--- title: "Privacy policy - Lentil" description: "What data Lentil collects, why, who processes it, how Google user data is handled, and how to have your data deleted." url: https://uselentil.com/privacy updated: 2026-10-12 site: "Lentil" --- Legal # Privacy policy Last updated October 11, 2026 Lentil builds and hosts websites for local businesses. It is operated by Purplecones, LLC ("we", "us"). This policy explains what we collect when you use Lentil, the websites we host for our customers, and this site, and what we do with it. Questions: [hello@uselentil.com](mailto:hello@uselentil.com). ## Google user data, in brief - Signing in with Google gives us only your name, email address and profile picture. - Connected features read only what you connect: Search Console and, where available, Business Profile. - Shown to you and used on your instructions only, under Google's Limited Use rules. Never sold, never used for ads or AI training. - Connection tokens are encrypted. Unlink or disconnect and the imported data is deleted. ## Information we collect **Your account.** Your name and email address, the workspaces and sites you belong to and your role in them. You sign in with a one-time link sent to your email, or with your Google account. If you use Google, we receive your name, email address and profile picture from Google and store the tokens Google issues for sign-in. For each sign-in we keep a session record with its expiry, your IP address and browser user agent, to keep you signed in and to protect your account. **Your content.** The text, images, settings and business details you add to your sites, the version history of your pages, and your conversations with the AI editor. If you ask us to import an existing website, we fetch its public pages and files and respect its robots.txt. **Connected AI assistants.** If you connect an AI assistant (such as Claude) to your account, we store the connection: the assistant's name, your account, and the access it was granted. You can see and revoke connections in your profile. **Billing.** When you pay, our payment processor Stripe collects your card details; we never see or store them. We keep your plan, subscription status and AI credit balance. Stripe keeps your invoices and the workspace name and owner email we share with it. **Usage.** We record each use of the AI features (which feature, which model, token counts and cost) to run plan limits and credits, and key product milestones (such as creating or publishing a site) to understand how Lentil is used. **Support.** If you ask for help, our staff may view your workspace or act in it as you to fix the problem. Every such support session is logged. ## Google user data Signing in with Google, described above, gives us only your name, email address and profile picture. Connecting a Google account to your sites is separate and optional. If you connect one, you choose which permissions to grant, and we use them only for the features below. - **Search Console** (`webmasters`, `siteverification.verify_only`): we verify that you own your site's address, add it to your Search Console, and read its clicks, impressions, click-through rate, position, top searches and top pages to show them to you. - **Business Profile** (`business.manage`), where available: we read your locations, business information, performance insights and reviews to show them to you, and post a reply to a review only after you approve the exact text. - **Your Google account** (`openid`, `email`): we store your Google account ID and email to show which account is connected. We encrypt the refresh token for these connected features. Business Profile reviews and insights are kept for at most 30 days and refreshed daily. Search Console data is kept while the site stays linked. When you unlink a site, we delete its Google data; when you disconnect your Google account, we delete the data of every site linked through it and revoke our access at Google, unless another of your workspaces still uses that Google account. You can also remove our access at any time from your Google account's security settings. If you ask the AI to draft a review reply, the review text and the reviewer's name are sent to our AI provider to write the draft; this request is not kept in our AI request logs. We do not sell Google user data, use it for advertising, or use it to train AI models, and we do not let anyone read it except to provide these features, for security, or where the law requires. Lentil's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. ## Visitors to websites we host For the sites we host for our customers, we act on the customer's behalf. - **Analytics** are cookieless. We count page views with the page and site address, referring site, campaign tags (`utm_source`, `utm_medium`, `utm_campaign` and `ref`), device type and browser, and the approximate location our hosting provider derives from the connection: country, region, city, US metro area and approximate coordinates. To count unique visitors without tracking anyone, we use a one-way hash of the IP address and user agent that changes every day; we do not store the IP address. If the visitor's browser sends Global Privacy Control or Do Not Track, we skip the hash, the city and the coordinates. We also record page speed measurements without any visitor identifier. - **Contact forms** send what the visitor enters to the business by email, and we store the submission (with the page address, browser user agent and referrer) for the business until it deletes it or the site is deleted. We use the IP address only to stop spam and do not store it. Forms use Cloudflare Turnstile to block bots. - **Online stores.** If a business connects a Shopify store, its site loads Shopify's storefront scripts and keeps the visitor's cart in the browser; Shopify handles checkout under its own privacy policy. - **Fonts** are served from our own hosting, so visitors do not contact a font provider. A business may add its own scripts or third-party tools to its site; their privacy practices are the business's responsibility. ## Businesses we contact We sometimes build a sample website for a local business that is not yet a customer, and offer it by mail. To do that we use only public information about the business: its name, website, mailing address, phone number and any email address published on its website. We build the sample from the business's public website (respecting its robots.txt) and send a postcard with a private link through our print and mail provider, PostGrid, which receives the business name and mailing address. When the link is opened we record the time, device type and approximate location (city, region, country), so we know whether the offer was seen. Sample sites that are not claimed are deleted 30 days after the offer expires. To stop receiving our mail, use the form at [app.uselentil.com/no-mail](https://app.uselentil.com/no-mail) or email us; we keep the business name and address on a do-not-mail list so that we can honor the request. ## How we use information To provide and secure Lentil: build, edit and host your sites, send the emails you expect (sign-in links, invitations, form submissions, site and domain updates, alerts), process payments, prevent abuse, support you when you ask, and understand which of our channels bring new customers. We do not sell personal information and we do not use it for advertising. ## Service providers We share information only with providers that run Lentil for us, under their data processing terms: - **Cloudflare**: hosting, database, file storage, email delivery, bot protection, request logs, and the gateway that routes our AI requests. The AI gateway keeps a log of requests and responses so we can monitor and debug the AI features. - **Anthropic and OpenAI**: the AI that writes and edits pages, imports sites, creates images and drafts replies. They process the content you send to the AI features; under their API terms they do not use it to train their models. - **Stripe**: payments and invoices. - **Google**: sign-in with Google and the Google features above, if you use them. This marketing site loads its fonts from Google Fonts, which receives your IP address and browser details. - **PostGrid**: printing and mailing postcards, as described above. - **Shopify**: online stores, only for businesses that connect one. We may disclose information if the law requires it, or to a successor if Purplecones, LLC is involved in a merger or acquisition. ## Cookies The Lentil app uses only essential cookies: one keeps you signed in, and short-lived ones protect signing in with Google, claiming a site from a link we sent you, previewing unpublished sites, and approving an AI assistant's connection to your account. It stores display preferences (such as dark mode) in your browser. We use no advertising cookies and no third-party tracking. This site and the app set one first-party attribution cookie when you first visit, unless your browser sends Global Privacy Control or Do Not Track. It records how you found us (the campaign tags and referring site of your first visit, the page you landed on, when, and the last sign-up button you clicked) for 90 days, so that if you create an account we know which of our channels brought you. We store those details with your account; we do not use them for advertising or share them. ## Retention and deletion We keep your account and content while you use Lentil. When you delete a site, we delete its pages, files, form submissions and Google data; its visitor analytics are kept for up to three months, like all visitor analytics. Sign-in sessions expire after 30 days without use. To delete your account or workspace, or to get a copy of your data, email [hello@uselentil.com](mailto:hello@uselentil.com) from the address on your account and we will do it within 30 days. After deletion we keep billing and AI usage records for as long as accounting and tax law require, records of support sessions for security, and how you found us as part of our sign-up statistics. ## Your rights Depending on where you live, you may have the right to access, correct, export or delete your personal information, and to object to how we use it. Email [hello@uselentil.com](mailto:hello@uselentil.com) and we will respond within 30 days. If you are a visitor to a site we host, please contact that business first; we will help them respond. ## Security Data is encrypted in transit and at rest by our hosting provider, and we additionally encrypt the tokens for connected Google features. Access to customer data is limited to staff who need it to run and support Lentil, and support access is logged. ## Children Lentil is for businesses and is not directed at children under 16. ## Changes If we change this policy we will update the date above, and tell account holders by email about significant changes. ## Contact Purplecones, LLC, [hello@uselentil.com](mailto:hello@uselentil.com).