Privacy Notice

Chariot Labs ("Chariot Labs", "we", "us", or "our") helps private equity sponsors and their portfolio companies find and deploy AI workflows. This notice explains how we collect, use, share, and protect personal information when you:

• visit www.chariotlabs.ai or any page that links to this notice;
• contact us, book a conversation with us, or receive updates from us;
• work with us during an audit or implementation engagement, whether as a client, an employee of a client, or a business partner; or
• meet us at an event or engage with our marketing.

Reading this notice will help you understand what we do with your information and the choices you have. If you do not agree with our practices, please do not use our website or services. Questions go to hello@chariotlabs.ai. To exercise your privacy rights, use our Privacy requests page.

Summary of key points

• What we collect. Contact and professional details you give us, technical information about visits to our site, and business information shared with us during engagements.
• Sensitive information. We do not ask for sensitive personal information through our website. Engagements can involve business data that incidentally contains personal information, which we handle on the client's instructions.
• Other sources. We may receive information from public professional sources, from a sponsor introducing a portfolio company, or from someone who refers you to us.
• How we use it. To respond to you, scope and deliver our services, run and secure our website, and meet legal obligations.
• Sharing. With service providers that help us operate, within engagements under client agreements, with professional advisers, and where the law requires. We do not sell personal information or share it for targeted advertising.
• Your rights. Depending on where you live, you can ask to access, correct, delete, or receive a copy of your information, object to certain processing, or withdraw consent. Start at Privacy requests.

1. Who we are and what this notice covers

Chariot Labs provides AI opportunity audits and builds AI workflows for PE-backed operating companies across industrials, business services, and multi-site consumer businesses. This notice covers the personal information we handle for our own purposes, such as information about website visitors, prospective clients, and business contacts.

During client engagements we usually handle information on a client's behalf and under its instructions: process documentation, system data, documents, and records that may include personal information about the client's employees, customers, or suppliers. For that information the client decides the purposes and means of processing and we act as its processor or service provider. The client agreement, statement of work, and any data processing terms govern that handling, and the client's own privacy notice describes its practices.

2. Information we collect

In short: we collect what you give us, limited technical data about site visits, and business information shared during engagements.

Information you provide

When you contact us, book a conversation, or work with us, you may provide your name, email address, phone number, company, role, the content of your messages, and scheduling details such as your time zone and any notes you add when booking. If you attend an event with us or ask for updates, we keep the details needed to follow up. Please keep this information accurate and tell us if it changes.

Information collected automatically

Our website uses Vercel Web Analytics to understand aggregate usage: pages viewed, the referring site, approximate country or region, browser and device type, operating system, and screen size. It does not use cookies. It derives a temporary, non-reversible identifier from request details to count unique visits and discards it within a day. Our hosting provider may also record IP addresses and request details in server logs for security and troubleshooting.

Information from other sources

Before a conversation we may look up publicly available professional information, such as a company website or a professional networking profile, so that we come prepared. We may also receive your details from a private equity sponsor introducing a portfolio company, from an event organizer, or from a business contact who refers you to us.

Information handled during engagements

As described in section 1, engagement data is processed on the client's instructions. We only use it to deliver the agreed work and as permitted by the client agreement.

3. How we use information

In short: to respond to you, deliver and support our services, run our website, and comply with the law.

• To respond to inquiries and schedule conversations.
• To scope, deliver, and support audits and implementations, and to manage the client relationship.
• To send administrative messages such as proposals, invoices, and changes to our terms or this notice.
• To share relevant updates about our work with business contacts where the law allows. You can opt out at any time using the link in a message or by emailing us.
• To operate, secure, troubleshoot, and improve our website and services, including understanding aggregate usage.
• To comply with legal obligations, enforce our agreements, and protect our rights and the rights of others.
• In connection with a business transaction, such as a financing, merger, or sale of assets.

4. Legal bases for processing

In short: we process personal information only where we have a valid reason under the law that applies to you.

If you are in the European Economic Area, the United Kingdom, or Switzerland

We rely on one or more of the following legal bases:

• Contract. To take steps you ask for before entering an agreement and to perform our agreements.
• Legitimate interests. To run our business, respond to inquiries, communicate with business contacts, secure our systems, and improve our services, where those interests are not overridden by your rights.
• Consent. Where the law requires it, for example for certain communications. You can withdraw consent at any time.
• Legal obligation. To comply with laws that apply to us.

If you are in Canada

We process personal information with your express or implied consent, as permitted by the Personal Information Protection and Electronic Documents Act and applicable provincial laws. You may withdraw consent at any time, subject to legal or contractual restrictions. In limited cases the law allows us to process information without consent, for example to investigate a breach of an agreement, to comply with a subpoena or court order, or where the information is publicly available as defined by regulation.

5. When we share information

In short: with providers that help us operate, within engagements, with advisers, and where the law requires. We do not sell personal information.

• Service providers. Companies that host our website and analytics (Vercel), deliver our website email (Resend), and provide document, productivity, accounting, and invoicing tools. For client engagements, the AI model providers and cloud platforms selected for that engagement. Providers may only use information to provide their services to us and are bound by contractual obligations.
• Within engagements. With the client and its authorized personnel and, where an engagement is arranged through a private equity sponsor and the client agrees, with that sponsor.
• Professional advisers. Lawyers, accountants, insurers, and similar advisers under confidentiality obligations.
• Legal reasons. To comply with the law, respond to lawful requests from public authorities, enforce our agreements, or protect the rights, property, or safety of Chariot Labs, our clients, or others.
• Business transfers. As part of a financing, merger, acquisition, or sale of all or part of our business.
• With your direction or consent. For example, when you ask us to introduce you to someone.

We do not sell personal information, and we do not share it for cross-context behavioral or targeted advertising.

6. Cookies, analytics, and embedded tools

In short: no advertising cookies, cookieless analytics, and site forms that email us directly.

Our website does not use advertising cookies or third-party advertising trackers. Analytics are collected through Vercel Web Analytics as described in section 2, without cookies.

When you submit the report request or contact form, the details you enter are sent to our email provider (Resend), which delivers them to us as an email. We use them only to prepare our reply. The forms do not set advertising cookies.

Because we do not sell or share personal information for targeted advertising, browser opt-out signals such as Global Privacy Control do not change how our site behaves. We do not currently respond to Do Not Track signals, as no common standard for them has been adopted.

7. AI in our services

In short: we build AI workflows for clients with third-party models, under client agreements, and client data is not used to train models for other clients.

We design, build, and deploy AI-assisted workflows for clients. To do that we use third-party foundation models and cloud services, selected for each engagement and often deployed inside the client's own environment. Information processed through these workflows is handled under the client's agreement and instructions. We choose providers and configurations under which client data is not used to train general-purpose models, unless the client expressly agrees otherwise, and we do not use one client's data to build solutions for another client.

Where a workflow affects people, we build in review points so that a person can check and override its output. Our website itself does not send your information to AI systems.

8. International transfers

In short: our service providers may process information in the United States and other countries, with safeguards where the law requires them.

Our service providers may store and process information in the United States and other countries that may not have data protection laws equivalent to those where you live. Where the law requires, we rely on appropriate safeguards for those transfers, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum. Details are available on request.

9. How long we keep information

In short: only as long as needed for the purposes in this notice, or as the law requires.

We keep personal information for as long as necessary to fulfill the purposes described in this notice, unless a longer period is required or permitted by law, for example for tax, accounting, or contractual record-keeping. Engagement records are kept for the period set in the client agreement. Analytics data is retained in aggregate form. When information is no longer needed, we delete or anonymize it; where that is not immediately possible, for example in backups, we isolate it from further use until deletion.

10. How we protect information

In short: reasonable technical and organizational measures, with the understanding that no system is completely secure.

We use technical and organizational measures appropriate to the sensitivity of the information, including access controls and least-privilege access, encryption in transit, review of the providers we rely on, and security arrangements agreed with each client for their engagement. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You should only access our services within a secure environment.

11. Children

Our website and services are intended for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, email hello@chariotlabs.ai and we will delete it.

12. Your rights and choices

In short: depending on where you live, you can access, correct, delete, or receive a copy of your information, object to processing, and withdraw consent.

Depending on the law that applies to you, you may have the right to:

• know whether we process your personal information and access a copy of it;
• correct inaccurate or incomplete information;
• delete your information, subject to records we must keep;
• receive your information in a portable format;
• object to, or ask us to restrict, certain processing;
• withdraw consent where processing is based on consent, without affecting processing that took place before;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects; and
• not be discriminated against for exercising these rights.

European Economic Area, United Kingdom, and Switzerland

If you believe we are processing your information unlawfully, you may complain to your local data protection authority, the UK Information Commissioner's Office, or the Swiss Federal Data Protection and Information Commissioner.

Canada

You may request access to or correction of your personal information and withdraw consent as described above. You may also contact the Office of the Privacy Commissioner of Canada or your provincial commissioner.

United States

Residents of states with comprehensive privacy laws, including California, Colorado, Connecticut, Texas, Virginia, and others, may have the rights listed above, as well as the right to opt out of the sale of personal information, its sharing for targeted advertising, and profiling. We do not sell personal information, share it for targeted advertising, or profile individuals in ways that produce legal or similarly significant effects. You may designate an authorized agent to make a request for you; we may ask for proof of that authorization. If we decline a request, you may appeal by replying to our decision, and we will respond in writing. If your appeal is denied, you may contact your state attorney general.

How to exercise your rights

Use the Privacy requests page or email hello@chariotlabs.ai. We may need to verify your identity before acting on a request, and we will only use the information you provide for that purpose. We respond within the timeframe required by applicable law, usually within 30 days, and will tell you if we need longer. To stop receiving updates from us, use the unsubscribe link in any message or email us.

13. Changes to this notice

We may update this notice from time to time. The date at the top shows when it was last revised. If we make material changes, we will post a prominent notice on our website or contact you directly where appropriate.

14. How to contact us

Questions, comments, or requests about this notice can be sent to hello@chariotlabs.ai. We will respond as promptly as we can.