Privacy policy

1Scope

This policy covers the Plenary Labs platform at plenarylabs.app and related applications and APIs. It does not cover third-party websites or services you reach through links.

2A note on Personas

Personas in the Service are fictional. They are machine-generated participant profiles, and the attributes they contain — including any age, background, occupation, or demographic characteristic — do not describe any real person and are not personal information about anyone.

If you submit information about a real individual to the Service, that is personal information and it is governed by Section 4.4 below.

3Information we collect

Account information. Name, email address, password credentials, company name, and role.

Billing information. Billing contact, address, and transaction records. Payment card details are collected and stored by our payment processor, Stripe; we do not store full card numbers.

Customer Content. Material you submit and material the Service generates for you — stimulus materials, Persona profiles, discussion guides, transcripts, and reports. This may contain personal information if you choose to include it.

Usage and technical data. Log records, IP address, browser and device information, pages viewed, features used, timestamps, and diagnostic data.

Service Data. Structural, numerical, and categorical data about how the Service runs, including token counts, latency, cost, model identifiers, and measures of simulation behavior such as sentiment categories, rating values, participation patterns, and impression scores. Service Data contains no free text from your Customer Content.

Configuration Data. How a simulation is set up as distinct from what it is about: Persona profiles and their personality, reasoning, and model settings; discussion guide structures and section lengths; room and run settings.

Communications. Support requests, feedback, and correspondence with us.

Cookies and similar technologies. See Section 8.

4How we use information

4.1 To provide the Service

To create and maintain your account, authenticate you, run simulations, generate reports, store your work, and provide support.

4.2 To transmit content to AI model providers

Operating the Service requires transmitting Customer Content to third-party artificial intelligence providers, which generate the simulated discussion. These providers may be located outside your country. A current list is at https://plenarylabs.app/subprocessors.

4.3 To bill, secure, and improve

To process payments, detect and prevent fraud and abuse, maintain security, monitor performance, and improve the Service.

Improvement work uses Service Data and Configuration Data — how simulations are set up and how they behave — under the license described in Section 6.3 of our Terms of Service. We use this to calibrate estimates, establish defaults, build templates and presets, evaluate our own models and orchestration logic, and produce aggregated research about simulation methodology. We do not publish or disclose it in any form that identifies you or reveals the subject matter of any Study. This license is a condition of access on standard plans; customers on an enterprise or negotiated plan may restrict it by written agreement.

4.4 Personal information you submit about others

If you submit personal information about a real individual — for example, by grounding a Persona in a real person’s details or uploading real research data — you are the controller of that information and we process it as your processor, on your instructions, under our Terms and any applicable Data Processing Addendum. You are responsible for having a lawful basis and any required consents. We do not independently verify the source of material you submit.

4.5 What we do not do

We do not sell your personal information. We do not share it for cross-context behavioral advertising.

We do not use your subject matter to train any machine learning model. Specifically, we do not use your stimulus materials, transcripts, worksheets, reports, or any other free text from your Customer Content to train, fine-tune, or improve any model, and we contractually require our model providers not to train on content transmitted through our integrations. This commitment does not extend to Service Data and Configuration Data as described in Section 4.3, or to Shared Assets you choose to publish.

5Legal bases (EEA, UK, Switzerland)

Where GDPR or UK GDPR applies, we rely on: contract (to provide the Service you requested), legitimate interests (security, fraud prevention, service improvement, business operations), consent (where required, such as certain cookies and marketing), and legal obligation (tax, accounting, and responses to lawful requests).

6Sharing

We share information with:

• Service providers and subprocessors — hosting, AI model providers, payment processing, analytics, email delivery, and customer support, each bound by confidentiality and data protection obligations and permitted to use the information only to provide services to us. Current list: https://plenarylabs.app/subprocessors.
• Other users — only for Shared Assets you affirmatively elect to publish. Publishing is optional and per asset. Review an asset before publishing; it may reveal information about your work.
• Your organization — if you use the Service under a team or enterprise account, your administrator may access your account and content.
• Legal and safety — where required by law, subpoena, or court order, or to protect our rights, users, or the public. We will notify you of a legal demand for your content unless prohibited.
• Business transfers — in a merger, acquisition, financing, or sale of assets, subject to this policy or a successor policy with materially similar protections.

7Retention

We keep account and billing records for the life of your account and for as long afterward as needed for legal, tax, and accounting purposes, typically seven (7) years.

Customer Content is retained until you delete it or until thirty (30) days after account termination, after which we delete it from active systems. Residual copies may persist in backups for up to ninety (90) days.

Service Data and aggregated, de-identified data may be retained indefinitely.

8Cookies

We keep this minimal, deliberately.

Strictly necessary cookies. We use first-party cookies for authentication, session management, and security. These are required for the Service to function and cannot be disabled while you are signed in.

Analytics. We use privacy-preserving, cookieless analytics that measure aggregate traffic and feature usage without storing identifiers on your device, without cross-site tracking, and without building a profile of you.

We do not use advertising, retargeting, or cross-site tracking cookies, and we do not embed third-party advertising tags.

Because we set no non-essential cookies and our analytics store nothing on your device, we do not display a cookie consent banner. If we later adopt a technology that requires consent, we will implement a consent mechanism and update this policy before doing so. You can control cookies through your browser settings; blocking strictly necessary cookies will prevent you from signing in.

9Your rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information; to object to or restrict processing; to withdraw consent; and to not be discriminated against for exercising these rights.

Texas residents have rights under the Texas Data Privacy and Security Act, including the right to confirm, access, correct, delete, obtain a portable copy, and opt out of sale, targeted advertising, and certain profiling. We do not sell personal data or use it for targeted advertising.

California residents have rights under the CCPA/CPRA, including to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as those terms are defined.

EEA, UK, and Swiss residents have rights under GDPR, including the right to lodge a complaint with a supervisory authority.

To exercise a right, contact jammil@twelvethirty-4.com. We will verify your identity before responding and will respond within the period required by applicable law. You may use an authorized agent where the law permits. If we deny a request, you may appeal by writing to jammil@twelvethirty-4.com with “Appeal” in the subject line.

If you are an end user of a customer’s team account, direct your request to that customer; we will refer you to them.

10International transfers

We are based in the United States and process information there. Our model providers and other subprocessors may process information in the United States and other countries.

The Service is available worldwide. Where we transfer personal information out of the European Economic Area (the EU member states plus Iceland, Liechtenstein and Norway), the United Kingdom, or Switzerland, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with supplementary measures including encryption in transit and at rest.

Data Processing Addendum. Customers subject to GDPR, UK GDPR, or comparable laws may request our Data Processing Addendum, which incorporates the Standard Contractual Clauses and the UK Addendum, by writing to jammil@twelvethirty-4.com. Once executed, it forms part of our agreement with you.

EU and UK representative. We do not maintain an establishment in the EEA or the UK. Where Article 27 of the GDPR or UK GDPR requires it, we will appoint a representative and name them here and at https://plenarylabs.app/subprocessors.

11Security

We use administrative, technical, and physical safeguards including encryption in transit and at rest, access controls, logging, and regular review. No system is completely secure, and we cannot guarantee absolute security. Notify us at jammil@twelvethirty-4.com of any suspected compromise.

12Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal information from children. If we learn we have, we will delete it. Contact jammil@twelvethirty-4.com if you believe a child has provided us information.

13Automated processing

The Service generates simulated discussions using AI models. These outputs describe fictional participants and are not decisions about any real person. We do not use automated processing to make decisions producing legal or similarly significant effects about individuals.

14Changes

We may update this policy. We will post the new version with a revised date and, for material changes, notify you by email or in the Service at least fifteen (15) days before it takes effect.

15Contact

Privacy and security: jammil@twelvethirty-4.com

EU/UK representative under Article 27 GDPR: not currently appointed. See Section 10.