LATO procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Administrative access: LATO personnel can access customer workspaces only for support and study operations, and every such access is recorded in an immutable audit log.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Respond to support requests; access customer workspaces for support and study operations (every access is recorded in an immutable audit log) ” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Our servers and database are hosted in the European Union. Where data is transferred to providers in the United States, including our AI providers, the transfer takes place under Standard Contractual Clauses included in the provider’s data processing agreement and, where the provider is certified, the EU-U.S. Data Privacy Framework. You can request a copy of the relevant safeguards by contacting legal@latolabs.io .” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ All connections are encrypted using HTTPS/TLS. Data at rest is encrypted with AES-256. Our database and backend are hosted in the European Union.” | Captured 2026-09-25Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ Complaint to your data protection authority.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You can withdraw your consent or request deletion of your interview data at any time by emailing legal@latolabs.io (see Section 7). Withdrawal does not affect processing that took place before you withdrew.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ For as long as the related interview content is retained, plus applicable limitation periods, as evidence of consent ” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You may stop using the Service and delete your account at any time.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ For the life of the related study and thereafter until deletion is requested ” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ While your account is active, or until it is deleted at your request ” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You can request full account deletion by contacting us.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ For conversation deletion beyond that, and for everything else, including full account deletion and deletion of interview or outreach data, email legal@latolabs.io . Deletion is performed manually by our team on request; we act without undue delay and confirm once deletion of our own copies is complete. Where an expert network, survey panel, or other sourcing partner or subprocessor (see Section 8) holds its own copy of your data under its own terms, we will also forward your deletion request to that party. Deletion does not undo delivery of a finished study to the customer that sponsored it.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ How long: if you do not take part in a study, we delete your data 12 months after our last contact with you, or earlier if you object.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You can delete study and analysis chats directly in the product, which removes the chat and its messages, and archive other conversations from your workspace view.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You can delete your conversations at any time.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Deletion: you may request that we delete personal data about you that we maintain, subject to certain exceptions under applicable law.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Upon termination, your right to use the Service ends immediately. We will delete your data in accordance with our Privacy Policy .” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ You can request deletion of your data at any time by emailing legal@latolabs.io . Deletion is carried out by our team on request.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ Sandboxed code execution and agent workspaces: code and files an agent processes during a task. Sandboxes are destroyed after use; workspaces are archived after inactivity and deleted with the agent.” | Captured 2026-09-25Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ 12 months after last contact if you do not take part in a study, or earlier if you object ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of LATO’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by LATO is among the assets transferred.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Direct outreach: we contact you via LinkedIn or email (see Section 5), and pay your incentive through our payment provider, which needs your name, email, and payout details.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Service providers: the subprocessors described in Section 8, solely to operate the LATO service; they are bound by contractual obligations to keep personal data confidential and use it only for the purposes for which we disclose it to them.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ With the sponsoring customer’s affiliates, co-investors, financing sources, and other professional advisers where you have separately consented to this and only for the categories of information you agreed to share, as described on the consent screen.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Connected integrations: if you connect Gmail, Microsoft 365, Slack, Affinity, Harmonic, or Granola, we access and process data from those accounts on your behalf and only within the scope you authorize. You can disconnect an integration at any time.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ All service providers acting on our behalf are bound by data processing agreements.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Application monitoring (EU): error logs and performance traces.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Expert networks: the network invites you, compensates you under its own terms, and invoices LATO. The network shares your candidate profile with us to run the interview.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Recruiting partners. Participant data is exchanged with the expert networks and survey panels described in Section 4 to run interviews and handle compensation. These partners act under their own terms for the compensation they provide.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ From business partners and service providers. We may receive personal data about you from other sources and combine that with information we collect directly from you. For example, we may obtain information about you from service providers that we engage to perform services on our behalf, such as email platform providers, payment processors, promotions services, analytics, security and anti-fraud services.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ OAuth sign-in and integration authorization (Google, Microsoft): authentication tokens and basic profile data.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Participant incentive payouts (United States): payee name, email, and payout amount for direct-outreach participants.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Pay incentives to direct-outreach participants through our payment provider ” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Survey panels (third-party survey panel providers): the panel redirects you to our interview and handles your compensation under its own terms.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ With sponsoring customers: interview content (quotes, transcripts, recordings, and your professional title and employer, but not participant identities) is delivered to the customer sponsoring the study, as described in Section 4; your professional title and employer are included where the recruiting channel’s terms and your consent permit it, and withheld where they do not; whether your name is also included depends on your recruiting channel and the consent you personally gave, as described in Section 4.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ AI voice interview infrastructure: interview audio and transcripts, processed and retained under the provider’s own terms.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Before contacting potential interview participants, we collect professional profile data from public sources and partners: LinkedIn profile data (name, title, profile URL), candidate profiles provided by expert networks, and enrichment data (such as role, company, and contact details) obtained through Clay. We also keep records of who was screened and contacted. Section 5 explains this in detail.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The Service integrates with third-party providers (including Microsoft and Anthropic) to function. Your use of the Service is also subject to Microsoft’s terms for Office Add-ins. We are not responsible for the availability or performance of third-party services.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We share data with the following categories of service providers, solely to operate the LATO service:” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Legal: where required by law or legal process, including to respond to any government or regulatory request, to protect the rights, property, and safety of our users or third parties.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Database, authentication, and file storage (EU): account data, workspace content, and interview data. We control deletion.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The voice interview runs on infrastructure operated by a third-party voice-AI infrastructure provider, which processes the interview audio and transcripts and retains them under its own terms. Recording takes place on LATO’s own platform for every interview, regardless of recruiting channel, and audio does not reach the network or panel that referred you. Separately, LATO stores its own copy of the recording, the full transcript, the AI-generated summary and analysis, your screener answers, and your short bio.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Customer-connected integrations. In addition, data flows to and from services that you or your organization choose to connect: Gmail, Microsoft 365, Slack, Affinity, Harmonic, and Granola. We process data from those accounts on your instructions, within the scope you authorize.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Enterprise SSO and directory provisioning: authentication and directory data, where your organization uses SSO.” | Captured 2026-09-25Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ The current list of these providers by name, with the data each receives, where it processes it, how long it retains it, and its security attestations, is published at latolabs.io/security/subprocessors . We update that page at least 30 days before adding or replacing a provider.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Support is available at support@latolabs.io . Enterprise plans may include additional support commitments.” | Captured 2026-09-25Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ Paid subscriptions are billed monthly in advance. All fees are in US dollars.” | Captured 2026-09-25Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.