LarkLegal
Privacy Policy
Lark runs AI agents for you: each one gets a model, tools and its own cloud machine, and works on the tasks you give it. This policy explains what data that involves, what we do with it, and the choices you have. We don't sell your data, and we don't use your agents' work to train AI models.
What we collect
- Your account: name, email address, a password hash (never the password), and, if you turn on two-factor sign-in, your phone number or an authenticator secret. If you sign in with Google, we receive your name and email from Google.
- Your organization: its name, its members and their roles, invitations, and its settings.
- What you give your agents: their instructions and settings, the tasks you send them, skills, triggers and the requests sent to your webhooks, messages and answers you send while they work, and their conversations with the assistant.
- What your agents produce: run logs (commands, output, pages visited, screenshots of their browser), results and reports, and the files on their machines.
- Secrets: API keys and tokens you store for your agents. They're encrypted at rest and are only put into the machines of the agents you attach them to.
- Billing: your plan, usage (machine time and AI tokens) and costs. Payments are handled by Stripe; we never see or store your card number.
- Technical data: IP addresses, browser type and timestamps in our security and request logs, and one session cookie that keeps you signed in. We don't use advertising or third-party tracking cookies.
How we use it
- To run your agents and show you their work, costs and results.
- To sign you in, keep your account and organization secure, and prevent abuse of the service.
- To bill you and enforce your plan's limits and your budget.
- To send the notifications you set up (email, Slack, text) and important account messages.
- To fix problems and improve Lark, using aggregate usage, not the content of your runs.
Who processes it for us
We use these providers to run Lark. Each only receives what it needs for its part:
- Fly.io: hosting for Lark and the cloud machines your agents run on.
- Google Cloud: hosting for internal tools, and Google sign-in if you use it.
- Vercel: hosting for the website and dashboard.
- AI model providers (Fireworks, Anthropic, OpenAI, and any provider you configure with your own key): your agents' prompts and the content they work with are sent to the model you choose, to produce its responses.
- Stripe: payments and invoices.
- Twilio: text messages, for sign-in codes and alerts you turn on.
- Our email provider: sign-in, invitation and notification emails.
- Frankie: the assistant in the dashboard, which acts on your behalf through Lark with your permissions.
Your agents can also reach any website or service you point them at, with the credentials you give them. What they send there is governed by those services' own terms and policies.
How long we keep it
- Account and organization data: while your account is open.
- Run logs, results and screenshots: while your organization exists, unless you delete them sooner.
- Agent machines: destroyed after each run, unless the agent is set to keep its machine between tasks. Kept machines are deleted when you reset or delete the agent.
- Billing records: as long as tax and accounting law requires.
- Security logs: up to 90 days.
When you delete your organization or account, we delete its data within 30 days, except what we must keep by law.
How we protect it
Each agent runs on its own isolated machine. Secrets are encrypted at rest and removed from logs. Connections are encrypted in transit, sign-in supports two-factor authentication, and access within an organization is limited by role and recorded in an audit log. No system is perfectly secure; if a breach affects your data, we'll tell you without undue delay.
Your choices and rights
You can see and edit your account and organization data in the dashboard, export your agents' results, delete runs and agents, and close your account. Depending on where you live, you may also have the right to access, correct, delete, restrict or port your personal data, and to object to how we use it. Email jorgeochoareyes@gmail.com and we'll respond within 30 days. If you're in the EU or UK, you can also complain to your data protection authority.
Children
Lark isn't for anyone under 16, and we don't knowingly collect their data.
Changes
If we change this policy in a way that matters, we'll tell you by email or in the dashboard before it takes effect.