Privacy Policy

1.1 When we are the controller

Auto Lab is the controller (or “business”) of the personal information we collect to run our business, such as account and contact information, information about how you use the Service, and your communications with us.

1.2 When we act for our customers

We provide the Service to organizations. When we process personal information contained in Customer Data on behalf of a customer, such as the contents of a mailbox the customer connects, documents it uploads, or information about the people its agents research or contact, we act as that customer’s processor (or “service provider”). The customer’s own privacy notice governs that processing, and the customer is responsible for providing any required notices and obtaining any required consents. If your information is processed through the Service by one of our customers and you wish to exercise your privacy rights, please contact that customer directly. We will assist our customers in responding to such requests as required by law.

1.3 What this Policy does not cover

This Policy does not apply to third-party websites or services, including those you connect to the Service and those an agent visits on your behalf. Their own privacy policies govern how they handle information.

2.1 Information you provide

• Account and contact information, such as your name, email address, organization, role, profile photo, and sign-in details.
• Goals and content, such as goal descriptions, instructions, messages to agents, answers and approvals, files, and other content you submit.
• Team information, such as the names, email addresses, and roles of colleagues you invite.
• Credentials and secrets, such as usernames, passwords, and API keys you choose to save so that agents can sign in to services on your behalf. These are stored encrypted.
• Billing information, such as your billing contact and payment details. Payment card details are collected and processed by our payment processor, and we do not store full card numbers.
• Communications, such as information you provide when you contact support, respond to a survey, or give feedback.

2.2 Information from connected accounts and channels

When you or your organization connects a Third-Party Service, we collect the information you authorize the Service to access. Depending on the service and the permissions you grant, this may include email messages and their metadata, calendar entries, contacts, documents, chat messages, and records from business applications. If you link a phone number to communicate with an agent by text message, we collect that phone number and the content of the messages you exchange with the agent.

2.3 Information agents collect for your goals

To carry out your goals, agents may search the web, read publicly available pages, and visit websites, including by signing in to accounts you authorize. In doing so they may collect information about businesses and individuals, such as names, job titles, business contact details, and public posts. This information forms part of Customer Data.

2.4 Information collected automatically

• Device and log information, such as IP address, browser and operating system type, device identifiers, referring addresses, pages viewed, and the dates and times of access.
• Usage information, such as the features you use, the actions you take, and the performance of agent work.
• Diagnostic information, such as crash reports, error logs, and performance data.
• Cookies and similar technologies, as described in Section 7.

2.5 Information from third parties

If you sign in through a third-party identity provider, we receive information from that provider, such as your name, email address, and profile photo, in accordance with your settings with that provider. We may also receive information about you from your organization, for example when an administrator invites you to the Service.

4.1 Model processing

The Service processes Customer Data with artificial intelligence models, operated by us or by third-party providers, to generate Outputs and to carry out agent actions. We share Customer Data with those providers only as needed to provide the Service.

4.2 No model training

We do not use Customer Data to train or fine-tune generalized artificial intelligence models.

4.3 Workspace learning

Agents may record notes, preferences, and similar learned material in your organization’s workspace so that they work better on your goals. This material stays within your organization’s workspace, is visible to members with access, and can be reviewed, edited, or undone in the Service.

4.4 Human access

Auto Lab personnel access Customer Data only as needed to provide support you request, to investigate and resolve technical or security issues, to address abuse, or to comply with law, and always subject to confidentiality obligations and access controls.

4.5 Automated decisions

Auto Lab does not make decisions about you that produce legal or similarly significant effects based solely on automated processing.

10.1 Choices available to everyone

• Review and update your account information in your account settings.
• Disconnect any connected account and revoke saved credentials in the Service at any time. You can also revoke access in the settings of the Third-Party Service.
• Pause, stop, or delete goals, and delete your account from your account settings.
• Unlink a phone number to stop text message communication with an agent.
• Unsubscribe from non-essential emails by following the instructions in them. We will continue to send messages about your account, security, and the Service.

10.2 European Economic Area, United Kingdom, and Switzerland

We process personal information on the following legal bases: to perform our contract with you or your organization; for our legitimate interests in operating, securing, and improving the Service and communicating with you, where those interests are not overridden by your rights; with your consent, which you may withdraw at any time; and to comply with legal obligations.

Subject to applicable law, you have the right to access, correct, delete, restrict, and receive a portable copy of your personal information, and to object to its processing, including processing based on our legitimate interests and processing for direct marketing. You also have the right to lodge a complaint with your local data protection supervisory authority.

10.3 United States residents

Depending on your state of residence, including California, Colorado, Connecticut, Oregon, Texas, Utah, and Virginia, you may have the right to know about and access the personal information we hold about you, to correct it, to delete it, to receive a portable copy of it, and to opt out of its sale, its sharing for cross-context behavioral advertising, targeted advertising, and certain profiling. We do not sell or share personal information, and we do not engage in targeted advertising or in profiling that produces legal or similarly significant effects. We will not discriminate against you for exercising any of these rights.

In the preceding twelve months we collected the following categories of personal information, from the sources described in Section 2, for the purposes described in Section 3, and disclosed them for business purposes to the recipients described in Section 5:

Identifiers

Name, email address, phone number, IP address, and account identifiers.

Professional information

Organization name, role, and business contact details.

Commercial information

Plan, billing, and transaction records.

Internet activity

Usage, log, device, and diagnostic information about your use of the Service.

Approximate location

General location derived from your IP address.

Account credentials

Sign-in details and the website credentials you choose to save for your agents.

Communications

Messages, emails, files, and other content you submit or connect to the Service.

Account credentials are sensitive personal information. We use them only to provide the Service as you request and not to infer characteristics about you. We retain each category for the periods described in Section 6.

You may use an authorized agent to submit a request on your behalf, in which case we may require proof of the agent’s authority and verification of your identity. If we decline your request, you may appeal by replying to our decision; if your appeal is denied, you may contact your state attorney general.

10.4 How to exercise your rights

To exercise any of these rights, email hello@auto-lab.ai with the subject line “Privacy request.” We will verify your identity before responding and will respond within the period required by applicable law. If your information is processed as Customer Data on behalf of one of our customers, we may refer your request to that customer.