In short. We keep what is needed to run your account and your work, and nothing for advertising. Your AI requests go to OpenRouter and the model that answers them, and on the free tier that model's company may keep them. Our server is in India. You can download everything or delete your account yourself, from Settings. We do not sell your data or use it to train AI.
Who we are
Wartens Ltd is the controller of the personal data described here, unless this policy says otherwise. We are a company registered in England and Wales with company number 15262249, and our registered office is 8 Lyon Road, Milton Keynes, England, MK1 1EX. Email hello@ladx.ai about anything in this policy. We are not required to appoint a data protection officer and have not done so.
Where a business uses LADX and puts other people's personal data into it, such as client contacts, that business is the controller of that data and we process it on its behalf. Section 7 of the Terms of Service sets out our commitments as its processor.
What we hold and why
The lawful bases are those of the UK GDPR and the EU GDPR. "Contract" means we need the data to provide LADX to you. "Legitimate interests" means we have a genuine reason that we have weighed against your interests, and you can object (see "Your right to object").
| What | Examples | Why | Lawful basis |
|---|---|---|---|
| Account | Name, email address, a hash of your password, when you joined | To run your account and sign you in | Contract |
| Sign-in and security | Session identifiers, single-use sign-in and reset links (stored as hashes), failed sign-in records, your IP address in our rate limiter | To keep accounts secure and stop abuse | Legitimate interests (security) |
| Your work | Projects, ladder programs and their history, documents, test runs, HMI screens, drawings, uploaded files, client and site details you enter, your company profile | To store and process your work, which is the service | Contract |
| AI use | Your messages, the project context sent with them, the answers, generated code you accept, things you ask LADX AI to remember, which model was used | To answer you, and to keep the conversation and code history you can return to | Contract |
| AI provider keys | Keys you connect, encrypted with AES-256-GCM, plus a masked preview | To run LADX AI on your own provider account | Contract |
| Forum and sharing | Your display name and posts; chats and documents you choose to share | To publish what you decide to make public, and to let you share work | Contract |
| Team workspaces | Your name, email and role, and invitations you send | To let teams work together | Contract |
| Audit trail | What happened and when: sign-ins, projects created, code generated or accepted, documents approved. It records facts about actions, not their content | Security, keeping an accurate record of what LADX generated and what was accepted, and establishing or defending legal claims | Legitimate interests |
| Messages to us | Name, email and message from the contact form, reports of content, complaints | To answer you and to handle reports and complaints | Legitimate interests; legal obligation for online safety reports |
| Desktop licences | Licence key (stored as a hash), email, the name the licence is issued to, a fingerprint of the computer, activation dates and version | To issue and check desktop licences | Contract |
| Server logs | IP address, the page or file requested, time, browser type | To keep the service running and secure | Legitimate interests (security) |
| Page counts | How many times each page was read each day, and which sites sent visitors | To understand which pages are useful | Not personal data: no cookie, address or visitor id is kept |
Giving us your name and email is necessary to create an account. Everything else you choose to provide. We do not make decisions about you by automated means that have legal or similarly significant effects.
Where your data goes
We use a small number of service providers. Each one is listed, with what it does and where, on our service providers page.
- Hosting. LADX runs on a server rented from Hostinger International Ltd, in its data centre in Mumbai, India. Your account, your work, the audit trail and our backups are stored there.
- Email. Account emails, such as sign-in links and password resets, are sent through Resend (United States). Messages you send us arrive in a mailbox hosted by Namecheap (United States).
- AI. When you use LADX AI, your message and the project context needed to answer it are sent to OpenRouter (United States), which passes them to the company that runs the chosen model. OpenRouter says it does not log the content of prompts and answers by default.
- Free models. Without a key of your own, LADX AI uses free models through LADX's shared OpenRouter account. Which company runs a free model changes over time, may be in any country, and some of these companies keep prompts and answers and use them to train their models, under their own terms. For that use they are controllers in their own right. Do not send personal data or confidential information to the free tier. Connect your own key for anything sensitive.
- Your own key. If you connect your own provider key, your requests go to that provider under your own account and settings with it.
- Other people. Forum posts and your display name are public. Anyone with a share link can read what you shared until you stop sharing it or the link expires. Members of your team workspace see each other's names, emails and work.
- When the law requires it. We disclose data to the police, regulators or courts when the law requires us to, to protect someone's life or safety, or to establish or defend legal claims. We report child sexual abuse material to the National Crime Agency.
- If LADX changes hands. If another organisation takes over LADX, your data would transfer to it, and this policy would continue to protect it.
We never sell your personal data, share it for advertising, or use it to train AI models.
International transfers
Our server is in India, and some of our providers are in the United States. Neither country has a UK or EU adequacy decision for these transfers in general. Where data leaves the UK or the European Economic Area, we rely on the safeguards recognised by law: Hostinger's data processing agreement incorporates the EU Standard Contractual Clauses with the UK Addendum, and for US providers we rely on standard contractual clauses or on the UK Extension to the EU-US Data Privacy Framework where the provider is certified. OpenRouter's privacy policy says it relies on adequacy decisions and standard contractual clauses. You can ask us for a copy of the safeguards that apply.
How long we keep it
| What | How long |
|---|---|
| Your account and your work | Until you delete it, or delete your account |
| Sessions | 30 days, or until you sign out |
| Sign-in and password reset links | Usable for 15 and 60 minutes; the records go with your account |
| Forum posts | Until you delete them or your account |
| Shared links | Until you stop sharing or the link expires (30 days by default for documents) |
| Audit trail | Six years from each event. If you delete your account, your email address is replaced in it by a code that cannot be turned back into the address |
| Messages, reports and complaints to us | Two years after the matter is closed |
| Desktop licence records | For the life of the licence and six years after |
| Server access logs | 14 days |
| Application logs | 30 days |
| IP addresses in the rate limiter | In memory only, for up to one hour |
| Backups | Daily backups for 14 days, weekly backups for 8 weeks |
When you delete your account, everything in it is removed from the live system at once. It disappears from backups as they expire, within eight weeks, and we do not restore deleted accounts from backups.
Cookies and browser storage
LADX sets one cookie, to keep you signed in, and keeps your settings in your browser. Your work in the free tools is kept in your browser only if you allow it. There are no advertising or analytics cookies, and no third party can follow you across other sites through LADX. The cookie page names every item and lets you change your choices at any time.
Because nothing on LADX tracks you across sites, there is nothing for a browser's Do Not Track or Global Privacy Control signal to switch off. We treat both as you would expect: nothing that tracks you is ever turned on.
Videos
Some articles include YouTube videos. LADX uses YouTube API Services to play them. Nothing is loaded from YouTube until you press play. When you do, the video plays in YouTube's privacy-enhanced player: Google receives your IP address and the page you were on, and YouTube may store and read information on your device. Google is responsible for that data, under the Google Privacy Policy, and playing a video means agreeing to the YouTube Terms of Service.
The desktop application
The LADX desktop application runs on your own computer and does not send your projects, prompts or usage to us. It makes one network call, when you activate your licence, which sends the licence key, a fingerprint of the computer and the application version to our licence service. Its AI features run on a local model on your computer.
Your rights
Under UK and EU data protection law you have the right to:
- access the personal data we hold about you, and receive a copy;
- correct it if it is wrong or incomplete;
- delete it;
- restrict how we use it while a concern is being looked at;
- take it with you in a machine-readable form;
- object to how we use it, as explained below;
- withdraw consent at any time, where we rely on consent, such as for browser storage of your work.
Two of these you can do yourself, straight away, from Settings, Your data in LADX Studio: download everything your account holds as one file, and delete your account and its data. For anything else, email us. We may ask you to confirm your identity, and we answer within one month.
Your right to object
Where we rely on legitimate interests, you can object at any time, and we will stop unless we have compelling reasons that override your interests, or need the data to establish or defend legal claims.
Complaints
If you are unhappy with how we have handled your personal data, complain to us first, by email or through the contact form. We acknowledge every data protection complaint within 30 days, look into it, keep you informed and tell you the outcome without undue delay. You can also complain to the UK regulator, the Information Commission (still known as the ICO), at ico.org.uk. If you live in the European Union, you can complain to the data protection authority in your own country.
If you are in India
You have the rights given by the Digital Personal Data Protection Act 2023, including to access, correct and erase your data and to have a grievance addressed. Contact us at the email address above; we will answer grievances within 30 days, and you may then take a complaint to the Data Protection Board of India.
If you are in California
You can review and correct the personal information in your account from Settings, or by asking us. We do not sell or share personal information, and nothing on LADX lets other companies track you across sites.
Children
LADX is for people aged 18 and over, and is not designed for or marketed to children. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, tell us and we will delete it.
Security
Passwords are stored only as bcrypt hashes and provider keys are encrypted. Sessions use random identifiers in a cookie that page scripts cannot read. All traffic is encrypted in transit, sensitive actions are rate limited, and significant actions are written to the audit trail. If a breach puts your data at risk, we will tell the regulator within 72 hours where the law requires it, and tell you without undue delay where it is likely to put you at high risk. The security page explains how to report a vulnerability.
Changes to this policy
If we change this policy in a way that matters, we will tell account holders by email or with a notice in LADX before the change takes effect. The date at the top shows when it last changed.