1. Scope and controller
Digital Journey LLC operates Lasso and is responsible for the personal information described in this policy. This policy covers the hosted Lasso website, dashboard, API-key and payment flows, JSON-RPC service, and support interactions. It does not govern independent blockchain networks, RPC providers, or third-party sites.
2. Information we collect
- Identity and account data: identifiers, name, email address, authentication method, and session information supplied through WorkOS.
- Configuration and credential data: API-key records, profile settings, provider endpoints and encrypted provider credentials, chain and routing selections, and administrative changes.
- Usage and operational data: request method, chain, strategy, provider choice, timing, response class, circuit and failover events, block-height observations, compute-unit usage, region, service logs, and diagnostics. Lasso may retain bounded or digested request attributes for observability and does not need full JSON-RPC parameters for ordinary routing metrics.
- Billing data: plan, entitlement, usage, transaction, and customer-portal references. Stripe or another displayed payment service processes payment credentials; Lasso does not intentionally store full card numbers.
- Device and communications data: IP address, browser and device metadata, cookies, security events, and information you send to support.
3. How we use information
We use information to:
- authenticate users and secure accounts and API keys;
- route requests, operate profiles, meter usage, and provide dashboards;
- bill for service and maintain account and transaction records;
- detect abuse, investigate incidents, debug failures, and improve reliability;
- respond to support requests and send service-related communications; and
- comply with law and enforce service terms.
4. Service providers and disclosures
We disclose information as needed to providers that support Lasso, including WorkOS for identity, Stripe and displayed payment networks for billing, Fly.io for hosting, Sentry for error monitoring, uptime-monitoring services, and the RPC providers selected for a request. A Custom profile sends RPC traffic to the provider endpoints you configure. We may also disclose information to comply with law, protect rights or security, investigate abuse, or complete a merger, financing, acquisition, or asset transfer. We do not disclose personal information to data brokers.
5. Cookies and sessions
Lasso and WorkOS use cookies and similar browser storage for authentication, security, return paths, interface state, and essential service operation. Lasso's authenticated browser session is encrypted, marked Secure in production, and subject to an application-enforced absolute lifetime. We do not currently describe an advertising-cookie program.
6. Retention
We retain information for as long as reasonably needed to provide and secure Lasso, maintain billing and audit records, resolve disputes, and comply with legal obligations. Retention differs by data type: live routing state and detailed diagnostics may be short-lived, while account, entitlement, billing, security, and legally required records may remain longer. Backups and logs may persist for a limited period after deletion.
7. Security
We use administrative and technical safeguards intended to protect information, including encrypted production sessions, scoped API-key handling, and encryption for stored provider credentials. No system is completely secure. You are responsible for protecting account, API-key, wallet, and upstream-provider credentials and for rotating them if exposure is suspected.
8. Your choices and requests
You may update available account and profile information through Lasso and may rotate or delete API keys using the provided controls. To request access, correction, or deletion of personal information, contact support@lasso.sh. We may need to verify your identity and may retain information when required for security, billing, legal compliance, or dispute resolution. Rights vary by location.
9. Children and international processing
Lasso is a developer infrastructure service and is not directed to children under 13. Information may be processed in the United States and other locations where Lasso or its service providers operate, which may have different data-protection laws than your location.
10. Changes and contact
We may update this policy by posting a revised effective date and will provide additional notice for material changes when reasonably practical. Questions and privacy requests may be sent to support@lasso.sh.