Privacy Policy

1. The short version

We collect what we need to run your account, publish the surfaces you ask us to, and improve the product. The business facts you publishare intentionally public and machine-readable. Everything else — your account details, draft content, and inquiry inbox — is private to your account. We don't sell your personal data.

2. Information we collect

• Account information — your email address and name, and either a hashed password or an identifier from a social sign-in provider (Google or GitHub) if you use one.
• Business profile content — the name, services, pricing, hours, location, policies, and FAQs you enter. When you publish, this becomes public (see section 5).
• Website-import data — when you ask us to import from a website, the URL you provide, the publicly available page content we fetch from it, page metadata, the facts we extract, the suggestions we generate, and related processing logs.
• Inquiries— when an agent sends you a lead on a customer's behalf, we store the contact details and message it includes so you can respond.
• Usage & agent-event logs — records of which AI agents and crawlers reach your surfaces and what they ask, used for your analytics and the answer-gap radar. IP addresses in these logs are stored as a one-way hash, not in the clear.
• Cookies & analytics— essential cookies keep you signed in; cookieless Vercel Web Analytics measures anonymous, aggregate page traffic, while optional PostHog product analytics runs only after you accept it on Lodestar's root product hosts. PostHog is not initialized on public business subdomains. You can change the PostHog choice anytime. See our Cookie Policy.

3. How we use your data

• To provide your account, dashboard, and published surfaces.
• To import, parse, and transform website content you ask us to import.
• To generate analytics, the agent-readiness score, and optimization suggestions for you.
• To send transactional email (verification, password reset, account changes).
• To process subscriptions and prevent abuse.
• To diagnose errors and improve reliability and the product.

4. Legal bases

Where data-protection law (such as the EU/UK GDPR) applies to you, we rely on these legal bases:

• Contract — to create your account and provide the service you sign up for.
• Legitimate interests — to secure, maintain, measure aggregate traffic for, and improve the service and to prevent abuse, balanced against your rights.
• Consent — for optional PostHog product analytics and other non-essential cookies. PostHog capture runs only after you opt in, and you can withdraw consent anytime (see the Cookie Policy).
• Legal obligation — to keep billing, tax, and accounting records.

5. What you publish is public

The purpose of Lodestar is to make your business readable by AI agents. Once you publish, your profile facts are served publicly through llms.txt, llms-full.txt, schema.org JSON-LD, the /.well-known discovery document, your MCP server resources, and your public profile page. Because these surfaces are public, they may be fetched, cached, copied, indexed, or stored by third-party agents and crawlers beyond our control, and unpublishing from Lodestar does not guarantee removal from those third parties. Don't publish anything you wouldn't want public.

6. AI processing

When you use AI features, import from a website, or an agent calls the grounded ask tool, the relevant profile content, website-import content, questions, and inquiry context may be sent directly to OpenAI through its APIfor drafting, optimization, triage, and grounded answers. Lodestar disables Responses application-state storage for these calls. OpenAI API data is not used to train models unless the operator explicitly opts in, while default abuse-monitoring retention follows the OpenAI account's data controls. An operator-controlled Google Gemini rollback route may be used during provider incidents. Lodestar does not use your data to train its own AI models.

7. Service providers

We share data with a small set of service providers (subprocessors) only as needed to run the service. Some run on every deployment; others are used only where the corresponding integration is enabled or configured:

• Neon — Database hosting (PostgreSQL).
• Vercel — Application hosting, content delivery & cookieless web analytics.
• Resend — Transactional email (verification, password reset) (where enabled).
• Cloudflare — Bot verification on sign-up and password-reset requests (where enabled).
• OpenAI — AI features — content drafting & grounded answers (where enabled).
• Google (Gemini AI) — Optional AI rollback provider (where enabled).
• Lemon Squeezy — Payments & subscriptions (Merchant of Record) (where enabled).
• Sentry — Error monitoring & diagnostics (where enabled).
• PostHog — Product analytics (where enabled).
• Google / GitHub — Optional social sign-in (OAuth) (where enabled).

8. Payments

Subscription payments are handled by Lemon Squeezy as our Merchant of Record. They collect and process your payment details under their own privacy policy; we never see or store full card numbers. We receive only the subscription status and limited billing metadata needed to manage your plan.

9. International transfers

Our infrastructure and subprocessors may process data in the United States and other countries where they operate, which may differ from where you live. Where data is transferred internationally, we rely on the safeguards offered by those providers (such as standard contractual clauses) to protect it.

10. Data retention

We keep your data for as long as your account is active. When you unpublish, the origin stops serving your surfaces, subject to a brief cache-propagation window. Cancelling a subscription keeps surfaces live through the paid or trial period; they stop when that entitlement ends. If you close your account, we delete or de-identify the associated personal data within a reasonable period after a verified request (typically within 30 days). Limited copies may persist for a short period in encrypted backups, security and operational logs, and we retain billing, tax, and accounting records for as long as the law requires.

11. Your rights

You can access and edit most of your data directly from the dashboard, and update your account email and password in settings. Depending on where you live, you may also have rights to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to lodge a complaint with your local data-protection authority. To make a request, email support@eastbase.studio.

12. Security

We protect data with measures including encrypted transport (HTTPS), hashed passwords, hashed IP addresses in logs, strict per-business data isolation, server-side rate limits, bot verification on selected public auth actions, and signature-verified billing webhooks. No system is perfectly secure, but we work to keep your data safe.

13. Children

Lodestar is a tool for businesses and is not directed to children. We don't knowingly collect personal data from anyone under the age of 16.

14. Changes & contact

We'll update this policy as the product evolves and revise the “Last updated” date above. Lodestar is operated by Eastbase Studio. Questions or requests? Email support@eastbase.studio.