Last updated 29 September 2026

Privacy policy

This policy explains how Lanewise handles personal data when you visit lanewise.app, use the dashboard, or call the API. We keep it short and collect as little as we can.

Who we are

Lanewise operates lanewise.app, docs.lanewise.app, dash.lanewise.app and api.lanewise.app, and is the controller of the personal data described here. For anything about privacy, write to[email protected].

Data we collect

Your account

Your name, email address and password. We store only a hash of the password.
Whether you verified your email, and when.
Your teams: their names and images, their members and roles, and the email addresses of people you invite.

Using the API and the dashboard

API keys. We store only a hash of each key, plus its name, last four characters, permissions, expiry date and when it was last used.
A request log for each API request: the endpoint, method, query parameters, request and response bodies (large bodies are replaced by their size), status code, time, and the API key used. You can see this log in the dashboard.
Aggregated usage counts (how many requests each key made per endpoint and period), without request contents.
Technical data such as IP addresses, which our servers and Cloudflare process to deliver the service and to protect it against abuse and fraud.

Visiting our websites

We use Cloudflare Web Analytics to count visits: which pages are viewed, the referring site, your country, browser and device type, and page load times. It uses no cookies or local storage, doesn't fingerprint you, and doesn't track you across sites or visits. We only see aggregated numbers.

Billing

Paid plans are sold through Link, the merchant of record operated by Stripe. Link collects your payment details, billing address and VAT information, and issues your receipts and invoices. We never see or store your card details. We keep a reference to your Stripe customer and subscription, and the status and renewal date of your subscription.

Your content

The points of interest, attributes, categories, imports and routing requests you send to Lanewise are your content. We process them only to provide the service to you, as explained in the data processing section of our terms of service. Uploaded CSV files are deleted once their import finishes.

Why we use it

To provide the service you signed up for (performance of a contract): your account, teams, API keys, plans and limits, request log and usage, and the emails the service needs to send, such as verification, password resets, invitations and plan changes.
To keep Lanewise secure and working (our legitimate interest): preventing abuse and fraud, enforcing plan limits and our terms, investigating errors, and understanding how our websites are used through aggregated analytics.
To comply with the law (legal obligation), where we are required to keep or disclose information.

We don't sell your data, use it for advertising, or build profiles about you. We don't send marketing emails.

How long we keep it

Account and team data: until you delete them.
Request log: 30 days.
Aggregated usage counts: while your team exists.
Web server logs, including IP addresses: 14 days.
Database backups: 7 days. Deleted data disappears from backups within that time.
Your content: until you delete it, or until the team is deleted.

Who processes it for us

We rely on these providers, each bound by a data processing agreement or equivalent terms:

Amazon Web Services: servers and database, in London (United Kingdom).
Cloudflare: network, security, email forwarding and privacy-friendly web analytics.
DigitalOcean: hosting for this website and the documentation.
Stripe and Link: payments, as merchant of record for paid plans.
MailerSend: sending the service's emails.
OpenStreetMap Foundation (Nominatim): turns the coordinates of your points of interest into addresses. Only coordinates are sent.
HeiGIT (OpenRouteService): calculates routes. Only coordinates and routing options are sent.

Some of these providers process data outside the European Economic Area, such as in the United Kingdom or the United States. Those transfers rely on an adequacy decision or on the European Commission's standard contractual clauses.

Cookies and browser storage

Lanewise doesn't use cookies for tracking or analytics, and doesn't load advertising or cross-site trackers. The dashboard keeps your session and a few settings, such as your theme and your onboarding progress, in your browser's local storage. The website only remembers your theme. This storage is strictly necessary for what you ask the site to do, so no consent banner is needed. Stripe's checkout pages set their own cookies, covered by Stripe's and Link's privacy policies.

Your rights

You can ask to access, correct, delete or export your personal data, or object to or restrict how we use it. Many of these you can do yourself in the dashboard: you can edit your profile, delete API keys, leave or delete teams, and delete your account. For anything else, email[email protected], and we'll answer within one month.

If you think we handle your data unlawfully, you can complain to the Spanish data protection authority, theAgencia Española de Protección de Datos, or to the authority where you live.

Children

Lanewise is a service for developers and businesses, and isn't meant for anyone under 16.

Changes to this policy

If we make material changes, we'll email account owners before they take effect. The date at the top shows the latest version.