law, you may have similar rights, including the right not to be discriminated against for exercising them. We do not sell or “share” personal information for cross-context behavioral advertising.

9. Cookies

We use essential cookies to run the site and keep you signed in securely. Optional analytics or marketing cookies are used only when you consent. See our Cookie Policy for details.

10. Children

LotThread is a business tool and is not directed to children under 16, and we do not knowingly collect their personal information.

11. Changes

We may update this policy from time to time. We will post the new version here and update the date above; for material changes we will provide additional notice.

12. Contact us

For privacy questions or requests, contact Nestware Labs, LLC at privacy@lotthread.com.