Privacy

Private beta

The marketplace is in an invite-only private beta, and this is a first version of this notice. During the beta some things it describes have no tool yet and are done by hand by Latent staff: copies of your data, deletion, ending your sessions, and removing a recording. Where that is so, this notice says it.

Who runs the service

This service is run by Latent Energy LLC, a Puerto Rico limited liability company. This notice covers the marketplace at latentenergy.com and its API. Write to market@latentenergy.com for anything in it. If you were a solar customer or an outage alert subscriber in Puerto Rico, see Solar customers and outage alerts.

What we collect

We keep only what the marketplace needs to work. By source:

• Account. Your email address, a display name taken from the part of the email before the @, the sign-in method you used and the time of each sign-in. There are no passwords: a link sent to your email signs you in, and each request for a link is stored with your email and the IP address it came from. Those records are used to limit sign-in requests and to recognise a network you signed in from in the last 90 days. If you choose Google, we receive your Google account id, email and name.
• Invite list. During the beta, only invited email addresses and domains can sign in. Latent keeps the list of addresses and domains it has invited.
• Sessions and API keys. A session cookie holding a random token (stored hashed on our side) and, if you create them, API keys with a label, their scopes and the time they were last used. Keys are stored hashed and shown to you once.
• Email notices. Your notice preferences, a copy of each notice we send you, and which order messages you have read.
• Provider profile. Name, kind, location, country, bio, robot platforms, rigs, links, hours per week and latency. All of it is public once the profile is listed.
• Verification. Before a provider is listed, Latent staff check who you are and that the robot or cell you describe exists, for example by email or on a video call. The platform records that the check was made, when and by whom. See the verification section.
• Tasks and orders. Everything typed into a task or an order: title, description, acceptance bar, volume, timeframe, formats, rights, notes, quantities and prices. For each delivered unit: the manifest (including the operator, robot and station ids the provider gives), the evidence link, the note, the decision and any rejection reason. Messages between the two sides of an order. Dispute reasons. Credit grant requests and their notes.
• Robot recordings. The files a provider delivers into Latent custody. These can show people. See the next section.
• Reviews. Four ratings and a text.
• Payments. Card details go to Stripe and never reach us. From Stripe we store the checkout session id, the payment id, the charge id, the Stripe customer id, the dispute id, the amount and currency, the payment, refund and dispute status, the receipt link, and the ids, amounts, statuses and our own order metadata of each webhook event so a failed event can be replayed. We do not store card numbers, expiry dates, security codes, cardholder names or billing addresses. Credit grants record the amount, the reason and who granted them. Every credit movement writes a ledger entry. When you buy credits with an email sign-in or Google, we send your account email to Stripe as the customer and receipt email, and our account id and purchase id as metadata.
• Payouts. For providers: the payout method you give us for bank transfers (free text, such as the bank name and the last digits of the account), shown to Latent admins; the status of your tax form (we record whether a W-9 or W-8 is on file, not the form); and for each payout the amount, the method, the status, the bank reference or Stripe transfer id, any reversal and whether its amount is held for review, a note, and which admin started it or that it was automatic. If you are paid through Stripe, you give your identity and bank details, and the tax details Stripe asks for, to Stripe directly in Stripe's onboarding, and Latent does not receive them. To create the Stripe account Latent sends Stripe your provider name, your country and Latent's provider id. Latent stores the Stripe account id, its country and currency, whether details are submitted and payouts are enabled, the names of the details Stripe still lists as due (such as 'bank account', never the values), and any error Stripe returns on a payout.
• Keys and devices. If a provider registers a security key or a capture device for signing deliveries, the key's public part and the attestation data the device or its maker returns.
• Technical. IP addresses, used in short rate-limit windows and stored with sign-in link requests, robot pairing requests and robot heartbeats, and the time of each request. Latent's own server logs each web request: the time, the method and the path without its query string (so sign-in and unsubscribe links are not logged), the response status and size, how long it took, the IP address and the browser's description of itself. The app keeps its own logs as well.

People in recordings

A robot recording shows whatever its cameras see. That can include the operator, people who walk past or work nearby, and sometimes children. Latent does not need anyone's face or identity to check a unit, and the terms ask providers to keep people out of frame and to have the consent of anyone who appears.

• What Latent stores. When a unit is delivered into Latent custody, Latent stores its files exactly as delivered, so anyone in view is in the stored video. Latent also keeps the file hashes, the check results, and short perceptual fingerprints of sampled video frames, used to catch footage that is delivered twice. A fingerprint is a short code, not a picture. When a unit is not in custody, the files stay in the provider's own storage and Latent records only the manifest and the hashes the provider declares.
• Who can see the files. The buyer of the order while the unit is delivered or accepted, the provider that delivered it, Latent admins, the auditor Latent assigns to that unit, and Latent's own checker workers while they run a check. Every batch of download links is logged with the account, its role and the time.
• Automated checks. Latent's checker workers, run by Latent, open custody files to check their structure, frame counts, the recording code in frame, stereo depth and joint logs against video. Workers get pseudonymous handles instead of account ids, names and emails, together with the manifest and the order's terms. Check results are kept with the order.
• Scanning for people. Where the people check runs, Latent's checker samples frames from each delivered video (about two a second) and runs a person detector and a face detector on them. It records how often a person was seen, on which cameras and at which times. It does not recognise or identify anyone, does not compare faces with anything, and no picture, crop or face is stored apart from the delivered files. The buyer and the provider see the result as a warning. If the order says "no people in frame", the unit's auto-accept is paused for a Latent reviewer when a person is found or the scan could not cover every camera in full. The detectors are not calibrated and make mistakes both ways. On a robot running Latent's software with the check installed, a lighter scan runs on the robot itself after each take, so the operator sees the warning before delivering.
• Face-blurred copies. When a person is seen, Latent's worker makes a copy of each video with faces blurred, and whole people blurred where no face is found. The buyer can download the blurred copy instead of the original. Blurring is best effort: a face seen from the side or at the edge of a wide camera can be missed. The original stays in custody, because disputes, audits and the hash record depend on it, and the buyer can still download it. A blurred copy is deleted when its original is.
• How long originals are kept. Files in Latent custody are deleted 30 days after the unit is rejected or voided, and 365 days after it is accepted. Deletion waits while the order is in dispute or an audit of the unit is open. The hashes, fingerprints, check results and download log stay with the order record. Copies a buyer has downloaded are outside Latent's storage; the terms require the buyer to delete them when a unit is rejected.
• Recordings from a related provider. A related provider is a provider owned by Latent or by a person who runs Latent (see the terms). Today there is one: a robot cell owned personally by Latent's founder, not by Latent Energy LLC. Latent keeps copies of recordings from that cell outside the periods above, under a licence from that provider, and uses them as test files to build and test its checks.
• Asking for removal. If you appear in a recording, or your child does, write to market@latentenergy.com with what you know (the place, the date, the order if you have it). During the beta there is no removal tool: Latent staff look at each request by hand and decide case by case, and a request about a child comes first. A Latent admin can reject a unit that is still waiting for a decision, or reverse an accepted unit within 14 days of its acceptance; either ends the buyer's access and schedules the files for deletion. After those 14 days there is no tool yet to cut the buyer's access or delete the files early; staff work out what can be done and tell you. Staff also retire any hidden test copy made from the unit for audits, which is then deleted 7 days later. We ask the buyer to delete any copy it downloaded, and we cannot delete a copy that is outside our storage.

Witness phone (planned)

Latent plans an iPhone app that films an episode from the side while the robot records it. It is not released. If a provider uses it on an order, its video will be stored in Latent custody with the unit, compared with the delivered dataset, shown to the same people as the unit's files and kept for the same time. It will show the station and anyone in view, so the section on people applies to it. We will update this notice before the app is released.

What we use it for

• Signing you in and keeping your account secure.
• Running orders: holding and charging credits, delivering and deciding units, settling earnings.
• Checking delivered units: seeds, manifests, hashes, file checks and audits.
• Paying providers, through Stripe or by bank transfer.
• Verifying providers before they are listed and keeping a record of that decision.
• Resolving disputes between a buyer and a provider.
• Emailing you sign-in links and notices about your own orders. We do not send marketing email.
• Notifying Latent staff in our own Slack workspace when a provider applies, a task or order is created, a dispute opens or credits are requested. Those notices carry display names, the order facts, the task title and up to 300 characters of a dispute reason, never an email address. The webhook and the scheduled check also post when a card purchase, refund or chargeback moves credits, when a chargeback is won or lost, and when a reconciliation or a ledger or earnings check finds an error, and when a provider payout through Stripe is sent, fails, waits on the platform balance, is reversed or needs an admin's attention, or a provider's Stripe account changes status; when a robot connects, is revoked or changes its key; and when a check, an audit or a stored file needs attention. These carry the account id, the provider id or the robot id, not the email.
• Preventing abuse, through rate limits and the review of unusual activity.
• Accounting and legal obligations.

Latent does not train models on the files in an order.

What is public and who sees what

• A listed provider profile, its listings and prices, its computed stats (units completed, acceptance rate, response time, rating) and the reviews written about it. A reviewer is shown as "A buyer", or by the name of the listed provider the reviewer owns.
• A public task: title, platform, unit type, description, acceptance bar, volume, offer, timeframe, formats and rights. The buyer is shown as "A buyer", or by the name of the listed provider the buyer owns; the buyer's email and sign-in name are never shown.
• Inside an order, the buyer sees the provider's name, and the provider sees "the buyer" (or the name of the listed provider the buyer owns) and the buyer's record on the platform (acceptance rate, reject codes, disputes and rating). Messages, evidence links and delivered files are visible only to the two sides and to Latent.

Who we share it with

Processors that act on our instructions: Stripe for payments and provider payouts, Resend for email, Slack for staff notices, Google for Google sign-in, Akamai (Linode) for the server and the database, and Cloudflare for DNS, TLS, the connection to our server, and the storage of custody files and database backups. The other side of your order sees what the order needs. We do not sell personal data and we do not run advertising.

We disclose data when the law requires it, to enforce the terms, or to protect someone from harm. If Latent Energy LLC is sold or merged, account data moves with the service under this notice.

Verification

Verification is done by Latent staff and is used only to decide whether to list the provider and to answer a later dispute about identity. The platform stores the decision, its time and who made it; anything you send us for it stays in our email and is read by Latent staff only. The verified badge states that we checked; it is not a guarantee of the work.

Custody, hashes, robots and audits

These apply only where they are enabled on the platform.

• What a hash shows. Latent computes or confirms a SHA-256 hash of every file in custody and records it on the order. A matching hash shows that the bytes a buyer downloads are the bytes the provider delivered, unchanged since delivery. It does not show who recorded them, when or where, whether anything was edited before delivery, or whether the recording shows what the order asked for.
• Audits. Auditors Latent appoints review a sample of custody units under confidentiality. Auditors see the order's terms, the manifest with aliases instead of ids, the checks and the original files, people included; never the parties, the price or the buyer's decision. Hidden test units are copies of units a related provider delivered on orders Latent placed, or of units from orders whose terms allow it.
• Linked accounts. To keep a provider from reviewing or buying its own work, we link accounts that share a card (through a keyed hash of the card fingerprint Stripe gives us; the fingerprint itself is not stored) or a work email domain, and admins may link accounts by hand. Links are kept.
• Robots. A connected robot sends its hostname, operating system, software versions, camera serials, a hashed machine fingerprint, its public key, its operator ids and its last take, and a heartbeat every 30 seconds (state, queue, clock and disk). We store the IP address it connects from and the city, region and country our network provider derives from it. We keep the robot record and its latest heartbeat, also after the robot is revoked.

How long we keep it

"Automatic" means the app deletes or expires the data in its scheduled cleanup. "By hand" means there is no deletion tool yet during the beta: the period is our policy, and Latent staff carry it out.

Your choices

• Revoke API keys in Settings.
• Sign out to end the current session. To end every session, write to us and Latent staff end them by hand.
• Ask for a copy of your data, or for deletion, at market@latentenergy.com. During the beta there is no export or deletion tool: Latent staff do it by hand, and we aim to answer within 30 days. Records the ledger and the order history need are kept for the periods above; the rest is deleted.
• A provider can delete a listing at any time, and can ask Latent to take its profile off the directory.

Cookies and browser storage

One session cookie, set when you sign in. Short-lived cookies during a Google sign-in. In your browser's own storage: your light or dark theme, drafts and defaults of the forms you fill in (tasks, orders, manifests, a robot pairing code), and the page to return to after sign-in. An order or task draft is deleted once it is placed or when you sign out. After 2 hours it is no longer used, and it is deleted the next time you open any page of this site. These stay in your browser. No analytics or advertising cookies. Cloudflare Web Analytics counts page views without cookies or browser storage: it receives the page's path, the referring site, your browser and device type, your country and how long the page took to load.

Security

Traffic is encrypted in transit. Session tokens, sign-in tokens and API keys are stored hashed. Every credit movement runs in a locked database transaction and writes an append-only ledger entry. Admin access is limited to named Latent accounts and an admin token held by Latent.

Age

Accounts are for businesses and adults over 18. Children can still appear in robot recordings; the section on people in recordings says how to have that removed.

Solar customers and outage alerts

Latent Energy LLC also offered solar quotes, installations and power outage alerts in Puerto Rico. Those services are paused: no alerts, quotes or sales emails are sent. Nothing was deleted when they were paused, so the old site's records are still held on Cloudflare:

• Outage alert subscribers: your email, your phone number if you gave one for text messages, your municipality and neighborhood, and whether you confirmed.
• Emailed quotes: your email, municipality, neighborhood, monthly bill and the system size we suggested.
• Proposals: your name, address, email, location, bill, system size and a satellite image of your roof.
• Installations: the property's cadastral number, location, system and commissioning date, and the installation files, kept for the life of the warranty.
• Messages you wrote to us and our replies, and any review you left.

To stop and delete an alert subscription or an emailed quote, use the unsubscribe link at the bottom of any email we sent you: it deletes your record. Those links keep working for at least 30 days after our last solar email, and may be retired after that. At any time, and after the links are retired, write to market@latentenergy.com to unsubscribe, for a copy of what we hold, a correction, or deletion of everything; Latent staff honor these requests by hand. The notice in Spanish is at /privacidad.

Changes

We date every version of this notice at the top of the page. If a change affects what we collect or how long we keep it, we tell account holders before it applies.