Privacy Policy

1. Scope and our role

This Privacy Policy explains how Stimulai LLC (“Stimulai,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information through LaiNS, our websites, applications, APIs, command-line tools, agent interfaces, and related services (collectively, the “Service”).

For account, website, security, support, and business-operations data, Stimulai generally acts as the business or controller. When we process personal information in workspace content on behalf of an organization, Stimulai generally acts as its service provider or processor. In that situation, the organization controls the information, and its privacy notice and instructions apply.

This Policy does not cover third-party services you connect to LaiNS or third-party sites that link to or from the Service.

2. Information we collect

Some Customer Content may contain personal information, sensitive personal information, or confidential business information chosen by you or your organization. Please submit only information that you are authorized to use with the Service.

3. Sources of information

We collect information:

• directly from you, such as when you create an account, provide content, configure the Service, or contact us;
• from your organization, including administrators and other workspace members;
• from services you connect, when you authorize LaiNS to retrieve information or take action through an integration;
• automatically, through server logs, cookies, local storage, and similar technical mechanisms; and
• from service providers and business partners, such as authentication, communications, infrastructure, and security providers.

4. How we use information

We use personal information to:

• provide, operate, maintain, and personalize the Service;
• authenticate users and administer accounts, organizations, permissions, integrations, agents, and subscriptions;
• process prompts, orchestrate workflows, retrieve context, and generate requested outputs;
• secure the Service, prevent fraud and abuse, investigate incidents, and enforce agreements;
• respond to support requests, communicate service updates, and send transactional messages;
• understand performance, diagnose errors, and improve reliability, usability, and features;
• comply with law and protect rights, safety, and property; and
• carry out other purposes disclosed when information is collected or with your consent.

Where required, our legal bases include performing a contract, complying with legal obligations, protecting vital or legitimate interests, and consent. Our legitimate interests include operating and securing the Service, supporting customers, and improving product performance in ways that do not override individual rights.

5. How we disclose information

We may disclose personal information to:

• your organization and workspace members, according to permissions and administrator controls;
• service providers, that support hosting, storage, authentication, email, customer support, security, error monitoring, and other business operations;
• model providers and connected services, when needed to perform an action you request or provide a configured feature;
• professional advisers, such as lawyers, auditors, insurers, and financial advisers;
• authorities or other parties, when we reasonably believe disclosure is required by law or necessary to protect rights, safety, security, or the integrity of the Service; and
• a successor or transaction participant, in connection with a financing, merger, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality safeguards.

We may use and disclose aggregated or de-identified information that cannot reasonably be linked to an individual, and we will not attempt to re-identify it except to test our de-identification methods or as permitted by law.

6. AI and Customer Content

LaiNS may send prompts, selected Customer Content, and relevant context to model providers or agent infrastructure configured for your organization. What is sent depends on the workflow, tool, permissions, and provider your organization selects.

Stimulai does not use Customer Content to train generalized AI models unless your organization affirmatively opts in or agrees to that use in writing. Third-party model providers process information under their agreements with Stimulai or your organization. Administrators should review provider settings and terms before enabling a model or integration.

We may use limited service and diagnostic data to evaluate safety, reliability, and performance. Where practical, we minimize or de-identify personal information used for those purposes.

7. Cookies and local storage

The Service uses cookies and similar storage that are necessary for authentication, security, account continuity, preferences, and requested functionality. We also use browser local storage for settings and in-progress work such as interface preferences or draft content.

We do not currently use third-party advertising cookies. Your browser may allow you to block or delete cookies and local storage, but doing so can prevent authentication, saved preferences, and other Service features from working correctly.

8. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, maintain security and audit records, resolve disputes, enforce agreements, and meet legal obligations.

Retention depends on the type and sensitivity of information, the workspace lifecycle, administrator instructions, contractual commitments, legal requirements, and the risk of harm from continued retention. When information is no longer needed, we delete, de-identify, or isolate it from active use. Backups may retain information for a limited period before routine deletion.

9. Security

We use administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, or alteration. These measures include access controls, credential protections, encryption where appropriate, logging, monitoring, and vendor review.

No system is completely secure. You are responsible for protecting your credentials and configuring workspace permissions and integrations appropriately. If you believe your account or information has been compromised, contact security@lains.io.

10. Your choices and rights

Depending on where you live and how Stimulai handles your information, you may have rights to access, correct, delete, restrict, object to processing of, or receive a portable copy of personal information. You may also have the right to withdraw consent and appeal a denied request.

You can update some account information in the Service. To make a privacy request, email privacy@lains.io. Describe your request and the account or organization involved. We may verify your identity and authority before responding. You may use an authorized agent where permitted by law.

If Stimulai processes information only on behalf of your organization, we may direct your request to that organization. We will not discriminate against you for exercising a privacy right.

11. U.S. state disclosures

U.S. state privacy laws may require additional disclosures. The table in Section 2 describes the categories of personal information we collect. We collect those categories for the business purposes in Section 4 and disclose them to the recipient categories in Section 5. Our retention criteria are described in Section 8.

In the preceding 12 months, Stimulai has not sold personal information or shared it for cross-context behavioral advertising. We do not have actual knowledge that we sell or share the personal information of people under 16 for those purposes.

Where applicable, you may request to know, access, correct, delete, or obtain a copy of personal information and may appeal a decision about your request. We honor legally recognized browser-based opt-out preference signals where required. Because we do not sell or share personal information for behavioral advertising, those signals do not change our current practices.

12. EEA, UK, and international rights

If the laws of the European Economic Area, United Kingdom, or another jurisdiction apply, you may have rights to be informed, access, correction, erasure, restriction, portability, objection, and withdrawal of consent. You may also complain to your local data protection authority.

Stimulai is based in the United States, and the Service may process information in the United States and other countries where we or our providers operate. Where required, we use approved contractual or other legal safeguards for international transfers.

The Service is not designed to make decisions based solely on automated processing that produce legal or similarly significant effects about individuals. Customers must provide appropriate human review for high-impact decisions.

13. Children

The Service is intended for business users and is not directed to children under 18. We do not knowingly collect personal information from children through the Service. If you believe a child has provided personal information to us, contact privacy@lains.io so we can investigate and take appropriate action.

14. Changes and contact

We may update this Policy as our practices, the Service, or law changes. We will post the updated version and revise the effective date. If a change materially affects how we use previously collected personal information, we will provide additional notice or seek consent where required.

Questions, complaints, and privacy requests may be sent to privacy@lains.io.

Stimulai LLC
Operator of LaiNS