Privacy Policy

1. Introduction

Light Reach, Inc. ("Light Reach," "we," "us," or "our") operates the LightReach service (the "Service"), accessible at compress.lightreach.io. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, do not use the Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address (required for account creation and communication)
• Password (stored as a cryptographic hash, never in plain text)
• Full name (optional)
• Account creation and last login timestamps

2.2 Authentication Data

To maintain secure sessions, we collect:

• Refresh tokens (hashed and stored securely)
• Device information and IP addresses for session management
• JWT authentication tokens

2.3 API Usage Data

When you use our API services, we collect usage data that varies by subscription tier:

• All Tiers: Token counts (input/output/total), compression ratios, request timestamps
• Pro and Enterprise Tiers: Detailed analytics including prompt previews (truncated), processing times, model/provider used, cost estimates, IP addresses, user agents, tags, and metadata
• Important: We do not store full prompt content. Only truncated previews are retained for analytics purposes (Pro+ tiers only)

2.4 API Keys and Provider Credentials

Compress Cloud uses server-side provider credentials. If you choose to connect an optional customer provider key, we collect and encrypt:

• Your API keys for third-party LLM providers (OpenAI, Anthropic, Google, OpenRouter, etc.)
• All provider keys are encrypted at rest using AES-128-CBC (Fernet) encryption
• Keys are never returned via our API after initial submission
• We store only key previews (first/last characters) for identification purposes

2.5 Billing Information

Payment processing is handled by Stripe. We collect:

• Stripe customer ID and subscription ID
• Subscription tier and billing cycle information
• Payment status and history via Stripe webhooks
• Note: We do not store credit card numbers or payment details. These are handled exclusively by Stripe.

2.6 Team and Collaboration Data

If you use team features, we collect:

• Workspace memberships and roles (owner, admin, member, viewer)
• Team invite emails and invitation tokens
• Tag-scoped access permissions
• Workspace settings and configurations

2.7 Analytics and Usage Tracking

We use PostHog for product analytics:

• Page views and navigation patterns
• Feature usage and engagement metrics
• User identification (anonymized where possible)
• All analytics data is sanitized to exclude sensitive information

2.8 Budget and Cost Management Data

For users utilizing budget features, we collect:

• Budget definitions (global or tag-scoped)
• Budget alert preferences and event history
• Cost tracking by tags, teams, and environments
• Spend forecasts and anomaly detection data

3. How We Use Your Information

We use collected information for the following purposes:

• Service Provision: To provide, maintain, and improve the LightReach service
• Authentication: To verify your identity and maintain secure access to your account
• Billing: To process payments and manage subscriptions via Stripe
• Analytics: To analyze usage patterns and improve service quality
• Communication: To send budget alerts, team invitations, service updates, and support responses
• Cost Optimization: To route requests to appropriate LLM providers and track cost savings
• Security: To detect and prevent fraud, abuse, and security incidents
• Compliance: To comply with legal obligations and enforce our Terms of Service

4. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share your information in the following circumstances:

4.1 Service Providers

• Stripe: Payment processing and subscription management
• Resend: Email delivery for alerts and invitations
• PostHog: Product analytics and feature flags
• LLM Providers: Your prompts are sent to the model provider selected through Compress Cloud or authorized through an optional customer provider key. Each provider has their own privacy policy.

4.2 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or subpoena).

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change in ownership.

4.4 Team Members

If you use team collaboration features, certain information (usage data, cost analytics, workspace configurations) is shared with team members according to their role-based permissions.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption: All data in transit is encrypted using HTTPS/TLS. Sensitive data (API keys, provider keys) is encrypted at rest using AES-128-CBC.
• Password Security: Passwords are hashed using bcrypt with 12 rounds of salting.
• Token Security: Refresh tokens and authentication tokens are hashed and stored securely.
• Access Controls: Role-based access controls limit data access to authorized personnel only.
• Secret Redaction: Application logs automatically redact sensitive information.
• Rate Limiting: We implement rate limiting to prevent abuse and unauthorized access.

While we strive to protect your information, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

6. Data Retention

We retain your information for as long as necessary to:

• Provide the Service to you
• Comply with legal obligations
• Resolve disputes and enforce agreements

Specific retention periods:

• Account Data: Retained until account deletion
• API Usage Data: Retained for 90 days (Free tier) or 1 year (Pro/Enterprise tiers)
• Billing Records: Retained for 7 years for tax and accounting purposes
• Authentication Tokens: Refresh tokens expire after 30 days of inactivity

7. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights:

7.1 Access and Portability

You have the right to access and export your personal information. You can view most of your data through the dashboard. For a complete export, contact us at hello@lightreach.io.

7.2 Correction

You can update your account information at any time through the dashboard settings.

7.3 Deletion

You may request deletion of your account and associated data by contacting us at hello@lightreach.io. Note that some information may be retained for legal or legitimate business purposes.

7.4 Opt-Out

You can opt out of non-essential emails by updating your notification preferences in the dashboard or by clicking the unsubscribe link in our emails.

7.5 Object to Processing

You may object to certain processing of your data. Contact us at hello@lightreach.io to exercise this right.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws different from those in your jurisdiction.

By using the Service, you consent to the transfer of your information to the United States and other countries where our service providers operate. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy.

9. Children's Privacy

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately at hello@lightreach.io.

10. Third-Party Services

When you use Compress Cloud or optional provider-key functionality, requests may be sent to third-party LLM providers. These providers include:

• OpenAI (openai.com/privacy)
• Anthropic (anthropic.com/privacy)
• Google (policies.google.com/privacy)
• OpenRouter (openrouter.ai/privacy)
• Other compatible providers you configure

Each provider has its own privacy policy and data handling practices. We recommend reviewing their policies before using their services through our platform.

11. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by businesses
• Right to opt-out of sale of personal information (Note: We do not sell your information)
• Right to non-discrimination for exercising your CCPA rights

To exercise these rights, contact us at hello@lightreach.io with "CCPA Request" in the subject line.

12. GDPR Rights (European Users)

If you are located in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Rights related to automated decision-making and profiling

To exercise these rights, contact us at hello@lightreach.io. We will respond within 30 days.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Posting the new Privacy Policy on this page
• Updating the "Last Updated" date
• Sending an email notification to your registered email address (for significant changes)

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: