Privacy Policy

Privacy Policy

Effective Date: 01 March 2026

Last Updated: 10 March 2026

This Privacy Policy (“Policy”) describes how Chariot Technologies Lab, Inc., a Delaware corporation (“Company”, “we”, “us”, or “our”), collects, uses, discloses, and otherwise processes personal information and certain other data in connection with the EXTELLA.AI web-based service, including any websites, applications, interfaces, dashboards, APIs (if any), software, documentation, and related services we provide (collectively, the “Service”). This Policy applies to all users of the Service (“you” or “User”), including individuals who access the Service on behalf of an entity. By accessing or using the Service, you acknowledge that you have read and understood this Policy. This Policy describes Company’s collection, use, disclosure, and other processing of personal information in connection with the Service, including when we transmit Inputs (and related data) to Third-Party AI Services or other Third-Party Services to provide the Service at your direction. Third-Party AI Services and other Third-Party Services operate under their own terms and privacy policies, which govern their independent processing activities. This Policy does not govern those third parties’ independent processing; however, it governs Company’s processing and disclosures in connection with the Service. We encourage you to review the privacy policies of Third-Party AI Services and any other Third-Party Services you choose to access or enable.

1. DEFINITIONS

1.1. Capitalized terms used in this Policy have the meanings set forth in our Terms of Use, unless

otherwise defined here. Key terms include: “Account” means the registered account associated with a User; “Inputs” means Content you provide to the Service for processing, including prompts, files, links, structured data, and Variables; “Outputs” means Content generated, returned, or surfaced by the Service in response to Inputs, including responses, summaries, classifications, recommendations, generated code, Experts, and Pipelines; “User Content” means Inputs and any other Content you submit, upload, transmit, or make available through the Service, including Experts and Pipelines you create; “Variables” means secrets, tokens, credentials, keys, or configuration values you provide for a specific task execution or integration; “Expert(s)” means executable modules containing scripts, functions, tools, APIs, any types of software (including but not limited to AI and ML models) or callable routines created by you, created by the Service at your direction, or made available by the Service (including templates) that may be executed or used within the Service to perform certain tasks “Pipeline(s)” means combinations of Experts (and/or other steps or auxiliary modules) either fixed or orchestrated by AI model and configured to perform repeatable automation workflows; “Usage Data” means de-identified and/or aggregated data derived from your use of the Service; “Third-Party Services” means any third-party sites, platforms, software, data sources, plugins, integrations, or services you connect to, use, or access via the Service; “Third-Party AI Services” means third-party AI models and related services used by the Service; “Sensitive Personal Information” has the meaning set forth in the Terms of Use and includes government-issued identification numbers, biometric identifiers, genetic data, financial account credentials, and other categories designated as sensitive under applicable law.

2. INFORMATION WE COLLECT

We collect information in the following categories:

2.1. Account and Registration Data. When you create an Account, we may collect:

• (a) First name and last name;
• (b) Email address;
• (c) Occupation or professional role (if provided);
• (d) Account credentials;
• (e) Account preferences and settings.

2.2. User Content and Task Data. When you use the Service, we process:

• (a) Inputs: prompts, questions, instructions, files, documents, images, links, and other data

you provide for processing by the Service;

• (b) Outputs: AI-generated responses, content, code, summaries, Experts, Pipelines, and other

results produced by the Service;

• (c) Variables: credentials, API tokens, keys, and configuration values you provide for

specific task executions. Company does not store your Third-Party Service passwords or API keys as general account-level credentials. Variables are processed as necessary to perform the requested task. While we implement measures designed to avoid logging sensitive credential values (such as redaction or masking where technically feasible), Variables or portions thereof may be retained in system logs or operational records as described in Section 10. We strongly recommend that you use short-lived tokens, restricted scopes, and least-privilege permissions, and that you rotate or revoke credentials if you suspect compromise;

• (d) Experts and Pipelines: Automation configurations, scripts, and workflows you create or

configure.

2.3. Usage and Telemetry Data. We automatically collect information about your use of the Service,

including:

• (a) Feature usage patterns and interactions;
• (b) Session information (timestamps, duration, frequency);
• (c) Task execution logs and error logs;
• (d) Experts’ properties and usage metrics;
• (e) Performance metrics and diagnostics;
• (f) Credit consumption and billing events.

2.4. Device and Technical Data. We collect technical information from your device, including:

• (a) IP address;
• (b) Browser type, version, and settings;
• (c) Operating system and platform;
• (d) Device identifiers and characteristics;
• (e) Time zone and language preferences;
• (f) Referring URLs and pages visited.

2.5. Cookies and Similar Technologies. We use cookies and similar tracking technologies to collect

information about your interactions with the Service.

2.6. Payment Information. We do not directly collect or store your payment card information.

Payments are processed by our third-party Payment Processor, which collects and processes payment information under its own terms and privacy policy. We receive limited transaction information from the Payment Processor.

2.7. Communications and Support Data. We collect information when you contact us, including:

• (a) Support requests and correspondence;
• (b) Feedback, suggestions, and bug reports;
• (c) Survey responses;
• (d) Communications preferences.

2.8. Sharing Program Data. If you opt in to the optional Sharing Program for Experts and Pipelines,

we collect and process the Experts and Pipelines you choose to share, subject to the eligibility filters and exclusions described in our Terms of Use. Company may apply technical or operational filters designed to reduce the likelihood that shared content contains personal data, Sensitive Personal Information, or Variables; however, Company is not obligated to do so, and you are solely responsible for ensuring that content you share through the Sharing Program does not include such information.

2.9. Entity Accounts and Authorized Users (if applicable). If the Service offers the functionality to

create or join entity-level accounts, and you access the Service through an Account associated with an entity: (a) the entity and its designated administrators may have the ability to access, monitor, restrict, or delete information associated with your use of the Service, including User Content, usage data, and Account settings, in accordance with the entity’s policies and our Terms of Use; (b) the entity may control certain privacy settings and data retention practices applicable to your use; (c) your use of the Service is subject to the entity’s own policies, which may impose additional requirements or restrictions; (d) if you have questions about your entity’s data practices or administrator access rights, please contact your entity administrator. Company is not responsible for the privacy practices of entities that use the Service. If you are an Authorized User under an Entity Account (if such feature is available), you should direct privacy inquiries regarding the entity’s practices to the Entity.

2.10. Sensitive and Regulated Data. We do not intend to collect, and you should not provide, the

following categories of information unless expressly permitted by Company in writing: (a) Sensitive Personal Information as defined in our Terms of Use (including government-issued identification numbers, biometric identifiers, genetic data, and financial account credentials); (b) protected health information subject to HIPAA or similar healthcare privacy laws; (c) payment card data subject to PCI DSS (other than through our Payment Processor); (d) personal information of children under 18; or (e) Other information subject to heightened legal or contractual protections. If such information is included in User Content despite this restriction, it may be processed as part of providing the Service. We recommend that you avoid including sensitive or regulated data in Inputs. You are solely responsible for ensuring that you have all required consents and legal bases for any personal data you provide, including data relating to third parties.

3. SOURCES OF INFORMATION

3.1. We collect information from the following sources:

• (a) Directly from you: when you create an Account, use the Service, submit User Content,

provide Variables, contact support, or communicate with us;

• (b) Automatically from your use of the Service: through cookies, log files, and similar

technologies when you access or use the Service;

• (c) From Third-Party Services: when you connect Third-Party Services to the Service, we

may receive information from those services as authorized by you;

• (d) From Third-Party AI Services: AI model providers process Inputs and return Outputs

as part of Service functionality.

• (e) From Payment Processors: transaction confirmation and limited billing information.

4. HOW WE USE YOUR INFORMATION

We use your information for the following purposes:

4.1. Providing and Operating the Service:

• (a) Creating and managing your Account;
• (b) Executing Experts, Pipelines, and automated tasks;
• (c) Routing requests to Third-Party AI Services to process your Inputs and generating

Outputs;

• (d) Processing Variables for task execution with Third-Party Services;
• (e) Providing customer support.

4.2. Billing and Payments:

• (a) Processing Credit purchases and Subscriptions;
• (b) Managing billing, invoicing, and refunds;
• (c) Preventing payment fraud.

4.3. Service Improvement and Development:

• (d) Analyzing usage patterns to improve features and functionality;
• (e) Debugging, troubleshooting, and fixing errors;
• (f) Developing new features and capabilities;
• (g) Conducting internal research and analytics;
• (h) Improving safety, security, and quality.

4.4. Security and Fraud Prevention:

• (i) Detecting, investigating, and preventing security incidents;
• (j) Protecting against fraud, abuse, and unauthorized access;
• (k) Enforcing our Terms of Use and policies;
• (l) Monitoring for violations of acceptable use.

4.5. Communications:

• (a) Sending operational, security, and administrative notices;
• (b) Responding to inquiries and support requests;
• (c) Providing updates about the Service.

4.6. Legal Compliance:

• (a) Complying with applicable laws and regulations;
• (b) Responding to lawful requests from authorities;
• (c) Establishing, exercising, or defending legal claims.

4.7. De-identification and Aggregation. Where permitted by applicable law, we may create and use

Usage Data (de-identified and/or aggregated data) for analytics, benchmarking, product development, safety, and business purposes. Usage Data does not directly identify you.

5.1. If you are located in the European Economic Area (“EEA”) or the United Kingdom (“UK”), we

process your personal data based on one or more of the following legal bases under the General Data Protection Regulation (“GDPR”) or UK GDPR: Purpose Legal Basis Providing and operating the Service Performance of contract (Article 6(1)(b)) Billing and payments Performance of contract; Legal obligation Service improvement and analytics Legitimate interests (improving the Service) Security and fraud prevention Legitimate interests (protecting the Service and users); Legal obligation Operational communications Performance of contract; Legitimate interests Legal compliance Legal obligation (Article 6(1)(c)) De-identification and aggregation Legitimate interests Marketing communications (if any) Consent (Article 6(1)(a)); Legitimate interests When we rely on legitimate interests, we have balanced our interests against your rights and determined that our processing does not unduly impact your privacy. You have the right to object to processing based on legitimate interests.

5.2. Data Controller and Processor Roles. Under GDPR and UK GDPR, a “controller” determines

6. AI AND AUTOMATED PROCESSING

6.1. How AI Processing Works. The Service uses Third-Party AI Services to process your Inputs and

generate Outputs. When you submit Inputs: (a) your Inputs are transmitted to our systems and are routed to Third-Party AI Services as necessary to generate Outputs; (b) AI models process your Inputs to generate Outputs based on patterns learned from training data; (c) Outputs are returned to you through the Service.

6.2. Personal Data in Inputs and Outputs. Inputs may contain personal data if you choose to

include it (for example, names, contact information, or other identifying details in prompts or uploaded files). Outputs may also contain personal data, either reflecting information from your Inputs or generated by the AI model. You are responsible for ensuring that you have appropriate rights, permissions, and consents to provide any personal data in Inputs, and for reviewing Outputs before using, publishing, or sharing them.

6.3. Accuracy and Limitations. AI-generated Outputs are probabilistic and may contain errors,

inaccuracies, omissions, or “hallucinations”. Outputs may not be current, complete, or suitable for your intended purpose. You must independently verify Outputs before relying on them. We do not guarantee the accuracy, completeness, or reliability of Outputs.

6.4. Third-Party AI Services. Third-Party AI Services are provided by independent third parties with

their own terms, privacy policies, and data practices. These providers may: (a) apply content moderation, safety filters, or other controls; (b) process Inputs and Outputs according to their own policies; (c) retain data as permitted by their terms. We do not control the internal operations, training practices, or data retention policies of Third-Party AI Services.

6.5. Service Learning and Personalization. Company does not develop or train AI models. All AI

model capabilities are provided by Third-Party AI Services. However, the Service may improve and become more capable for you over time through the creation and accumulation of Experts and Pipelines within your Account. As you use the Service, it may generate Experts and Pipelines to perform tasks, and these may be retained and reused to assist you with similar tasks in the future. This means that more extensive and varied use of the Service may result in a broader set of tools available within your Account. For clarity, the fact that Company does not train AI models does not limit Company’s right to use User Content and Outputs to develop, improve, and enhance the Service (including safety, security, and functionality) as described in Sections 4.3,

4.7, and our Terms of Use. The Service may also store and memorize certain instructions, corrections, preferences, and other guidance provided by you during interactions with the Service. Such information may be used to adapt the behavior of the Service and its Outputs to better reflect the User’s preferences and working style over time. For example, the Service may remember preferred formats, instructions, approach, style or adjustments previously provided or instructed by the User and apply them in future interactions within the User’s Account. This functionality is intended to enhance usability and personalization of the Service for the User. The information remembered by the Service may be associated with the User’s Account and may be used to personalize future interactions with the Service. Such use forms part of the Service functionality and does not constitute training of AI models by the Company.

6.6. Third-Party AI Model Training. Third-Party AI Services may have their own policies regarding

the use of data for model training. Where Third-Party AI Services offer options to limit or opt out of model training, Company may utilize such options; however, Company cannot control, verify, or guarantee the data practices of Third-Party AI Services. You should review the applicable Third-Party AI Service’s privacy policy and terms for information about their model training practices.

6.7. Human Review. In limited circumstances, Company personnel may review User Content

(including Inputs and Outputs) for purposes such as: (a) investigating reported safety concerns or policy violations; (b) debugging and troubleshooting technical issues; (c) responding to legal requests; (d) quality assurance and safety evaluation. Such review is conducted under strict access controls and confidentiality obligations.

6.8. Automated Decision-Making. The Service does not make significant automated decisions that

produce legal effects or similarly significant effects on you solely based on automated processing, without human involvement. The Service provides AI-generated Outputs that you review and decide whether to use.

7. DISCLOSURE AND SHARING OF INFORMATION

We may disclose your information in the following circumstances:

7.1. Service Providers and Processors. We share information with third-party service providers who

perform services on our behalf, including:

• (a) AI Model Providers: Third-Party AI Services that process Inputs and generate Outputs

(currently Anthropic (you can review Anthropic’s privacy practices at https://www.anthropic.com/privacy); additional providers may be added);

• (b) Cloud Infrastructure: Hosting, storage, and computing services (currently Digital

Ocean; additional providers may be added);

• (c) Payment Processors: Processing payments and billing;
• (d) Analytics Providers: Analyzing usage and improving the Service;
• (e) Security Services: Fraud detection, threat monitoring, and security;
• (f) Communication Services: Email delivery and customer support tools.

Service providers are contractually obligated to use your information only to perform services for us and to maintain appropriate security measures.

7.2. Third-Party Services You Connect. When you connect Third-Party Services through the

Service, we transmit information necessary to perform the tasks you request, including Inputs and Variables you provide. The applicable third party’s privacy policy governs their processing.

7.3. Sharing Program Participants. If you opt in to the Sharing Program, your shared Experts and

Pipelines may be made available to other users as described in our Terms of Use. Company may, but is not obligated to, apply technical or operational filters designed to reduce the likelihood that shared content contains personal data, Sensitive Personal Information, Variables, or other excluded content. However, such filters do not guarantee exclusion, and you are solely responsible for ensuring that any Experts or Pipelines you share through the Sharing Program do not include personal data, confidential information, credentials, or other prohibited content. By participating in the Sharing Program, you represent and warrant that your shared content complies with the requirements in our Terms of Use.

7.4. Legal Compliance and Protection. We may disclose information when we believe in good faith

that disclosure is necessary to: (a) comply with applicable law, regulation, or legal process; (b) respond to lawful requests from governmental authorities; (c) enforce our Terms of Use and policies; (d) protect the rights, property, or safety of Company, users, or others; (e) detect, prevent, or address fraud, security, or technical issues.

7.5. Business Transfers. In connection with a merger, acquisition, reorganization, sale of assets,

financing, or similar transaction, your information may be transferred to the successor entity, subject to this Policy or a successor policy.

7.6. Aggregated and De-identified Data. We may share aggregated or de-identified Usage Data that

does not reasonably identify you for analytics, research, benchmarking, and business purposes.

7.7. With Your Consent. We may share your information with third parties when you direct us to do

so or provide consent.

7.8. Sale and Sharing of Personal Information. We do not sell your personal information for

monetary or other valuable consideration. We do not intentionally “share” personal information for cross-context behavioral advertising as those terms are defined under applicable privacy laws. However, certain analytics or advertising technologies integrated into the Service may involve data sharing that could be deemed “sharing” under applicable law. Where required, we honor opt-out requests, including through recognized opt-out preference signals such as Global Privacy Control (see Section 8.4). You may also exercise your opt-out rights by contacting us as described in Section 12.

8. COOKIES AND TRACKING TECHNOLOGIES

8.1. Types of Technologies Used. We use the following technologies to collect information:

• (a) Cookies: small text files stored on your device that help us recognize you and remember

your preferences;

• (b) Web Beacons/Pixels: small graphic images that track whether you have viewed content

or opened emails;

• (c) Local Storage: HTML5 local storage and similar technologies for storing data on your

device.

8.2. Categories of Cookies:

Category Purpose Strictly Necessary Essential for the Service to function (authentication, security, load balancing). Cannot be disabled. Functional Remember your preferences and settings to enhance your experience. Analytics/Performance Collect information about how you use the Service to help us improve. Advertising Deliver relevant advertising and measure effectiveness.

8.3. Managing Cookies. You can manage your cookie preferences through:

• (a) Browser Settings: most browsers allow you to refuse or delete cookies. Note that

disabling cookies may affect Service functionality;

• (b) Cookie Banner/Settings: we may provide a cookie preference center where you can

manage non-essential cookies. Where required by applicable law, we obtain your consent before setting non-essential cookies. You may withdraw your consent at any time by adjusting your preferences through our cookie settings or by using browser controls. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

8.4. Opt-Out Preference Signals. Certain jurisdictions require that we recognize browser-based

opt-out preference signals, such as the Global Privacy Control (“GPC”). Where required by applicable law, we will treat a recognized opt-out preference signal as a valid request to opt out of the sale or sharing of personal information associated with that browser or device. You can learn more about GPC at https://globalprivacycontrol.org. If you use an opt-out preference signal, note that it applies to the specific browser or device from which you send it; you may need to enable the signal on each browser or device you use.

9. INTERNATIONAL DATA TRANSFERS

9.1. Data Location. The Service is operated from the United States. Your information may be

processed, stored, and transferred to the United States and other countries where Company, its service providers, or Third-Party AI Services operate.

9.2. EEA/UK Transfers. If you are located in the EEA or UK, your personal data may be transferred

to countries outside the EEA/UK that may not provide the same level of data protection. When we transfer personal data outside the EEA/UK, we implement appropriate safeguards, which may include:

• (a) Standard Contractual Clauses (SCCs): EU Commission-approved SCCs for data

transfers;

• (b) UK International Data Transfer Agreement (IDTA) or UK Addendum: For transfers

from the UK;

• (c) Adequacy Decisions: Transfers to countries recognized as providing adequate protection.

You may request a copy of the applicable transfer safeguards by contacting us.

9.3. Other International Transfers. For users in other jurisdictions, we comply with applicable data

transfer requirements under local law.

10. DATA RETENTION AND DELETION

10.1. Retention Periods. We retain your information for as long as necessary to fulfill the purposes

described in this Policy, unless a longer retention period is required or permitted by law. Retention periods vary based on the type of data, purpose, operational requirements, and applicable law. The following are general guidelines and may vary: Data Category Retention Period Account Data Generally, for the duration of your Account and a reasonable period thereafter for operational wrap-up. Inputs and Outputs As necessary to provide the Service; Company has no obligation to retain or provide copies (see Section 10.3). Experts and Pipelines As necessary to provide the Service, or until deleted by you; Company has no obligation to retain. Usage and Log Data Generally retained for operational and security purposes; periods may vary. Payment Records As required for tax, accounting, and legal compliance. Support Communications Generally retained for a reasonable period after resolution.

10.2. Deletion. You may request deletion of your personal data as described in Section 12. When you

delete User Content or your Account: (a) deletion may not be immediate; we process deletion requests within a reasonable timeframe; (b) residual copies may remain in backups, logs, or archives for a limited period; (c) we may retain information as required by applicable law, legal process, or to establish, exercise, or defend legal claims.

10.3. No Obligation to Store. Except as expressly stated in this Policy or required by applicable law,

Company has no obligation to store, maintain, archive, or provide you with copies of any User Content, Inputs, Outputs, Experts, Pipelines, or other data. You are solely responsible for exporting, backing up, and preserving your data as needed.

11. SECURITY MEASURES

11.1. We implement technical, administrative, and organizational measures designed to protect your

12. YOUR PRIVACY RIGHTS

12.1. Rights for All Users. Depending on where you reside, you may have certain rights regarding

your personal information. To exercise these rights, contact us using the information in Section 15.

• (a) Access: you may request information about the personal data we hold about you and

obtain a copy;

• (b) Correction: you may request that we correct inaccurate or incomplete personal data;
• (c) Deletion: you may request that we delete your personal data, subject to certain

exceptions;

• (d) Account Closure: you may close your Account through the Service or by contacting us.

12.2. Rights for U.S. State Residents. If you are a resident of California, Virginia, Colorado,

Connecticut, Utah, Delaware, or another U.S. state with comprehensive privacy legislation, you may have additional rights, including:

• (a) Right to Know/Access: the right to know what personal information we collect, use,

disclose, and to obtain a copy of your personal information;

• (b) Right to Delete: the right to request deletion of your personal information, subject to

certain exceptions;

• (c) Right to Correct: the right to request correction of inaccurate personal information;
• (d) Right to Opt Out of Sale/Sharing and Targeted Advertising: you have the right to opt

out of the sale or sharing of personal information, and the processing of personal information for targeted advertising. We do not sell personal information for monetary or other valuable consideration. We do not intentionally share personal information for cross-context behavioral advertising; however, as described in Section 7, certain analytics or advertising technologies integrated into the Service may involve data sharing that could be deemed “sharing” under applicable law. Where required, we honor valid opt-out requests, including through recognized opt-out preference signals (see Section 8.4);

• (e) Right to Opt Out of Profiling: the right to opt out of profiling in furtherance of

decisions that produce legal or similarly significant effects. We do not engage in such profiling;

• (f) Sensitive Personal Information: as described in our Terms of Use, you should not

submit Sensitive Personal Information to the Service unless expressly permitted by Company in writing. We do not intend to collect or solicit Sensitive Personal Information. If you provide Sensitive Personal Information despite this restriction, we will process it only as necessary to provide the Service, maintain security, or comply with legal obligations, and we will protect it in accordance with applicable law. You may request deletion of such information as described in this Section 12;

• (g) Right to Non-Discrimination: we will not discriminate against you for exercising your

privacy rights;

• (h) Authorized Agents: you may designate an authorized agent to submit requests on your

behalf. We may require verification of the agent’s authority;

• (i) Appeals (where applicable): Certain U.S. state privacy laws provide a right to appeal if

12.3. Rights for EEA/UK Residents. If you are located in the EEA or UK, you have rights under the

GDPR/UK GDPR, including:

• (a) Access: the right to obtain confirmation of whether we process your personal data and to

access that data;

• (b) Rectification: the right to have inaccurate personal data corrected;
• (c) Erasure: the right to have your personal data erased in certain circumstances;
• (d) Restriction: the right to restrict processing in certain circumstances;
• (e) Portability: the right to receive your personal data in a structured, commonly used,

machine-readable format and to transmit it to another controller;

• (f) Objection: the right to object to processing based on legitimate interests or for direct

marketing;

• (g) Withdrawal of Consent: where processing is based on consent, you may withdraw

consent at any time without affecting the lawfulness of prior processing;

• (h) Complaint: you have the right to lodge a complaint with a supervisory authority in your

country of residence.

12.4. How to Exercise Your Rights. To exercise your rights, please contact us at:

13. CHILDREN AND MINORS

13.1. The Service is intended for adults. You must be at least 18 years old and the age of majority in

14. CHANGES TO THIS PRIVACY POLICY

14.1. We may update this Privacy Policy from time to time to reflect changes in our practices,

technologies, legal requirements, or for other operational reasons. When we make changes, we will:

• (a) Update the “Last Updated” date at the top of this Policy;
• (b) Post the revised Policy on the Service;
• (c) For material changes, provide additional notice (such as email notification or in-Service

notice) where required by applicable law. We encourage you to review this Policy periodically. Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Policy.

15. CONTACT US

15.1. If you have questions, concerns, or requests regarding this Privacy Policy or our data practices,