Experiential
privacy

Privacy policy

Experiential Labs. Last updated September 16, 2026.

Resolute Labs AI, Inc., operating as Experiential Labs (we, us), explains here how we handle personal information through our website, hosted platform and related business activities. Personal information includes information that identifies a person or can reasonably be linked to them. Our address is 989 Market Street, 2nd Floor, San Francisco, CA 94103, United States. Contact founders@experientiallabs.ai about privacy.

1 Scope and our roles

This notice covers experientiallabs.ai, platform.experientiallabs.ai, api.experientiallabs.ai and our related account, sales, billing and support activities.

We generally act as controller or business for website activity and account administration where we determine how and why information is used. When we process personal information on a customer's behalf to provide the Services, the customer generally determines its purposes and we act as processor or service provider. Our DPA applies where that relationship requires contractual processing protections under applicable law, regardless of plan. Separately negotiated agreements retain their agreed precedence.

An organization that supplies your information or gives you access to an account may have its own privacy notice. Its administrators can manage the organization's users and account information within their assigned permissions. Contact that organization about information it controls, or contact us for help identifying the appropriate route.

2 Information we collect

We collect information you provide when you create an account, use the Services, submit a form, book a call or contact us. We also receive information from sign-in, payment and service providers and from the website technologies described below.

Information required to supply a requested service is identified at collection. Without it, we may be unable to provide that service.

3 Website collection and signup

We use information submitted through website forms to respond to enquiries, review startup applications and arrange calls. Applications may include company details, team size, expected AI usage or spending, and contact information. Resend handles form emails and Cal.com handles scheduling. Relevant submissions may be shared with our team through internal notifications, including Slack.

Account creation uses the platform's authentication services, including Supabase Auth and available Google or GitHub sign-in. We use the information returned through your chosen sign-in method to create and maintain your account.

Where permitted by your choices and applicable law, we associate website activity with visitor identifiers or contact information you provide to understand attribution and respond to business interest. Cookies and related choices are described in section 7.

4 Platform requests capture and optional features

The hosted gateway receives requests, sends the information needed to the selected model or hosting provider, and returns responses. The recipient and its handling depend on the selected model, route and applicable settings. A provider's zero-retention or no-training setting covers that provider's specified handling; it does not describe all processing by Experiential.

The standard hosted service records prompts, responses and related activity. Available settings and the features you use affect recording. Requests must still be processed to provide an answer, and necessary account, billing and security records are handled separately.

Customer-specific model training is optional and requires authorization to collect the traces needed for it. We use that training data for the customer's models. Our Terms do not authorize using Customer Content or datasets derived from it to train shared models or other customers' models, or selling those datasets. Customer Content is not used for advertising. A future change of purpose requires the applicable notice and lawful authorization.

We use PostHog for platform analytics, including page activity and session replay, to understand how people use the product and investigate problems. This disclosure does not authorize recording Customer Content for purposes outside the limited permissions in our Terms and DPA. These activities are subject to applicable privacy and consent requirements. Permission for customer-specific training is separate from website tracking choices.

Self-hosted deployments are operated by their customers. Their data handling depends on the deployment, connected hosted features and providers they select. Self-hosting does not necessarily prevent requests from reaching third-party providers.

5 How we use information and the applicable basis

We use information to provide and administer requested Services, process payments, respond to enquiries and support requests, maintain security, investigate misuse, improve the product and website, conduct permitted marketing and comply with legal obligations. Customer Content follows the narrower purposes in section 4 and the applicable customer agreement or DPA.

Where EU or UK law requires a legal basis, we rely on:

Where we act as a processor, the customer determines the basis for its processing and we act on its documented instructions. Accepting Terms is not blanket consent to unrelated data uses. Withdrawing consent does not affect processing that was lawful before withdrawal.

6 Recipients

We disclose information to providers that help operate the website and Services, selected inference providers, and others in the circumstances below. The data a provider receives depends on the feature or activity involved.

Providers' legal roles depend on their actual use of information and the applicable arrangements. Website advertising and visitor identification are described separately in section 7. Where a provider acts as our processor, the applicable processing arrangements govern its handling. If you use a provider through your own account, its agreement also applies.

We may disclose information to professional advisers, when legally required, to investigate misuse or protect rights within applicable law, or in connection with a financing, reorganization or transfer of the business. A successor remains subject to applicable privacy commitments.

7 Cookies advertising and choices

We use cookies and browser storage for sign-in, security, preferences and privacy choices. On our marketing website (experientiallabs.ai), we also use optional measurement, advertising and visitor-identification technologies, including PostHog analytics, Reddit advertising tools, RB2B and our own visitor and attribution identifiers. Platform analytics uses PostHog as described in section 4; marketing-website choices do not automatically control platform session replay.

We disclose website identifiers, browsing activity and available business-contact information to advertising and visitor-identification partners. These disclosures may constitute a sale of personal information or sharing for cross-context behavioral advertising under applicable privacy laws, even when we receive no cash payment for the information. They are separate from processing customer prompts and responses to provide the Services.

Use Your Privacy Choices on the website to manage optional tracking and opt out of relevant sale, sharing or targeted advertising. Where required, optional tracking depends on your prior consent. We honor applicable opt-out preference signals, including Global Privacy Control. These browser choices apply to the browser and website activity covered by the control; they do not automatically erase previously collected information or change every platform setting.

You may also manage cookies through your browser, although disabling necessary storage may affect sign-in or other functionality. You can withdraw consent through the available privacy controls and unsubscribe from marketing emails using the link in the message. We may still send service, billing or security communications.

8 Retention

We retain personal information for the purposes described in this notice, subject to applicable legal requirements. The period depends on the type of information, the service used, the status of the relationship and any need to handle a dispute, security issue or legal obligation.

Stored prompts and responses in the primary capture table are automatically removed after 30 days. That period does not describe every trace, file, backup or provider-held copy. Other service records are retained for the period needed to provide the relevant feature, resolve operational or security issues, and meet applicable legal requirements, taking account of available settings and the DPA where applicable.

We retain account information while needed to administer the account and any outstanding obligations. Billing records may be kept after closure for tax, accounting, fraud-prevention and dispute purposes. Website activity is retained for the measurement and marketing purposes for which it was collected, with its ongoing necessity assessed against those purposes. Enquiries and correspondence are retained while the relationship or request remains active and for any further period needed to handle related claims or legal obligations. Limited consent and suppression records may remain necessary to demonstrate and respect your choices.

Deletion requests are handled under applicable law and the DPA where relevant. Information retained for a legal hold or in protected backups remains restricted and subject to the applicable deletion requirements. Stopping future recording does not itself delete information already held.

9 International transfers and security

Experiential operates in the United States. The primary platform database is hosted in Supabase's us-west-2 region. Information may also be processed where the providers supporting your selected Services operate. We do not make a general promise that every copy or provider operation remains in one country.

Transfers subject to data-protection restrictions require applicable safeguards, such as an available adequacy arrangement or appropriate contractual protections. The DPA addresses processing on a customer's behalf. Contact us for information about the safeguards relevant to your data.

We use technical and organizational measures appropriate to the processing risk to protect information. No service can guarantee absolute security. Report a suspected security issue to founders@experientiallabs.ai or through our private GitHub security advisory channel at https://github.com/experientiallabs/experiential/security/advisories/new.

10 Your rights

Depending on the law that applies, you may request access or a copy, correction, deletion, portability, restriction or information about disclosures. You may object to certain processing, withdraw consent and opt out of sale, sharing or targeted advertising where applicable. You may also have rights concerning sensitive information or qualifying automated decisions. We will not unlawfully discriminate against you for exercising a right.

Send requests to founders@experientiallabs.ai. We may verify identity where appropriate to the request. Website tracking opt-outs are available through Your Privacy Choices without creating an account. Authorized agents may act with appropriate authority. If we deny a request, we will explain the reason and how to appeal where applicable; you may contact the same address to request an appeal.

We respond within the periods required by applicable law and explain any permitted extension. For information controlled by a customer, we may refer you to that customer and assist it as required. You may complain to your competent privacy regulator, including the UK Information Commissioner's Office where relevant. These statutory rights do not depend on buying a particular plan.

The categories, sources, purposes and recipients of personal information are described in sections 2, 5 and 6. Website identifiers, browsing activity and business-contact information are the categories involved in the advertising and identification disclosures described in section 7. Retention is addressed in section 8.

11 Children and automated decisions

Users must be at least 18, and our Terms prohibit submitting personal data about minors. We do not knowingly solicit accounts from children. Contact us if you believe we have received children's information contrary to these restrictions.

Customers remain responsible for their applications and consequential uses of model outputs, including required human review and notices. Model routing is not a promise that an output is appropriate for a decision about a person.

12 Changes and contact

We will identify the effective date of each version and provide notice of material changes before they apply where required. We will obtain consent or other authorization when required by law or an existing commitment. Publishing an updated notice does not itself authorize a new use of previously collected information.

Contact Resolute Labs AI, Inc., doing business as Experiential Labs, at 989 Market Street, 2nd Floor, San Francisco, CA 94103, United States or founders@experientiallabs.ai.