PRIVACY POLICY
This Privacy Policy explains how Primitive Labs AI Inc ("we," "us" and "our") handles personal information when you visit our websites, use our products and services, or otherwise interact with us. By using our services, you agree to the practices described here. If you do not agree, do not use our services. This policy works alongside our Terms of Service.
This policy applies to information we collect through our marketing site, our product, and any other channel where we collect data directly from you. It does not apply to third-party sites or services we do not control. This Privacy Policy does not apply where Primitive Labs AI Inc acts as a data processor and processes personal information on behalf of business customers, for example if your employer has provisioned your account; in that case our customer agreement and data processing agreement govern.
California Notice at Collection. We collect the categories of personal information described in the "What We Collect" section for the purposes described in the "Why We Collect It" section. We do not sell your personal information or share it for cross-context behavioral advertising. For the full list of your California rights and how to exercise them, see the "State-Specific Rights" section below.
1. Who We Are. Primitive Labs AI Inc is a company incorporated in Delaware, with its principal place of business at 2261 Market St., STE 67217, San Francisco, CA 94114. Questions about this policy or your data can be sent to privacy@primitivelabs.ai.
2. Customer Data and End-User Data. If you use our product as part of an organization's account (for example, your employer's), the organization controls the personal information stored in the product. This policy describes information we collect and control directly: information you give us when you create an account, visit our marketing site, fill out forms, or otherwise interact with us. Personal information your organization stores in the product is governed by our agreement with the organization, and requests about that information should be directed to your organization in the first instance.
3. What We Collect. We collect the following categories of personal information, using the categories defined under California law:
• Identifiers. Name, email address, phone number, IP address.
• Customer records. Billing address, payment information processed by our payment provider.
• Commercial information. Records of products purchased and account history.
• Usage data. How you interact with our product and site, including features used, pages viewed, actions taken, and approximate location derived from IP address. This includes session replay recordings that capture interactions such as clicks, scrolling, mouse movements, and information you enter into forms; we configure these tools to mask or suppress sensitive fields such as passwords and payment information.
• Geolocation. Approximate location based on IP address. We do not collect precise device location.
• Professional or employment information. If you provide it (for example, your job title or company when contacting sales).
• Inferences. Information we derive from the above to understand how customers use our services.
• Audio or visual information. Support call recordings, profile photos, or other media you provide or upload.
• Protected classifications. Age, gender, or similar demographic information you choose to provide.
• Education information. School, degree, or other academic information you provide.
• User-generated content and input data. Comments, messages, posts, photos, images, videos, documents, works of authorship, and other content you create, upload, transmit, or store on our services, together with associated metadata such as how, when, and by whom content was created or edited.
We do not knowingly collect sensitive personal information as defined by California law.
4. How We Collect It. We collect personal information three ways:
• Directly from you. When you create an account, fill out a form, contact support, or otherwise interact with us.
• Automatically. When you visit our site or use our product, we automatically collect technical information through cookies, software development kits, and similar technologies, including product analytics and session replay tools.
• From third parties. Our payment processor, analytics providers, and similar service providers send us information related to your use of our services. We may also receive information about you from other sources, such as public sources (for example, public records or social media platforms), data providers, and marketing or referral partners.
5. Data About Others. We may offer features that let you invite friends or contacts to use our services, and we may collect their contact details so we can deliver the invitation. Please do not refer someone to us or share their contact details with us unless you have their permission to do so.
6. Mobile App Permissions. Our mobile app may request permissions for features such as your camera, microphone, contacts, calendar, photos, location, and notifications. These permissions are optional. The app will function without them, although certain features may be unavailable. You can change these permissions at any time in your device settings.
7. Anti-Bot and CAPTCHA. We use CAPTCHA and similar anti-bot technologies to protect our services from automated abuse such as credential stuffing, scraping, and spam. The provider may evaluate signals like your IP address, browser characteristics, and interaction patterns to determine whether traffic is automated. We do not have access to the underlying signals; we receive only the assessment result.
8. Why We Collect It. We use personal information to:
• Provide, maintain, and improve our products and services.
• Develop, train, and improve our AI and machine learning features.
• Authenticate accounts and prevent fraud and abuse.
• Process payments and bill customers.
• Communicate with you about your account, our services, and product updates.
• Respond to your inquiries and provide support.
• Understand how customers use our services and improve them.
• Comply with legal obligations, enforce our terms, and protect our rights.
9. Aggregated and De-Identified Data. We may create aggregated or de-identified data from personal information by removing identifiers and combining records so that you cannot reasonably be re-identified. Aggregated and de-identified data is not personal information. We may use and disclose it for any lawful purpose, including improving our products and publishing usage statistics. We publicly commit to maintain and use this data only in de-identified form and not to attempt to re-identify it, and we contractually require the same of any recipients.
• Affiliates. Our parent, subsidiaries, and other entities under common control with us, for the purposes described in this policy.
• Service providers and sub-processors that operate our infrastructure, payments, analytics, communications, and similar functions. We bind them by written agreements that limit their use of personal information to providing services to us. A current list of our sub-processors is available on request at privacy@primitivelabs.ai.
• Professional advisors including auditors, lawyers, and accountants.
• Government authorities when required by law, subpoena, or other legal process.
• In a business transaction such as a merger, acquisition, or sale of assets, in which case the acquirer will be subject to this policy or one materially similar.
• Other users and the public. If you post content publicly through our service (such as profile information, comments, or shared posts), that content can be viewed, copied, or stored by other users and the public. We are not responsible for how third parties use content that you have made public.
If you choose to log into our service using a third-party account (for example, Google, Microsoft, or another single sign-on provider), we receive information from that provider as permitted by your settings with the provider, including your name, email address, and profile identifier. The provider's use of any data you share with it remains governed by the provider's privacy policy, not ours. If you connect or authorize a third-party service from within our product, we may share information with that service at your direction; that service's use of the information is governed by its own privacy policy, not ours.
We do not share personal information with third parties for their own direct-marketing purposes. If you are a business customer and require a Data Processing Addendum, our standard DPA is available on request at privacy@primitivelabs.ai.
11. Sale and Sharing of Personal Information. We do not "sell" personal information for monetary or other valuable consideration. We do not "share" personal information for cross-context behavioral advertising as those terms are defined under California law.
12. AI and Machine Learning. We use content you submit through our service, including the inputs you provide to and outputs you receive from our AI features, together with related usage data, to develop, train, evaluate, fine-tune, and improve our own artificial intelligence and machine learning features. We do not use session replay recordings to train, fine-tune, or develop our models; we use those recordings only for analytics and product debugging. You can opt out of the use of your content to train and fine-tune our models at any time by changing the relevant setting in your account or by contacting us at privacy@primitivelabs.ai. Opting out applies going forward and does not affect training already performed. Even if you opt out, we may continue to use your content as needed to operate, secure, and ensure the safety and quality of the service. We do not share user data with third-party AI providers for training their models. Where we act as a processor for a business customer, our customer agreement and Data Processing Addendum govern this use. We may use aggregated and de-identified data, which is not personal information, to evaluate and improve our product features.
Analytics and Session Replay. We use first-party and third-party product analytics and session replay technologies to understand how our marketing site and product are used and to improve them. These technologies are provided by service providers acting on our behalf and by our own tools, and they may set cookies or use similar identifiers and local storage; they are not cookieless. The session replay tools record interactions as described in the “What We Collect” section, with sensitive fields masked or suppressed. A current list of these providers is available on request at privacy@primitivelabs.ai.
Your Choices. Analytics, session replay, and other non-essential technologies are not strictly necessary to provide our services. We use your approximate location, derived from your IP address, to determine which experience to present. If you are located in the European Economic Area, the United Kingdom, or Switzerland, we present a consent banner and load these non-essential technologies only after you opt in. Elsewhere, including in the United States, these technologies load by default and you can opt out at any time through the “Cookie preferences” link in our website footer or through your browser settings. You can change or withdraw your choice at any time through the same controls.
14. Marketing Communications. You can unsubscribe from marketing emails by using the unsubscribe link in any marketing message or by contacting us at privacy@primitivelabs.ai. Service emails (about your account, billing, security, or required notices) will continue.
15. Your Rights. Depending on where you live, you may have the right to:
• Access the personal information we hold about you.
• Correct inaccurate personal information.
• Delete your personal information, subject to legal exceptions.
• Opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
• Opt out of certain automated decision-making, where applicable.
• Receive a portable copy of your personal information.
• Be free from discrimination for exercising these rights.
16. How to Exercise Your Rights. To exercise any of these rights, email us at privacy@primitivelabs.ai. We will verify your identity before responding. We will respond within forty-five days, with one extension permitted by law if we need more time. We will tell you if we cannot fulfill the request, and why. You can use an authorized agent. Provide written permission from you and identification for the agent.
17. Retention. We keep personal information for as long as we need it for the purposes described in this policy. The actual period depends on the type of information, the reason we collected it, applicable legal obligations (such as tax and accounting), and your relationship with us. When we no longer need it, we delete or anonymize it. If you close your account, we delete or anonymize information associated with the account promptly, subject to the exceptions in this section (records kept for legal, accounting, fraud-prevention, or dispute-resolution reasons).
18. Security. We protect personal information using administrative, technical, and physical safeguards reasonable to the type of information and our size. No system is perfectly secure, and we cannot guarantee that information will never be accessed by unauthorized parties. We will notify you of a breach affecting your personal information as required by law.
19. Children. Our services are not intended for, and may not be used by, anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it. If you believe someone under 18 has provided us with personal information, contact us at privacy@primitivelabs.ai.
20. Job Applicants. If you apply for a job with us, we collect the personal information you provide in your application (such as your name, contact information, work history, and education). We use this information to evaluate your application and, if applicable, to communicate with you about employment. We retain applicant information for the period required by applicable law.
21. State-Specific Rights. The following sections describe additional or modified rights for residents of specific US states. Where a state law gives you a right not listed here, we honor it whether or not it is described.
(a) California (CCPA / CPRA). All rights in the "Your Rights" and "How to Exercise Your Rights" sections apply. You also have the right to limit the use of sensitive personal information if we collect it, and the right to know the specific pieces of personal information we hold about you. You can designate an authorized agent. In the preceding 12 months (or such shorter period as we have been operating), we have collected the categories of personal information listed in the "What We Collect" section. We have disclosed each of those categories for business purposes to the categories of recipients listed in the "Who We Share It With" section. We have not sold or shared any category of personal information for cross-context behavioral advertising. California's "Shine the Light" law also lets California residents request information about personal information we disclosed to third parties for those third parties' own direct-marketing purposes; as stated above, we do not share personal information with third parties for their own direct marketing.
(b) Other US States. Residents of US states with comprehensive privacy laws have the rights described in the "Your Rights" and "How to Exercise Your Rights" sections, with state-specific differences as required by each state's law.
(c) Nevada. Nevada residents have the right under SB 220 to submit a verified request directing us not to sell their covered personal information to third parties. To submit such a request, contact us at privacy@primitivelabs.ai with "Nevada Opt-Out" in the subject line.
(d) Appeals. If we deny your privacy request, you may appeal our decision by contacting us at privacy@primitivelabs.ai with "Appeal" in the subject line. We will respond to your appeal within sixty days. If your appeal is denied, you may contact your state Attorney General's office to lodge a complaint.
22. International Users. We process personal information in the United States. If you access our services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.
a. Supplemental Notice for EU/UK and Swiss Users. If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following additional information applies to our processing of your personal data under the General Data Protection Regulation (GDPR), the UK GDPR, and the Swiss Federal Act on Data Protection (FADP), as applicable.
b. Legal Basis for Processing. We process your personal data on the following legal bases:
• Contract performance. To provide and maintain the services you requested.
• Legitimate interests. To operate, improve, and secure our services, provided our interests are not overridden by your data protection rights. Our legitimate interests include fraud prevention, network security, product improvement, and direct marketing to existing customers.
• Consent. Where you have given specific consent, such as for marketing communications and for non-essential cookies, analytics, and session replay. You may withdraw consent at any time by contacting us at privacy@primitivelabs.ai or, for cookies and similar technologies, through the “Cookie preferences” link in our website footer.
• Legal obligation. Where processing is required to comply with applicable law.
c. International Transfers. Your personal data is transferred to and processed in the United States, which the European Commission has not determined provides an adequate level of data protection. We protect these transfers using the European Commission's Standard Contractual Clauses, with the Swiss addendum where applicable. You can request a copy by contacting us at privacy@primitivelabs.ai.
d. Your Additional Rights Under GDPR. In addition to the rights described above, EU, UK, and Swiss residents have the right to:
• Object to processing of your personal data based on legitimate interests.
• Restrict processing of your personal data in certain circumstances.
• Withdraw consent at any time, where our processing is based on your consent, without affecting the lawfulness of processing carried out before withdrawal.
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects concerning you, except as permitted by law.
• Lodge a complaint with your local data protection supervisory authority.
23. Other Sites and Services. Our services may link to, or integrate with, websites and online services operated by third parties that we do not control. A link or integration is not an endorsement, and we are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites and services you use.
24. Changes to This Policy. We may update this policy from time to time. The "Last Updated" date at the top reflects the most recent change. If we make a material change, we will take reasonable steps to notify you.
25. Contact
Primitive Labs AI Inc.
2261 Market St., STE 67217
San Francisco, CA 94114
privacy@primitivelabs.ai