LSSM ID Privacy Notice

Who is responsible

CHAMAN VENTURES, SASU, operates LSSM ID and is responsible for the personal data described in this notice. RCS Paris · SIREN 989 498 902. Registered address: 229 rue Saint-Honoré, 75001 Paris, France.

Contact legal@lssm.co for privacy requests and support@lssm.co for account help. This notice covers the central identity service at id.lssm.co. Separate products and organizations explain their own processing in their applicable notices.

The information an account uses

• Account details you provide, such as your name, email address, profile image and language; whether your email is verified; and the identifiers of accounts you explicitly link.
• Authentication data: password hashes, authenticator settings, recovery-code verification records, passkey public keys, and the information needed to verify one-time codes and sign-in links. LSSM ID does not receive passkey private keys or device biometrics.
• Session, device and security information, such as session identifiers, sign-in times, browser or device information, IP addresses, and records of security events and account-management actions.
• Organization and team memberships, roles and invitations; application permissions; and the scope, expiry and revocation status of API keys and agent grants you create or approve.

We use temporary verification records while you complete registration or prove control of an email address. Receiving a verification message does not by itself create product access.

Signing in with another platform

If you choose a social sign-in provider, it sends the identity information covered by its consent screen, typically a provider-specific identifier, name, profile image and email address when available. We use that information to authenticate you and maintain the account you choose to link. We do not receive the password you use with that provider.

Google sign-in requests basic identity permissions: OpenID, profile and email. Signing in with Google does not authorize access to Gmail or Calendar. The same separation applies between other social logins and their platform connections. Missing or unverified email information can require a separate email-verification step. Within LSSM ID, social sign-in and platform connections remain separate. Some providers require more broadly named permissions for their identity flow; review the provider's authorization screen. Those permissions do not by themselves establish an LSSM platform-data connection.

Connections are a separate choice

A connected-platform feature has its own authorization flow. The requested scopes and selected resources explain its access. Depending on the enabled connection, this can include mail metadata and calendar events; repositories and issues; shared pages; workspace, channel or team metadata; selected projects and deployment status; profile, creator-video or timeline information; or separately authorized advertising and merchant reports.

We process connected data to provide the feature you request. We store the authorization credentials and resource or scope references needed to maintain that connection, including refresh credentials when the provider issues them. We protect stored credentials and do not display them as ordinary profile information. Provider availability, account requirements and approvals vary.

A login, a browser session, an API key and an agent grant do not automatically grant each other's permissions. Read access does not authorize publishing, payment or deployment actions. Any available action requires its own permitted scope and applicable approval.

Why we use this information

We process the information necessary to provide the account and features you request, authenticate you, deliver verification and security messages, manage permissions and respond to support requests. Providing a requested service relies on performance of the relevant contract. We also use necessary security and operational records to prevent abuse, investigate incidents and protect the service and its users, based on our legitimate interests.

We rely on consent where we specifically ask for it, including optional processing that requires consent. We also process information when necessary to meet a legal obligation. An authorization to access a platform is limited to the feature and permissions shown to you; it is not permission for unrelated uses.

We do not sell personal data or use identity or connected-platform data for targeted advertising. We do not use data obtained through Google APIs to train general-purpose AI models. Google API data is used for the user-facing feature you authorize, in accordance with the Google API Services User Data Policy, including its Limited Use requirements.

Who receives information

An application you authorize receives the identity information covered by its approved scopes and the authorization you give. Its local permissions still determine your product access. Organization administrators can manage the memberships, invitations and roles for their organization; that role does not automatically give access to your private platform connections.

An application or agent can receive connected-platform information only through the separately authorized feature, resources and permissions that cover that information. A basic sign-in or profile grant does not expose it. LSSM ID does not send connected-platform data to a model provider to perform sign-in; separately enabled products explain any additional data uses and recipients in their own authorization flow and notice.

Authorized support and security personnel may process information needed for account administration or incident handling. Where temporary support access in the context of a user account is enabled, it is access-controlled and recorded in audit logs. Other people do not receive your information merely because they also use LSSM ID.

Our infrastructure providers process data for their service functions: Vercel for hosting, Supabase for the identity database, Resend for transactional email, and Cloudflare Turnstile for abuse protection. Your selected sign-in and connected-platform providers also process information under their own notices.

We may disclose information when required by law or when necessary to protect rights and investigate abuse, subject to applicable safeguards.

International processing and safeguards

Our current infrastructure includes identity-request processing in the United States through Vercel and an identity database project hosted in Paris, France through Supabase. Delivery, security, support and provider control-plane services can also process information outside the European Economic Area, including in the United States. Regional database hosting is not a promise that every operation stays in the EEA.

For restricted transfers not covered by an applicable adequacy decision, the relevant provider processing agreements incorporate the European Commission’s Standard Contractual Clauses. Their published agreements describe these safeguards: Vercel, Supabase, Resend and Cloudflare. You can request information or a copy of the safeguards applying to your data at legal@lssm.co.

Cookies, browser storage and security

Necessary cookies and browser storage support sign-in, session and account selection, verification, security challenges and language preferences. Blocking necessary cookies can prevent these features from working. Cloudflare Turnstile processes technical information to assess abusive requests.

The central LSSM ID pages do not initialize product analytics or advertising trackers. Necessary operational and security records described in this notice remain in use. Other websites and products explain their own analytics and consent controls in their applicable notices.

We use access controls and technical protections appropriate to the information, including encrypted transport and protection of stored authorization credentials. No online service can promise absolute security. Report a suspected account compromise to security@lssm.co.

Retention, disconnecting and closing an account

Profile and account details are used until you change or remove them or the account-closure process completes. Verification challenges stop authorizing access when used or when their stated validity ends; session and credential expiry also stop their use. On a successful local disconnection, the stored platform credential is removed from the connection vault. These access-expiry events do not imply immediate erasure of every related security record.

You can revoke an API key or agent grant, remove a browser session, or disconnect a platform through the available account controls. Disconnecting stops the local connection from being used. Some providers require an additional step in their own account or workspace settings to revoke the underlying authorization. We distinguish that provider-side step from local disconnection.

Closing an account invalidates its access credentials and removes or replaces profile information as part of the closure process. Limited audit references and information needed for the purposes above can remain. Backups and records already lawfully held by a separate product or organization follow their own applicable lifecycle. Closing a central identity is not a promise that every separate product copy disappears immediately. Contact legal@lssm.co for a request concerning your circumstances.

Central database backups can contain earlier account records until their configured recovery cycle expires. Separately created, encrypted migration or incident-recovery archives are retained for their documented recovery purpose and reviewed when that case or rollout closes. Such archives are not reused as active accounts. Limited administration, revocation and audit references may remain to document the affected organization, investigation, dispute or legal obligation; this does not authorize keeping the former live profile or usable credentials. Contact legal@lssm.co for the retention criteria and recovery records applying to your request.

Your choices and rights

You can review available account details, permissions, sessions, keys, agents and connections in LSSM ID. You may also contact legal@lssm.co to request access, correction, deletion, restriction or portability of your personal data, to object to relevant processing, or to withdraw consent where processing relies on it. These rights are subject to the conditions and exceptions in applicable law. Withdrawing consent does not change the lawfulness of earlier processing.

We may need to verify your identity before acting on a request. You can complain to a competent data-protection authority, including the CNIL in France: CNIL.

We update this notice when the service or its processing changes. Material changes are communicated through an appropriate service or account notice; additional permission is requested before accessing new platform data for a different purpose.