Website Privacy Notice

Who we are and what this covers

Bespokelabs.AI, Inc. (“Bespoke Labs,” “we,” “us”) operates this corporate website. Contact privacy@bespokelabs.ai about personal information or privacy rights.

You may also write to Bespokelabs.AI, Inc., 800 W El Camino Real, Suite 225, Mountain View, CA 94040, United States.

This notice covers visits to this website and communications about it. It does not describe personal information in datasets acquired or licensed by Bespoke Labs, or processing within Nimble, Horizon or other products. Those activities require their applicable notices and agreements. You may use the same privacy address for questions or requests about them.

Information we collect and why

• Contact and professional information: the name, work email, organization, role and message you choose to provide when contacting us. We use these details to assess and respond to your inquiry, arrange follow-up and keep necessary correspondence. Do not include sensitive personal information, credentials or datasets in an inquiry.
• Internet and device information: IP address, browser and device information, requested pages, request times and security events processed when serving and protecting the site.
• Privacy preferences: your consent choices, their time and version, and identifiers used to remember and demonstrate those choices. The consent provider also processes IP addresses and technical request information.
• Privacy requests: your contact details, request, proportionate verification information where needed, and a record of our response. These are used to fulfill requests and demonstrate compliance.

These details come directly from you, your browser or the service providers delivering the website. We do not ask the website inquiry form for precise location, government identifiers, payment details or health information. Inquiry content is not used for model training, benchmarking or unrelated product development.

For visitors from EEA/UK: Why we’re allowed to use your information

• Inquiries: we use your contact details to reply to you, because answering business inquiries is a normal part of running our business.
• Website and security data: we use this to run the site and keep it safe, for the same reason.
• Analytics: we only use these if you say yes, and you can change your mind at any time.
• Privacy requests: we keep records of these because the law requires us to.

Providers and recipients

The following services support the current website and are supplied by two provider organizations: Google and iubenda. A request to an external service can disclose your IP address, browser information and referring site even when that service does not set an advertising cookie.

• Google Analytics: optional public-website usage measurement, including pages viewed, browser/device information and engagement. It loads only after measurement consent on the public website, with Google Signals and advertising personalization disabled. Inquiry and legal pages are excluded; only known site routes can load analytics. Page URLs omit query strings and fragments, and referrers include only the originating site. Google privacy information.
• Google Cloud: website hosting, request/security logging and storage for the inquiry workflow. It processes website requests and, where applicable, submitted inquiry content and access information. Google Cloud privacy information.
• Google Workspace: email sent to our company and privacy addresses, including your message, contact details and attachments. Sending email creates a separate correspondence record. Google Workspace privacy information.
• iubenda: the consent interface, records of cookie/privacy choices, and consent-service usage metrics such as page and choice counts. It processes preference identifiers, IP addresses, timestamps and consent details. It does not receive inquiry form content through our form integration. Consent-service privacy information.

Authorized staff use inquiry and privacy-request information for the purposes above. Information may also be disclosed when necessary to comply with law, protect rights and security, or support a corporate transaction subject to applicable safeguards. Links to recruitment, social, research and product websites take you to services governed by their own notices. YouTube links use locally hosted preview images and open YouTube only when selected.

Cookies and optional analytics

Necessary cookies support access and remember privacy choices. Optional measurement requires your permission. Google Analytics loads only if you allow measurement, and never on inquiry or legal pages. No advertising tags are enabled.

Read our Cookie Notice for provider and storage details. You can reject optional cookies, change your decision or withdraw consent through Privacy choices. Refusing optional cookies does not prevent access to ordinary website content.

How long information is kept

Different records have different schedules. We delete closed, unsuccessful inquiries 90 days after recorded closure and review active inquiries at least every 90 days. If an inquiry becomes an engagement, necessary engagement records follow the applicable contract and record schedule. Verified erasure requests can result in earlier deletion, subject to lawful exceptions. Legal or security holds are reviewed at least every 30 days.

Routine website logs use a 30-day schedule. Some platform audit logs are retained for 400 days, and security audit records for 1,095 days. These records are distinct from inquiry content. Consent preferences and the consent provider’s evidence logs have separate schedules described in the Cookie Notice.

For privacy requests, we retain a minimized case record for 24 calendar months after the final substantive response, delete ordinary working correspondence within 90 days after closure or sooner where required, and remove unnecessary verification documents and temporary exports when their purpose is complete. Authorized handlers manually remove working mailbox copies and temporary exports; deleting an inquiry does not automatically delete separate mailbox or provider copies. Necessary legal evidence and documented holds follow the applicable limited retention requirement. These periods apply to privacy-case records and copies, not all company email.

California privacy rights

Where the CCPA, as amended by the CPRA, applies, California residents may request access to and information about personal information, deletion, correction, and equal treatment when exercising privacy rights. They may also opt out of sale or sharing for cross-context behavioral advertising and limit qualifying uses or disclosures of sensitive personal information.

The categories relevant to this website are identifiers, internet/device activity, professional information, and information you choose to include in correspondence. Their sources, purposes and recipients are described above. This website is not configured with advertising or cross-context behavioral advertising tags. This statement does not make a claim about Bespoke Labs’ acquired datasets or all company activities over the preceding 12 months.

Use Do Not Sell or Share My Personal Information for browser choices and opt-out instructions. We honor Global Privacy Control on this website and additionally keep optional analytics blocked when that signal is enabled. A browser choice applies to that browser; contact us for a request involving information held outside it. Browser opt-outs do not require an account or identity verification.

To request access, deletion, correction, or a limit on qualifying sensitive-information use, email privacy@bespokelabs.ai. Describe your request and your relationship with us without sending identity documents or unnecessary sensitive information. An authorized agent may submit a request; we may need evidence of authority and proportionate verification for access, deletion or correction. We do not require identity verification for sale/sharing opt-outs.

For covered California requests to know, delete or correct, we acknowledge receipt within 10 business days and generally respond within 45 calendar days. If an allowed extension is needed, we explain it within the initial period. Sale/sharing opt-outs and qualifying limitation requests are acted on as soon as feasible and no later than 15 business days. Exceptions, verification needs and the reason for any denial will be explained as applicable.

Other privacy rights and international processing

Depending on applicable law, you may have rights to access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent, and complain to a supervisory authority. Withdrawal does not change the lawfulness of earlier processing. Contact privacy@bespokelabs.ai to exercise these rights.

We operate in the United States. Our communication, hosting, and other service providers may process information in additional countries. Where applicable law restricts an international transfer, we require an appropriate arrangement for that activity, such as an applicable adequacy decision or contractual safeguards with any required additional measures. Contact us to request information about the safeguards applicable to your information and how to obtain a copy.

Updates and contact

We will update this notice when the website’s processing changes and provide any additional notice required by law. The date at the top shows when it was last updated. Questions and privacy requests can be sent to privacy@bespokelabs.ai.