Privacy Policy

This Privacy Policy explains how PurpleAILAB ("PurpleAILAB", "we", "us") collects, uses, and shares personal data when you use the Decepticon platform and related services (the "Service"). It applies to visitors, account holders, and customers. By using the Service you agree to this Policy.

Account data — your name, email address, and authentication identifiers (for example, when you sign in with Google or GitHub).

Billing data — prepaid-credit purchase, payment, tax, and refund information processed by our payment provider, Polar. We do not store full card numbers; payment details are handled by Polar.

Usage and engagement data — configurations, targets and scope you define, engagement inputs and results, logs, and activity needed to operate the Service.

AI interaction data — prompts, agent responses, tool calls, tool results, and execution outcomes may appear in restricted operational traces used to deliver, secure, troubleshoot, and evaluate the reliability of your engagement.

Technical data — IP address, device and browser information, and similar diagnostics collected automatically to keep the Service secure and reliable.

We use personal data to: provide, operate, and secure the Service; authenticate you and manage your account; process prepaid purchases, payments, and refunds; respond to support requests; monitor, debug, and improve the Service; and comply with legal obligations. We do not sell your personal data.

Where the GDPR or similar laws apply, we process personal data on the bases of performance of our contract with you, our legitimate interests in operating and securing the Service, your consent (where required), and compliance with legal obligations.

We do not use Customer Content from commercial workspaces to train or improve general PurpleAILAB models by default. Product analytics contains usage metadata such as event type, model, token count, cost, latency, and prompt length, but not prompt, response, finding, evidence, or tool-result content. Learning-data review is limited to PurpleAILAB-owned synthetic or internal workspaces, or to customer data covered by a separate written authorization that identifies the purpose and controls.

We share personal data with service providers (subprocessors) who help us run the Service, under appropriate confidentiality and data-protection obligations. These include, for example: Polar (payments, taxes, and refunds), large language model providers used to generate and analyze engagement activity, and cloud infrastructure and email providers. We may also disclose data to comply with law, enforce our terms, or protect rights and safety. If we undergo a merger or acquisition, data may be transferred as part of that transaction.

We retain personal data for as long as your account is active or as needed to provide the Service, then for the period necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. You may request deletion as described below. Operational AI traces are kept under a separate, limited retention policy and are not copied into a persistent training dataset for commercial workspaces.

We use technical and organizational measures designed to protect personal data, including encryption in transit, access controls, and network isolation of sensitive infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

We may process and store data in countries other than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for cross-border transfers.

Depending on your location, you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us using the details below. We will respond consistent with applicable law.

We use strictly necessary cookies to keep you signed in and to secure the Service, and we may use limited analytics to understand usage. You can control cookies through your browser settings; disabling necessary cookies may break parts of the Service.

The Service is not directed to children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this Policy from time to time. We will indicate changes by updating the "Last updated" date and, where appropriate, provide additional notice.

For privacy questions or to exercise your rights, reach us through our contact page.