Privacy Policy
Version 2026-10-31. Last updated: October 31, 2026.
This policy explains what personal data BEPA Ventures LLC, doing business as Lantern ("Lantern", "we", "us"), of 5900 Balcones Dr, Ste 100, Austin, TX 78731, USA, collects, why, who processes it, how long we keep it, and the choices you have. Questions: support@lanternnms.com.
Who this covers, and our role
- Visitors to lanternnms.com, and people who request a demo or a volume discount.
- Customers and their team members who use their Lantern account at account.lanternnms.com.
For this data we decide how it is used (we are the "controller" or "business").
Data inside a customer's cloud portal at name.lanternnms.com, such as the customer's users or device data from the customer's clients, is different: the customer decides what goes in, and we process it on the customer's behalf under our Data Processing Addendum. If your data is in a Lantern customer's portal (for example you work for one of its clients), please contact that customer; if you contact us, we pass your request to them.
On the self-hosted plan, the appliance runs on the customer's own hardware and sends us nothing: no usage data, no crash reports, no license or update checks. It connects only to the customer's devices and to services the customer configures, such as an email provider, ticketing system, documentation platform, identity provider or AWX.
What we collect and why
| Data | Where it comes from | Why we use it |
|---|---|---|
| Name, work email, company, role, network size and your message | The demo and volume discount forms | To reply and arrange a demo or quote |
| Email address, company, plan, number of sites and portal name | Sign-up | To create and run your account and subscription |
| Record of your acceptance of our terms: the exact statement, document version, time, IP address and browser identification | Sign-up and Stripe Checkout | To show what was agreed, and when |
| Team members' email addresses, roles, who invited them, sign-in times | Your Lantern account | To run the account and keep it secure |
| Account activity: purchases, plan changes, downloads, license files issued, portal setup, with time and sometimes IP address | Your Lantern account | Security, abuse prevention, support and our records |
| License files: company name, account, plan, number of sites and dates (no personal data) | Self-hosted purchases | To license the appliance |
| Billing details: billing name and address, the last four digits, brand and expiry of your card, invoices, payment status and tax details | Stripe | Billing, receipts, tax and accounting |
| Emails you send us, and our replies | Support and our records | |
| Web server logs: IP address, page requested, browser and time | Our hosting providers | Running and securing the service |
Card numbers never reach us. You enter them on Stripe's hosted pages, and Stripe stores them.
We do not buy personal data, combine it with data from data brokers, or use it for advertising or profiling. We do not use personal data or customer data to train artificial intelligence models.
Cookies and similar technology
- lanternnms.com sets no cookies, stores nothing in your browser, and loads no analytics, advertising, social media or other third-party scripts, fonts or embeds.
- account.lanternnms.com uses two strictly necessary cookies, limited to that address:
la_sessionkeeps you signed in (up to 12 hours), andla_csrfprotects its forms against forgery (up to 4 hours). - Cloud portals and the self-hosted appliance use strictly necessary cookies for sign-in, two-step sign-in and single sign-on, and keep display preferences (such as map layout and theme) in your browser's local storage. Nothing is sent to third parties.
Because we do not sell or share personal data and do not use tracking technology, there is nothing to opt out of; we treat a Global Privacy Control signal as a request not to sell or share, which we already honor for everyone.
Data in the cloud service
On the cloud plan, a collector at each of the customer's sites keeps the bulky and sensitive data on site. Raw logs, raw flow records, configuration backups and their history, and device credentials are kept on the collector and never stored in our cloud. When a user searches logs or opens a configuration in the portal, the collector sends the result through the portal to their browser, and the portal does not keep it.
While the cloud plan is in early access, a portal stores:
- the customer's clients and sites;
- each collector's name, host name, operating system, software version, the public IP address it connects from, its certificate, and the address ranges it is allowed to scan;
- the device inventory: host names, management addresses, vendor, model, serial numbers, firmware, role, status and port counts;
- the portal's users, their sign-in settings and sign-in records, and the portal's audit log.
As further features are released, a portal will also hold the network map and its history, alerts, incidents and loop events, log findings and message counts (not the log lines), traffic summaries, the last 24 hours of graphs (older history is fetched from the collector when viewed and not kept), configuration change records (device, time, who and line counts, never the configuration itself), LAN endpoint names and addresses, and SSH session details such as the device login used. We will update this list, with how long each item is kept, when each feature ships.
Who processes data for us
The companies that process data for us, what for and where, are listed on our subprocessors page: Stripe (payments), DigitalOcean (hosting, New York, USA), Microsoft 365 (email), Netlify (website and its forms) and Cloudflare (DNS only).
We share personal data only with them, with your own Lantern team members where the account requires it, when the law requires it (for example a valid court order), to protect our rights or someone's safety, or with a buyer of our business, who would have to keep this policy's promises. We do not sell personal data, and we do not share it for advertising.
How long we keep it
| Data | Kept for |
|---|---|
| Demo and volume discount requests | 12 months after our last contact, unless you become a customer |
| Sign-ups that were never paid | Deleted 30 days after they expire |
| Invitations to join an account | Deleted 30 days after they are used or expire |
| Sign-in links and sessions | Deleted once they expire (a link after 15 minutes, a session after 12 hours at most) |
| Account data (team members, account activity) | While the account is open. When an account is closed, at the owner's request or after 3 years without an active subscription, we delete it within 30 days, except the records below |
| Acceptance records and the audit log of billing and account actions | While the account is open and 4 years after it closes, to show what was agreed and done |
| Billing records | 7 years, as tax law requires (held by Stripe and in our accounting) |
| Support emails | 24 months after the conversation ends |
| Cloud portal data | While the subscription runs, then 30 days read-only, then deleted; backup copies expire within 30 days after that |
| Web server logs | Rotated automatically and not archived |
Security
Data in transit is encrypted with TLS. Each cloud customer has its own database and database login, its own isolated application environment on shared infrastructure, and its own encryption keys. The few secrets we must keep to run a portal are stored encrypted in our database, with the encryption key kept outside it. Card data stays with Stripe. Sign-in links are single use and expire after 15 minutes. Access to our systems is limited to the people who run Lantern, and every billing and provisioning action is logged.
No system is perfectly secure. If a breach affects your personal data, we will tell you without undue delay and as the law requires. To report a security problem, see our vulnerability disclosure policy.
Your choices and rights
You can ask us to tell you what personal data we hold about you, give you a copy, correct it, delete it, or stop using it for a purpose, by emailing support@lanternnms.com. Please write from the email address the request is about, or we may need to confirm your identity another way. We reply within 30 days. We do not treat you differently for using these rights. We may keep some records where the law requires it, such as invoices, and we tell you when that is the case. You can also ask someone to make a request for you, with your written permission.
Data protection laws may give you further rights depending on where you live. If you are in the European Union or the United Kingdom, you can also complain to your data protection authority.
Business use and children
Lantern is a service for businesses, for people aged 18 and over acting for a business. It is not directed to children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, email support@lanternnms.com and we will look into it and delete it.
Emails we send
We send service emails about your account: sign-in links, sign-up confirmations, portal and license notices, billing and renewal reminders, and security or legal notices. You cannot opt out of these while you have an account, because they are part of the service. We do not send marketing emails. If we ever do, we will only send them to people who may receive them under the law, identify them as from Lantern with our postal address, and include a working unsubscribe link that we honor.
Where data is kept
Our services are hosted in the United States. If you contact us from elsewhere, your data is transferred to and processed in the United States.
Changes
We post changes here with a new version date, and we email account owners about significant ones before they take effect.