Privacy notice
Version 2026-10-20.1. In effect from 20 October 2026.
This notice explains what personal data Lodestar handles, why, where it is kept and for how long, and the rights you have. Lodestar handles two kinds of data, and our role is different for each:
- Account data: details of the people who use the Lodestar console and of the organisations that pay for it. We decide how this is used, so we are its controller.
- Device data: what the Lodestar agents report about the devices (computers) they are installed on. The organisation that installed Lodestar decides how this is used. It is the controller, and we are its processor.
If Lodestar is installed on a device you use for work, your employer or its IT provider put it there. Ask them first about your device data. They can reach us if they need our help.
1. Who we are
Lodestar is run by Panoptic Technology Limited, trading as Panoptic IT Solutions, a company registered in Ireland with number 596017, at Unit 7, Office Block C, Newpark Shopping Centre, Kilkenny, R95 EYX7.
For anything about personal data, contact us at [email protected].
2. Account data (we are the controller)
| What | Why | Lawful basis |
|---|---|---|
| Name, email address and profile picture of each console user, from Kinde when they sign in. The time each user was last active. | To let people sign in, and to show who did what. | Contract |
| Sign-in details, such as passwords and one-time codes. Kinde handles these; Lodestar never sees passwords. | To sign people in securely. | Contract |
| The organisation's name and type (MSP or a business with its own devices), and when its terms were accepted, by whom and which version. | To set up the organisation and keep a record of what it agreed to. | Contract |
| Billing details: billing email address, organisation name, billing address, VAT number and payment method (card details, or bank account details and the SEPA Direct Debit mandate). Stripe collects and holds these; we keep only Stripe's reference numbers and the subscription's status. | To take payment and issue invoices. | Contract, and our legal obligation to keep tax records |
| The audit log: who changed what in the console and when, including everything Panoptic support does there. | So each organisation can see who changed its console. | Legitimate interests (security and accountability) |
| Operations logs and traces: the page or API called, the result, how long it took, and internal identifiers for the organisation and device. They exclude email addresses, device names and report contents. | To keep Lodestar running and to find faults. | Legitimate interests (running a reliable service) |
| IP addresses of browsers and agents connecting to Lodestar. We count requests per IP address to stop abuse. | To protect Lodestar from attack and misuse. | Legitimate interests (security) |
Cookies
The console uses only the cookies it needs to work: sign-in cookies set by Kinde, one that remembers whether you collapsed the sidebar and, for Panoptic support staff, one that keeps a support session open. Your browser also remembers whether you switched sounds on. Cloudflare, which protects Lodestar, may set a cookie needed for security. There are no analytics or advertising cookies.
3. Device data (we are the processor)
Agents report once a day, and whenever someone asks for a report from the console. Each report contains the following.
About the device
- its name, model and serial number
- a hardware identifier the operating system assigns to it, used to recognise the device if Lodestar is reinstalled
- its operating system and version, and the versions of the Lodestar agent and catalogue
- the names of the user accounts on it (the names of their home folders)
- when it last sent a report and last checked in
AI tools found on the device
For each AI tool found, the agent reports:
- its name and version
- where it was found: the file or folder path, which includes the user account's folder name, and the browser or editor and profile it was found in (a browser profile name can be a person's name)
- which user account it belongs to, or that it is installed for all users
- when it was last changed on disk, or for Mac apps, when the app was last opened according to macOS
- identifying details: an app's bundle ID or publisher, an extension's ID, or where a command-line tool links to
The agents look for:
- AI apps
- AI browser extensions, in Chrome, Edge, Brave, Arc, Dia, Vivaldi, Opera, Comet, Chromium, Firefox and Safari
- AI extensions for code editors, such as VS Code, Cursor and JetBrains IDEs
- AI command-line tools
- settings folders that AI tools leave in a user's home folder
- local AI models from Ollama, LM Studio and Hugging Face: how many there are, their total size, and the names of up to eight of them
- MCP servers set up in AI tools: the server's name, and either the program it runs or the host name it connects to. For Claude Code, also the name of the project folder the server is set up for.
Connections to AI services
The agent notes when an app on the device connects to an AI service in Lodestar's catalogue. On a Mac it reads the host name from the start of each connection; on Windows it reads the host names the device looks up. For each app and AI service it reports:
- the AI service's host name, such as api.openai.com
- the app's name and file path, and on a Mac its bundle ID
- when the connection was first and last seen, and how many times it happened
Connections to anything not in the catalogue are ignored and never recorded. The agent never blocks or changes a connection.
Signed-in AI accounts (off unless switched on)
Only if an admin switches this on, the agent also reports, for Claude Code, OpenAI Codex, Cursor and GitHub Copilot:
- the plan the tool is signed in with, such as free, personal, business or enterprise
- the domain of the account's email address (the part after the @), not the address
- whether the tool uses an API key, but never the key itself
When the setting is switched off, the console deletes these details at the device's next report.
What the console adds
The console keeps the latest report from each device in full. When the device sends a new report, the console reduces the previous one to when it was made, when it arrived, and how many AI tools and connections to AI services it listed. The console also builds a history of when tools appeared and disappeared, and keeps what the organisation's users record about tools: policies, dismissals and their notes, review decisions, approved accounts, and requests for a device to report or uninstall Lodestar.
What the agents never collect
- what people type into AI tools, their prompts or chats, or the AI tools' replies
- the contents of files, documents, emails or messages
- web pages, full web addresses or browsing history. On a Mac the agent reads only the host name at the start of a connection, and nothing after it.
- connections to anything not in Lodestar's AI catalogue
- passwords, API keys, access tokens or cookies
- the full email address of a signed-in AI account
- the arguments, environment variables or headers of MCP servers, which often hold secrets
- keystrokes, screenshots, screen recordings, location, camera or microphone
How we use device data
We process device data only to provide Lodestar to the organisation that installed it, and on its instructions. That includes counting active devices for billing. We do not sell device data or use it for advertising.
4. Sub-processors
We use these companies to run Lodestar.
| Company | What they do | Data they handle | Where |
|---|---|---|---|
| Hetzner Online GmbH | Hosts the console, its database, logs and backups | All account data and device data | Germany, for the servers and the backups |
| Cloudflare | Network edge: every connection to Lodestar passes through it, for encryption, attack protection and rate limiting | All traffic between browsers, agents and the console, including IP addresses | Cloudflare's global network, at the data centre nearest the user. Cloudflare, Inc. is in the United States. |
| Kinde Australia Pty Ltd | Sign-in and organisation membership | Names, email addresses and sign-in records of console users | Ireland, in Kinde's Europe region. Kinde is based in Australia. |
| Stripe Payments Europe, Limited | Payments and invoices | Billing details, and the number of active devices each month. No other device data. | Ireland. Stripe also processes data in the United States, through Stripe, LLC. |
Our logs and traces stay on our own servers at Hetzner; no monitoring company receives them.
Where a sub-processor handles personal data outside the European Economic Area, we rely on the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the EU Standard Contractual Clauses in our agreement with it.
5. How long we keep data
| Data | Kept for |
|---|---|
| AI tools currently on a device | As long as the device keeps reporting them |
| Tools that have been removed, connections to AI services, and the history of changes | 90 days after they were last seen, unless the organisation chooses 30, 180 or 365 days for a client |
| Signed-in AI account details | Until a report no longer includes them, or the setting is switched off |
| The latest report from each device, in full | Until the device sends its next report. If it never does, as long as the organisation has an account. |
| Earlier reports, reduced to when each was made and arrived and how many AI tools and connections it listed | As long as the organisation has an account |
| Devices, including retired ones | As long as the organisation has an account |
| Audit log | As long as the organisation has an account. No one can edit or delete it before then. |
| Request counts per IP address | 1 day |
| Operations logs | 30 days |
| Traces | 7 days |
| Account data and device data after a subscription ends | Deleted within 90 days after the subscription ends, or sooner if an admin asks us |
| Backups | About 5 weeks, then overwritten. Deleted data leaves the backups within that time. |
| Billing records | 6 years, as Irish tax law requires. Stripe holds them for us. |
6. How we protect data
- Lodestar is hosted in Germany, on Hetzner servers.
- Every connection between browsers, agents and the console is encrypted in transit.
- Each organisation's data is kept apart: every query is limited to one organisation, and the database enforces the same separation itself, as a second barrier.
- Agents prove who they are with a secret unique to each device. We store only a one-way hash of each secret and enrolment token, never the value.
- Backups are encrypted and kept in a second location.
- Panoptic support can open an organisation's console only with its admins' permission, and every action is logged.
7. Your rights
Under data protection law, you have the right to:
- get a copy of your personal data
- have it corrected if it is wrong
- have it deleted
- restrict or object to how it is used
- receive it in a format you can take elsewhere
For account data, contact us at [email protected]. We will reply within one month.
For device data, contact the organisation that installed Lodestar on your device. It decides how that data is used, and we will help it answer you. If you contact us instead, we will pass your request on to it.
8. Complaints
If you are unhappy with how we handle your personal data, please tell us first so we can put it right. You also have the right to complain to the Data Protection Commission, the Irish data protection authority, at dataprotection.ie.
9. Changes to this notice
We may update this notice. Each version has its own version number and date at the top of this page. If a change affects how we use account data or device data, we will tell organisations' admins before it takes effect.