Privacy policy

This policy describes what the Experiential Labs platform (platform.experientiallabs.ai and api.experientiallabs.ai, the “Platform”) collects, stores, and shares, and the choices you have. The Platform is operated by Resolute Labs AI, Inc., a Delaware corporation doing business as Experiential Labs. The marketing website has a separate policy that covers only the website. This one starts when you create an account or send a request through the gateway. Section 1 summarizes the essentials: what is stored, for how long, who can read it, how it is used, what changes with your own provider keys, and where the data lives.

For the content of the requests your applications send (“Customer Content”), your organization decides what is sent and why, and we process it on your instructions to serve the request; in data-protection terms, you are the controller and we are the processor. For your account, your organization’s settings and billing, and how you use the dashboard, we decide the purposes and are the controller.

1. Data handling at a glance

2. What we collect

Account and organization data

Your email address and sign-in identity (an emailed code, a password you chose to set, or a Google, GitHub, or enterprise SSO identity), your organization’s name and settings, its members and their roles, invitations, and the API keys you mint (we store a hash of each key plus a short prefix and suffix for display, never the key). At sign-up we record where the account came from: a masked network prefix of your IP address (never the full address), its network operator and type, approximate location from that address, browser and device family, and the referring page or campaign.

Request content

The messages, tool definitions, files, and other content your applications send to the gateway, and the responses models return. Section 3 states exactly which of this is stored, where, and for how long. Content you upload yourself (traces from your own observability tools, batch input files) is stored until you delete it or its job expires.

Request metadata

For every request: the model and provider that served it, token counts (input, cached, output, reasoning), latency and time to first token, the settled cost, the outcome and a sanitized error class when it failed, the API key used, timestamps, content-free digests that let us group repeated prompts without storing them, and the end-user label your application sent (the OpenAI safety_identifier or user field). That label is yours to choose; if you put personal data in it, it is stored as metadata.

Billing data

Your credit balance, purchases, grants, and spend, and the outcome of each payment attempt: a one-way hash of the card, the card’s issuing country, the billing country, and any decline code. Card numbers are entered directly with Stripe and never reach us.

Provider credentials

If you connect your own provider keys, the secret is stored in an encrypted vault and we keep only its last four characters and health status outside it. A provider’s own error text for a failing connection is shown back to you in Settings.

Dashboard usage and communications

How you use the dashboard (pages, clicks, session recordings, browser and device, approximate location), tied to your email and organization through our product analytics provider; emails we send you and your replies; and anything you send to support or in an appeal.

3. Request content: what is stored and for how long

The serving path is content-free by construction: the request and usage ledgers cannot hold bodies. Content is stored only in the places below, each with its own retention.

Request metadata and billing records have no expiry: they are the record of what was served and charged. When an organization is deleted, identifying fields in those records (end-user labels, error messages, per-user identifiers) are erased and the amounts, tokens, model, and timestamps are kept as financial records.

4. How we use data

• Serving requests. Routing each request to a provider, streaming the response, honoring continuations and idempotent replays, and enforcing your spending and rate limits.
• Your logs and intelligence. Captured prompts power the per-request view in Logs, prompt grouping in Insights, and the intelligence features your organization enables. The natural-language usage query sends only your question to a model, together with aggregate figures about your own usage; it never sends stored prompts.
• Billing. Settling each request against your credits, charging purchases and auto-recharge, and showing you spend.
• Security and abuse prevention. Detecting credential leaks, card testing, sign-up farms, and free-allowance evasion. This includes comparing captured prompts across organizations to detect the same workload hopping between accounts to evade limits, comparing one-way card hashes across organizations, and checking sign-up network reputation. The result of such a check is an internal flag or a hold on the organization, never disclosure of one customer’s content to another.
• Support and operations. Answering your requests, investigating incidents, and monitoring the health of the service.
• Our own purposes, outside private mode. Content captured from organizations that are not in private mode may be used to develop, evaluate, and improve our services and the models we host. Private mode excludes an organization from this use entirely: nothing is stored, and turning it on deletes what was.
• Product analytics. Understanding how the dashboard is used so we can improve it.
• Communications. Sign-in codes, verification and billing emails, notices about your account, and, where you have asked for them, product updates.

We do not sell Customer Content or personal data, and we never show one customer’s content to another. Aggregated statistics that identify neither an organization nor a person (for example request volume by model) may be used and published.

5. Who can access your data

Access to an organization’s data requires membership in that organization, enforced in the database on every request, not only in the interface. Members see logs and usage; admins additionally manage keys, members, settings, and billing. Captured prompts can be read by your organization’s members in Logs and through the usage API.

Within Experiential Labs, access to customer data is limited to platform administrators, who use it only to provide support you request, to investigate abuse, and to respond to incidents. Platform administrators can view any organization’s captured prompts through the same interfaces its members use. Changes made through the control plane are written to an append-only audit log that organization admins can read and export. Provider secrets are released only to the serving process and are never shown to anyone, including our staff.

6. Private mode and provider data controls

Private mode turns off prompt, response, and continuation capture for an organization. It is available on the Pro plan and to organizations that were verified before capture became the default; organizations on the free plan cannot turn capture off. When private mode is on, request metadata continues to be recorded, the 24-hour keyed-replay store continues to operate because the API depends on it, Responses API continuations are no longer stored (a later previous_response_id gets an explicit "resend the conversation" error), and features built on captured content (per-request prompt view, prompt grouping, intelligence) have nothing to show for new requests. Turning it on takes effect immediately and deletes the content captured earlier, and none of the organization’s content is used for our own purposes. Requests served on your own provider keys store no content on any plan.

Separately, an organization can restrict the providers its traffic may reach and require that a provider offer zero data retention or a no-training commitment for the model serving each request. These controls are enforced when a request is routed and fail closed: a model that no compliant provider can serve is refused rather than sent elsewhere. The provider commitments we rely on are our reading of each provider’s published data-handling terms, reviewed at least every thirty days, except for models on our own infrastructure, where the commitment is ours.

7. Where data is held

All Platform data is stored and processed in the United States, in Oregon:

• AWS us-west-2: the serving cluster, application logs (which admit no request bodies or headers and are kept 14 days), metrics, and the analytics warehouse (ClickHouse Cloud).
• Supabase, AWS us-west-2: the primary database (accounts, metadata, captured prompts, batch files, provider credential vault), authentication, and file storage for uploaded traces. Single primary database today.
• Google Cloud us-west1: the GPU cluster serving the models we host ourselves (Experiential Cloud).

Traffic to and from the Platform passes through Cloudflare’s global edge, which terminates TLS and therefore sees request and response bytes in transit. Model providers process requests wherever they operate; the provider data controls in section 6 are the way to constrain that. There is no customer-selectable data region today. If you are outside the United States, your data is transferred to and processed in the United States; for transfers from the EEA, the United Kingdom, or Switzerland we rely on the standard contractual clauses in our data processing agreement.

8. Subprocessors and other recipients

The parties below receive Platform data in order to run the service for you.

We may also disclose data where we believe in good faith that the law, a court order, or a lawful request by a public authority requires it, or where necessary to protect the rights, property, or safety of Experiential Labs, our customers, or others; and to a counterparty and its advisers in a merger, acquisition, financing, or sale of assets, where it transfers to the successor under this policy.

9. Retention schedule

We may keep data longer where the law requires or to establish or defend a legal claim. Copies in routine backups are overwritten on the backup cycle.

10. Deletion and export

An organization admin can delete all of the organization’s stored content from Settings: captured prompts, uploaded traces, batch files, and the records derived from them. The organization, its members, keys, provider connections, and spend history remain. This is the only content deletion available today; there is no per-request deletion, and the 30-day capture window is the alternative for organizations that do not want to delete everything.

Any member can delete their account from Settings. The account, its memberships, and its sessions are removed. When that leaves an organization with no members, the organization’s API keys are revoked immediately and the organization is deleted unless it holds an active subscription or content that a person must review, in which case it is kept for an operator to close out. The account of the sole platform administrator, or the last admin of an organization that still has other members, cannot be deleted until that is resolved. Usage history is exportable at any time through the usage export API; your uploaded traces are yours and can be re-exported to a connected destination.

11. Security

Traffic is encrypted in transit with TLS from your client to the edge and from the edge to our origin. Every table holding organization data is protected by row-level security, and access to captured prompts goes through privileged database routines that check the caller’s organization on each call. API keys are stored only as SHA-256 hashes. Provider secrets live in Supabase Vault and are decrypted only inside the serving process. Authentication failures return a uniform response that reveals nothing about why a key was rejected. Per-key rate limits, spending limits, and IP allow and deny lists are available to you. We hold no security certifications today (no SOC 2, ISO 27001, or HIPAA attestation) and say so plainly; enterprise customers who need a questionnaire completed can write to founders@experientiallabs.ai. Report a vulnerability to the same address.

12. Your rights

You can see and change your account details in Settings and delete your account or your organization’s content at any time. Where the GDPR or UK GDPR applies, we process account and dashboard data on the basis of performing our contract with you, our legitimate interest in running a secure service, and, for product analytics, your consent where the law requires it; you have the right to access, rectify, erase, restrict, port, and object, and to complain to your supervisory authority. Where a US state privacy law applies, you have the right to know, delete, and correct, and we do not sell personal information or share it for cross-context behavioral advertising; our product analytics provider acts as our service provider. For requests about Customer Content that your organization sent, contact that organization; we assist it as its processor. Send requests about your own data to founders@experientiallabs.ai; we verify them by replying to the email on the account.

13. Enterprise customers

Organizations that need a data processing agreement, a completed security questionnaire, custom retention, or contractual data-handling commitments beyond this policy can request them at founders@experientiallabs.ai. A signed agreement governs where it conflicts with this policy.

14. Children

The Platform is not directed at anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe we have, write to us and we will delete it.

15. Changes

We may update this policy. When we do, we change the date at the top; for a material change, such as a new category of data, a new subprocessor that receives content, or a longer retention period, we notify organization admins at least fourteen days before it takes effect.

16. Contact

Questions about this policy, requests about your data, and security matters: founders@experientiallabs.ai.