Commitments
Security
Security andconfidentiality.
Lola works with the most sensitive information a company has: legal advice, privileged communications, and the agreements behind every deal. This is how we handle it, in the same terms as our privacy policy.
Your data never trains AI models.
Not ours, and not anyone else’s. Lola uses what you connect only to do the work you ask of it.
Processed only on your instructions
For the content you connect, Lola acts as your processor. It handles that data only on your documented instructions, under your agreement with us.
You decide what Lola can reach
Your administrators choose which tools are connected and can revoke access at any time. Lola retrieves only what it needs to do the work.
Heightened care for privileged work
Legal advice, privileged and work-product material, and other sensitive records get heightened safeguards.
Encrypted credentials
Connector credentials and tokens are stored encrypted and used only to provide the service. Data is encrypted in transit.
Control access
Access is limited to the people who need it. We log and monitor our systems, with vulnerability management and incident response in place.
Yours to take back
When you leave, or whenever you ask, we delete or return your content as your agreement provides, unless the law requires us to keep it.
In detail
How your content is handled.
1.Model training
Lola never uses your data to train AI models, its own or anyone else’s. What you connect is used only to do the work you ask of Lola, on your instructions.
2.Your content, your instructions
Lola has two roles. For its own business records (such as your account details), Lola is a controller. For the documents, messages, and other content you connect, which our policy calls Customer Content, Lola is a processor: your company remains the controller and decides how that content is used.
As a processor, Lola processes Customer Content only on your documented instructions and as set out in your agreement with us. That agreement governs, not our privacy policy.
3.Connections you control
- Your administrators decide which integrations are enabled, and can revoke access.
- The credentials and tokens that authorize a connection are stored encrypted and used only to provide the service.
- Data moves between Lola and a connected tool only as the integration needs and as you instruct. Lola does not use its access to retrieve more than the work requires.
- Each connected tool’s own handling of data is governed by that provider’s terms.
4.Privileged and sensitive material
Connected content can include legal advice, attorney–client privileged and work-product material, employment matters, regulatory and compliance records, investigation material, and personal information inside agreements. We apply heightened safeguards to it, and process it only as your processor, on your instructions.
5.Our security program
Lola maintains a risk-based information-security program with administrative, technical, and physical safeguards. It includes:
- Encryption in transit, and at rest where supported
- Access controls and least-privilege access
- Network security, logging, and monitoring
- Vulnerability management and incident response
- Personnel training and vendor risk management
No method of transmission or storage is completely secure, and we won’t claim otherwise.
6.Service providers
We use vendors to run the service, such as cloud hosting and infrastructure, authentication, and error monitoring. They are bound by contract to process personal information only on our documented instructions and to protect it. As a processor, Lola discloses Customer Content only as you instruct and as your agreement sets out.
7.If something goes wrong
If a breach affects personal data in your content, we notify you without undue delay and support the notifications you need to make to authorities and individuals.
8.Retention and deletion
Retention of your content follows your agreement. When it ends, or whenever you ask, we delete or return your content as the agreement provides, unless the law requires us to keep it.
9.Where data is processed
Lola operates globally, so data may be processed in the United States and other countries where Lola or its service providers operate. Where the law requires it, we put appropriate safeguards in place for international transfers, and we address data-localization requirements through hosting and contractual arrangements.
10.What we don’t do
We do not sell personal information, and we do not disclose it for cross-context behavioral advertising.
Questions
Questions from your security or legal team?
Write to us and we’ll answer them directly. Your rights, and how to exercise them, are set out in our privacy policy.