Rebel Labs | Privacy Policy

1. Who This Policy Is For

This Policy applies to:

Visitors to the Site.
Customers and Platform users, meaning people who access the Platform on behalf of an organization that has a contract with us (a “Customer“), including people invited to view simulation results or interview recordings.
Prospects and business contacts, meaning people we communicate with about our services.
Job applicants and contractors, to the extent not covered by a separate notice.

This Policy does not apply to research participants. If you take part in one of our interviews or surveys, the Participant Privacy Notice at https://rebellabs.com/participant-privacy and the Participant Agreement at https://rebellabs.com/participant-agreement govern our use of your information, not this Policy.

2. Information We Collect

2.1 Information you provide

Account and profile information: name, work email address, job title, organization, password or single sign-on credentials, and profile settings when you or your organization creates a Platform account.
Communications: the contents of emails, forms, meeting requests, support tickets, and other messages you send us, including through the Site’s contact or demo request forms.
Customer content: prompts, questions, scenarios, documents, datasets, and other material that you or your organization submit to the Platform (“Inputs“), and the outputs the Platform generates in response (“Outputs“).
Commercial information: contract, billing, and payment details for Customers. Card payments, if any, are processed by a third-party payment processor and we do not store full card numbers.
Recruiting information: resumes, work history, and related details if you apply to work with us.

2.2 Information we collect automatically

When you use the Services we and our service providers automatically collect device and usage data, including IP address, approximate location derived from IP, browser and device type, operating system, referring pages, pages viewed, links clicked, session duration, feature usage within the Platform, error logs, and timestamps. We collect this through server logs, cookies, and similar technologies. See Section 7 for details on cookies.

2.3 Information from other sources

Customer organizations: your employer or the organization that administers your Platform account may provide us with your name, email, and role in order to provision access.
Business partners and service providers: analytics providers, authentication providers, event or conference organizers, and other business partners may provide information about you to us.

3. How We Use Information

We use personal information to:

Provide and operate the Services: create and manage accounts, authenticate users, run simulations, generate Outputs, deliver results, and provide support.
Fulfill contracts: perform our agreements with Customers, process billing, and manage relationships.
Communicate: respond to inquiries, send service notices, and send sales and marketing communications about our services to business contacts, each of which includes a way to opt out.
Improve the Services: understand how the Services are used, fix bugs, and develop new features. We do not use Customer Inputs or Outputs to train or fine-tune our models or any third-party AI model. Customer content is used only to provide the Services to that Customer.
Secure the Services: detect, prevent, and respond to fraud, abuse, security incidents, and violations of our terms.
Comply with law: meet legal, regulatory, tax, audit, and compliance obligations.
Recruit: evaluate job applicants.

We do not sell personal information, and we do not use personal information for targeted advertising as those terms are defined under U.S. state privacy laws.

4. How the Platform Uses AI

The Platform generates simulations using large language models and AI agents. Customer Inputs are processed by these models to produce Outputs. Our Platform runs on Amazon Web Services, and our models are hosted and trained through AI infrastructure providers that are contractually prohibited from using our content to train their own models. The AI agents that power simulations are built from de-identified research participant data as described in the Participant Privacy Notice, together with public data. Customer Inputs are never incorporated into those agents or shared across Customers.

5. How We Share Information

We share personal information with:

Service providers that process information on our behalf under contract, including cloud hosting and AI infrastructure, authentication, analytics and logging, email and communication tools, customer relationship management and sales tools, e-signature, payment processing, security and compliance tooling, and productivity software. Service providers may use personal information only to provide services to us.
Customer organizations: if you use the Platform through an account provisioned by your employer or another organization, that organization can see your account activity and content within its workspace.
Professional advisors: lawyers, accountants, auditors, and insurers.
Business transaction parties: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality obligations.
Authorities: where required by law, subpoena, or court order, or to protect the rights, property, or safety of Rebel Labs, our users, our Customers, or the public.

We do not share Customer Inputs or Outputs with anyone other than the Customer that submitted them and the service providers necessary to deliver the Services.

6. Retention

We retain personal information for as long as needed for the purposes described in this Policy, including for the duration of a Customer relationship and for a reasonable period afterward to meet legal, accounting, and compliance obligations. Customer Inputs and Outputs are retained for the term of the Customer agreement and deleted or returned in accordance with that agreement. Site analytics data is retained for up to 24 months. We may retain information longer where required by law or to resolve disputes.

7. Cookies and Similar Technologies

The Site and Platform use cookies and similar technologies that are strictly necessary to operate the Services (for example, authentication and security) and analytics technologies that help us understand how the Services are used. We do not use advertising cookies. You can control cookies through your browser settings; disabling necessary cookies may prevent the Platform from functioning. We do not respond to Do Not Track signals, but we honor Global Privacy Control signals where the law requires. Because we do not sell or share personal information for targeted advertising, there is no sale or sharing to opt out of.

8. Security

We maintain administrative, technical, and organizational safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, logging and monitoring, vendor security review, and confidentiality obligations for employees and contractors. Rebel Labs has completed a SOC 2 Type I examination and is undergoing a SOC 2 Type II examination. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and regulators as required by law.

9. Your Rights and Choices

Depending on where you live, you may have the right to:

Access the personal information we hold about you and receive a copy.
Correct inaccurate personal information.
Delete your personal information.
Port personal information you provided to us in a machine-readable format.
Opt out of sale, sharing, targeted advertising, and profiling. We do not engage in these activities, but you may confirm this with us at any time.
Appeal a decision we make about your request.
Not be discriminated against for exercising your rights.

Marketing communications. You may opt out of sales and marketing emails at any time by using the unsubscribe link in any message or by emailing contact@rebellabs.com. We will honor opt-out requests within ten business days. Service and transactional messages related to an active account or contract are not affected.

How to exercise your rights. Email contact@rebellabs.com with “Privacy Request” in the subject line. We will verify your identity using the email address associated with your account or our records, and respond within the time required by applicable law (generally 45 days). You may use an authorized agent where the law permits; we may ask for proof of authorization.

Platform users. If you access the Platform through a Customer organization, that organization controls your account and much of your data. Direct requests about your account to your organization’s administrator, and we will assist them as their service provider.

10. U.S. State Privacy Disclosures

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Nebraska, Indiana, Kentucky, Rhode Island, or another state with a comprehensive privacy law, the rights in Section 9 are available to you as provided by that law. We honor access, correction, and deletion requests regardless of where you live.

Categories collected (past 12 months): identifiers (name, email, IP address, account identifiers); professional or employment information (job title, employer); commercial information (contract and billing details); internet and network activity (usage and device data); approximate geolocation derived from IP; and the contents of communications and Customer content you submit. We do not knowingly collect sensitive personal information through the Site or Platform.

Sources: you; your organization; your device; business partners and service providers.

Purposes: Section 3. Recipients: Section 5. Retention: Section 6.

California: We do not “sell” or “share” personal information as defined by the CCPA, and we have no actual knowledge that we sell or share the personal information of consumers under 16. We do not use personal information for automated decision-making that produces legal or similarly significant effects about you.

11. Visitors Outside the United States

We are located in the United States and the Services are operated from the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country. Our Services are intended for business users. If you are located in a jurisdiction that requires specific transfer safeguards or additional disclosures, contact us and we will provide the applicable information.

12. Children

The Services are not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a child, we will delete it. If you believe a child has provided us with personal information, contact us.

13. Third-Party Links

The Site may link to third-party websites and services, including recruitment platforms, social media, and partner sites. Their privacy practices are governed by their own policies, and we are not responsible for them.

14. Contact Us

Rebel Labs Inc. c/o Republic Registered Agent LLC 262 Chapman Rd, Ste 240 Newark, DE 19702 Email: contact@rebellabs.com (preferred for all requests) Website: https://rebellabs.com

15. Changes to This Policy

We may update this Policy from time to time. We will post the revised Policy with a new “Last Updated” date and, for material changes, provide notice through the Services or by email to account holders. Material changes to how we use personal information already collected will apply only with your consent or as otherwise permitted by law.