This policy explains what information Lore collects, why, and what happens to it. By using Lore you agree to this policy.
1. What we collect
Depending on how you use Lore, we process:
- Account information - your name, email address and profile picture from your sign-in provider (for example Google). We use it to identify you and manage your organisation membership.
- Uploaded and pasted content - documents, reports, IOC lists, process trees, URLs and raw text you submit for analysis. You keep ownership of your content.
- Generated analysis - the entities, claims, provenance records, hypotheses and hunting queries Lore derives from your content, and from public threat-intelligence sources.
- Usage records - timestamps of AI analyses and collection runs, used to enforce daily limits.
- Technical data - server logs and error reports needed to operate and secure the service.
2. Public vs. private investigations
You choose the visibility of every investigation. Private investigations are visible only to their creator. Public investigations can be viewed by anyone, including visitors who are not signed in. Nothing else from your account - your company, your other investigations, your uploaded files - is public. When you sign in, you also see the Global Intel Library: research collected automatically from public vendor blogs, CERT advisories and government sources.
3. AI processing
Deep analysis is performed by third-party AI models. Content you submit for analysis - and excerpts of it used to ground findings - is processed by those providers to produce the result. Do not submit content you are not permitted to send to a cloud service.
4. Storage and retention
Investigations, organisations, membership records and the global intelligence archive are stored in Lore's cloud database. We keep your data while your account is active. If you want your data deleted, contact us and we will remove your account data; public investigations you created may be retained or anonymised.
5. Sharing
We do not sell your information. We share it only with: the service providers that operate Lore (hosting, database, authentication, AI models), and - for public investigations - with anyone who visits the site. Your colleagues in your organisation can see your organisation's name and member list.
6. Your rights
You can view and update your profile, leave an organisation, and request deletion of your account and private data. Depending on your jurisdiction (for example under the GDPR) you may also have rights of access, correction, portability and objection.
7. Security
Access to private data is enforced in the database with row-level security: private investigations are visible only to their creator, and organisation data only to its members. We apply least-privilege access throughout the backend.
8. Cookies and local storage
Lore uses browser storage only to keep you signed in and to remember interface choices. We do not use advertising or cross-site tracking cookies.
9. Contact
Questions about this policy or requests regarding your data: contact us through the application or at the address published on this site.