Privacy Policy

1. Heura Lab Platform & Services

Heura Lab provides AI-powered services to help organizations understand, anticipate, and influence human decisions using psychologically-grounded synthetic audiences. This Privacy Policy explains what personal information we collect, how we use and share it, and your choices when you visit our website, use our services, or communicate with us.

2. What This Policy Covers

This Privacy Policy applies to:

• Our website at heuralab.ai and all related subdomains;
• Our AI platform and services (the “Services”);
• Beta programs, pilots, and evaluation agreements;
• Communications with Heura Lab; and
• All personal information we collect from visitors, users, customers, and prospective customers.

This policy does not apply to third-party websites or services that may be linked from our website, which have their own privacy policies.

3. Information Heura Lab Collects

3.1 – Personal Information You Provide

When you create an account, sign up for a beta or pilot program, purchase a subscription, or contact us, you may provide personal information such as:

• Name, job title, and company name;
• Email address, phone number, and mailing address;
• Payment and billing information;
• Login credentials; and
• Any information you include in communications with us.

Personal information may also include information about your organization’s employees, operations, or other areas. All such information is collectively identified herein as “Customer Data.” You retain ownership of Customer Data, which we will process to provide the Services you have requested. For additional information about our AI data practices, see Section 6.

Regarding your organization’s customers and use cases, please submit only de-identified, anonymized, or aggregated data, which is not considered Customer Data and is not covered by this Privacy Policy. Moreover, the non-personal information identified in Section 3.2 does not constitute Customer Data.

3.2 – Information Automatically Collected

When you use our website or platform, the following type of information is automatically collected:

• “Log Data,” which is defined as information about IP address, browser type, operating system, pages visited, access dates and times, and referring URLs;
• “Device Information,” which is defined as information about hardware model, operating system version, and device identifiers; and
• “Usage Data,” which is defined as information about features used, actions taken, session duration, and interaction patterns.
• Cookies and similar technologies, which is further defined in Section 9 (Cookies & Tracking Technology).

3.3 – Cookies and Tracking Technologies

We use Google Analytics and similar technologies to operate our website and platform. For additional details about the technologies we use, their purposes and available choices, see Section 9.

3.4 – Information From Third Parties

We may receive information about you from:

• Business partners and integration providers if you connect third-party tools to our platform;
• Publicly available sources to verify business information; and
• Analytics and advertising partners, consistent with their own privacy policies.

4. How We Use Your Information

We use the information we collect to accomplish the following purposes:

• Provide our services by creating and managing accounts, delivering subscriptions, managing beta programs and pilots, and processing payments.
• Provide support by responding to questions, feedback, and support requests.
• Communicate with you by sending confirmations, invoices, security alerts, and updates about our Services, policies, and terms.
• Send marketing communications to share information about our products and services; you can unsubscribe at any time.
• Improve our platform by understanding how people use our Services, monitoring performance, and developing features.
• Protect our services by detecting and preventing fraud, abuse, and security threats.
• Meet legal obligations by complying with applicable laws, responding to legal requests, enforcing our agreements, and maintaining required records.

• For information about our use of Customer Data and any data used for AI research, training, or model improvement, see Section 6.

5. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data under the following legal bases:

• To ensure contract performance by processing necessary to deliver the Services you have requested;
• To serve legitimate interests such as improving our platform, preventing fraud, and communicating with customers about our services;
• To fulfil legal obligation by complying with applicable laws and regulations; and
• To ensure consent in providing marketing communications.

You may withdraw consent at any time where consent is the legal basis for processing, without affecting the lawfulness of prior processing.

6. How We Use AI and Your Data

6.1 – What We Do

• We use your Usage Data and platform interactions to improve platform performance and user experience;
• We use aggregated, fully de-identified data to research and improve our AI models; and
• We use Customer Data only to deliver the specific Services you have requested.

6.2 – What We Do Not Do

• We do not sell Customer Data;
• We do not use Customer Data to train, fine-tune, or improve our AI models without your written consent;
• We do not share Customer Data with third parties for their own AI training purposes;
• We do not attempt to re-identify de-identified data; and
• We do not use any personal information to make fully automated decisions that significantly affect you without human oversight.

6.3 – Automated Decision-Making Technology (ADMT) — California Disclosure

Our platform uses automated decision-making technology (ADMT) as part of its core AI Services. In compliance with the California Consumer Privacy Act (“CCPA”) regulations effective January 1, 2027, we disclose the following:

Purpose of ADMT: Our AI system uses psychologically-grounded synthetic audiences to model decision patterns, simulate outcomes, and generate recommendations to help organizations design better decision outcomes.

What is automated: The platform autonomously analyzes input data and generates decision models, simulations, and recommendations. Our AI does not make final decisions on behalf of our customers or their end users; all outputs are recommendations subject to human review.

Your rights: California residents have the right to access information about how ADMT is used in decisions affecting them and, in applicable circumstances, the right to opt out of ADMT processing. See Section 10 for how to exercise these rights.

Human oversight: Heura Lab maintains human oversight of our AI systems. We do not deploy fully autonomous decision-making that affects individuals without human review.

7. How We Share Your Information

We use service providers to help with hosting, payments, communications, analytics, and support. They may access the information needed to perform those services and their own privacy policies govern their use.

7.1 – Service Providers (Subprocessors)

We share information with trusted third-party vendors who help us operate our website and services, including:

• Cloud infrastructure providers (e.g., Google Cloud, Vercel);
• Payment and billing service providers (where applicable);
• Email and communications platforms;
• Analytics providers; and
• Customer support tools.

These providers are contractually required to protect your information and use it only for the purposes we specify. For a list of our current subprocessors, please email legal@heuralab.ai.

7.2 – Business Transfers

If Heura Lab is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

7.3 – Legal Requirements

We may disclose your information if required by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property, or safety of Heura Lab, our customers, or others.

8. Data Retention

We retain personal information for as long as necessary to provide our Services, fulfill the purposes described in this policy, and meet applicable legal obligations. How long we keep information depends on the type of data, why it was collected, and any applicable legal or contractual obligations. Customer Data is retained, returned, or deleted according to the applicable customer agreement. Server logs are generally cleared when application changes go live. Analytical data is retained as per the configuration in our Google Analytics settings. Payment records are retained as required by applicable tax and financial regulations. You may request deletion of your personal information at any time, subject to legal retention requirements. See Section 10 for information about submitting a deletion request.

9. Cookies and Tracking Technologies

We also use Google Analytics and similar technologies to understand how our website is being accessed and used. These technologies set essential and analytic cookies in your browser and process the information they obtain pursuant to their own privacy policies. Login sessions, security-related events, website usage, and platform functionality may be tracked. This information is used to ensure safe and secure operation of the website; it is not used to build advertising profiles and we do not use data collected on our platform for advertising personalization. You can manage cookies through your browser settings.

10. Your Privacy Rights

Under this policy, you have choices regarding your personal information. We honor the rights identified in Section 10.1 regardless of your location.

10.1 – Rights Available to Everyone

You have a right to:

• Request a copy of the personal information we hold about you;
• Ask us to correct inaccurate or incomplete information;
• Ask us to delete your personal information, subject to legal retention requirements; and
• Receive your personal information in a structured, machine-readable format.

You can unsubscribe from marketing emails at any time using the link in any email or by contacting info@heuralab.ai.

10.2 – California Residents (CCPA/CPRA)

California residents have additional rights under the CCPA and California Privacy Rights Act (“CPRA”), including the right to:

• Know the categories and specific pieces of personal information collected, the sources, why we collect it, and the categories of third parties receiving it;
• Request deletion, subject to applicable exceptions;
• Correct inaccurate personal information;
• Opt out of sale or sharing;
• Request we limit certain uses and disclosures of sensitive personal information to what is necessary to provide the Services; and
• Non-discrimination for exercising any CCPA right.

As noted in previous sections, we do not sell your personal information and we do not use personal information for cross-context behavioral advertising.

California residents may have rights to information about ADMT and, where applicable, to opt out of certain uses. See Section 6.3 for information about our AI Services.

To submit a California privacy request, contact us at legal@heuralab.ai. We will respond within 45 days. We may need to verify your identity before processing your request.

10.3 – EEA, UK, and Swiss Residents (GDPR)

In addition to the rights above, if you are located in the EEA, UK, or Switzerland, you have the right to:

• Object to processing based on legitimate interests;
• Restrict processing in certain circumstances;
• Withdraw consent at any time where consent is the basis for processing; and
• Lodge a complaint with your local data protection authority.

To reach us about such rights, contact us at legal@heuralab.ai.

11. Data Security

We take the security of your information seriously and implement commercially reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, or destruction. For more information about our security practices and controls, please visit: heuralab.ai/security/how-we-protect-your-data

In the event of a data breach that affects your personal information, we will notify you as required by applicable law, and in any case within 72 hours of discovery for breaches involving Customer Data.

No method of electronic transmission or storage is 100% secure. While we work hard to protect your information, we cannot guarantee absolute security.

12. International Data Transfers

Heura Lab is based in the United States. If you are accessing our Services from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.

13. Children’s Privacy

Our Services are not directed to individuals under the age of 16, and we do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16 without verifiable parental consent, we will take steps to delete that information. If you believe we may have collected information from a child under 16, please contact us at legal@heuralab.ai.

14. Third-Party Links and Integrations

Our website and platform may contain links to third-party websites and integrations with third-party services. This Privacy Policy does not apply to those third-party sites or services. When you connect a third-party integration to our platform, that third party’s privacy practices govern the data they collect. We are not responsible for the privacy practices of third-party integration providers and encourage you to review the privacy policies of any third parties you interact with through our platform.

15. Changes to This Policy

By using our site, you signify your consent to our policy. We may update this policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make material changes, we will:

• Post the updated policy at heuralab.ai/privacy with a new effective date; and
• Where required by law, seek your consent before applying material changes to how we process your existing information.

Your continued use of our Services after the effective date of any update constitutes your acceptance of the revised policy.

16. Contact Us

If you have questions regarding this Privacy Policy or our data practices, please contact us:

Email: legal@heuralab.ai

Mail: Heura Lab, Attn: Privacy Officer, One Hawthorne Street, Unit 22C, San Francisco, CA 94105

Website: heuralab.ai/privacy

Response time: We aim to respond to all privacy inquiries within 5 business days and to complete formal rights requests within 45 days.