Privacy

Concept Space lets you define axes, map projects across a multi-axis grid, find gaps, and generate AI idea candidates. Sign in to keep your projects and ideas. Mapping is free; unlimited AI generation needs a time-boxed pass, purchased via Lotl Pay (Stripe). No third-party analytics or trackers.

Sign-in identity is managed by Lotl Auth. Your axes, projects, and generated idea drafts live on our server. AI gap-idea generation goes through Lotl AI, our AI gateway, which routes it to DeepSeek by default or OpenAI. Access passes are purchased through Lotl Pay (Stripe). Telemetry goes to Lotl Observe.

What we collect

We collect and store the following kinds of data, each with its own retention and legal basis:

Account: Your sign-in identity is managed by Lotl Auth, our authentication service (auth.lotlsoft.com). Lotl Auth stores your email, your name if you provided one, and a hash of your password (argon2id). Sign-in issues a short-lived JWT access token (15 minutes) and a refresh token (30 days). Email verification and password resets go through transactional email (Resend).Stored on our server. Kept until you delete it. Legal basis: contract (needed to run the service). Removable when you delete your account. Shared with: Lotl Auth.
Taxonomies and projects: The axes (taxonomies) you define and the projects you place on them, including any tags, descriptions, and grid positions. Stored against your account. When you add a project without choosing its axes, its name and description are sent to Lotl AI, our AI gateway, to compute an embedding that places it on the grid by meaning. Embeddings run on a model we host ourselves, or on OpenAI if that model is not configured.Stored on our server. Kept until you delete it. The AI provider (DeepSeek or OpenAI) processes the request under its own API terms; Lotl AI keeps request metadata, not the text. Legal basis: contract (needed to run the service). Removable when you delete your account. Shared with: DeepSeek and OpenAI (via Lotl AI).
AI generated ideas: The axis values and project context you submit for gap-idea generation, and the candidates that come back. Candidates are stored against your account so you can review and save them later. AI features go through Lotl AI, our AI gateway service (ai.lotlsoft.com). Lotl AI forwards the prompt to DeepSeek by default, or to OpenAI for some features, such as web search. Image generation, where an app offers it, goes to fal or OpenAI. Anthropic is used only when a feature asks for it by name. Text embeddings are computed on a model we host ourselves, or by OpenAI if that model is not configured. For each request Lotl AI stores the app id, agent id, your user id if the app sends one, the provider and model, token counts, latency, cost, finish reason, any error, and any extra details the app attaches to the request. It does not keep the prompt or the response text. The provider receives the prompt, not your user id, and processes it under its own API terms; OpenAI's API terms exclude API data from model training.Stored on our server. Kept until you delete it. The AI provider (DeepSeek or OpenAI) processes the request under its own API terms; Lotl AI keeps request metadata, not the text. Legal basis: contract (needed to run the service). Removable when you delete your account. Shared with: DeepSeek and OpenAI (via Lotl AI).
Passes and purchases: Your access-pass state (active tier and expiry), the once-per-account free trial grant, daily free-generation counts, and pass purchase history. Purchases go through Lotl Pay (Stripe holds the card data).Stored on our server. Kept permanently. Purchase records are kept for tax and dispute-resolution reasons even after account deletion. Legal basis: contract (needed to run the service). Not individually deletable. Shared with: Stripe.
Usage telemetry: Page views, click events, AI operation counts, and crash reports sent to Lotl Observe. Does not include the contents of your taxonomies, project descriptions, or AI prompts.Stored on our server. Kept permanently. Legal basis: legitimate interests. Not individually deletable. Shared with: Lotl Observe.

Third parties

These external services receive some of your data:

DeepSeek and OpenAI (via Lotl AI) — AI gap-idea generation, and project-placement embeddings when our self-hosted embedding model is not configured
DigitalOcean — server hosting for the Concept Space service
Stripe — Access pass checkout (via Lotl Pay)

Your rights

You can export everything we hold about you, and delete your account at any time. Both options live in your account settings. Deletion is immediate and unrecoverable.

Last updated: 2026-10-02.