Palindrome Privacy Policy
Last updated: August 20, 2026
1. Scope
This Privacy Policy explains how Palindrome Labs, Inc. ("Palindrome," "we," "us," or "our") collects, uses, and shares Personal Information when you visit palindromelabs.ai or its subdomains, create or administer an account, communicate with us, or otherwise interact with our services (the "Services"). "Personal Information" means information that identifies, relates to, or could reasonably be linked to an identifiable individual.
This Privacy Policy covers Personal Information that Palindrome processes for its own business purposes. It does not govern data or content that a business customer or its authorized users submit to the Services ("Customer Data"). Palindrome processes Customer Data on the customer's behalf under our Master Services Agreement, Data Processing and Security Addendum, applicable Order Form, or another written service agreement with that customer. If you use the Services through your employer or another organization, direct requests concerning Customer Data to that organization.
2. Who We Are
For the Personal Information covered by this policy, the controller or business is:
Palindrome Labs, Inc.
128 King St, Floor 3
San Francisco, CA 94107, United States
3. Personal Information We Collect
Information you provide
- Account and profile information: name, work email, phone number, company, role, and similar account details.
- Authentication information: identifiers and basic profile information provided by Clerk or an identity provider enabled for your organization, which may include Google, Microsoft, or an enterprise identity provider.
- Communications: messages, support requests, feedback, survey responses, and information you choose to share with us.
- Business and billing contacts: names and contact details for customer administrators, procurement personnel, and billing contacts. Palindrome does not currently collect payment-card information directly.
Information we collect automatically
- Device and network information: IP address, device and browser type, operating system, referring URL, and approximate location derived from an IP address.
- Service activity: pages viewed, features used, actions taken, session information, and application, security, and diagnostic events.
- Essential cookies and similar technologies: authentication cookies, local storage, security tokens, and preferences described in our Cookie Policy.
- Privacy-focused website analytics: pages viewed, referring websites, browser and device type, country-level location, and aggregated visit and event counts collected through Fathom Analytics without placing analytics cookies or persistent identifiers on your device.
Sources of Personal Information
We collect Personal Information from you, your organization, identity providers that your organization enables, service providers that support our business, your browser or device, and your use of the Services. We may also receive business contact information from public sources, professional networks, event organizers, or referral partners.
Palindrome does not intentionally solicit sensitive Personal Information for its own business purposes, such as government identifiers, financial-account numbers, precise geolocation, health or biometric information, or information revealing protected characteristics. Customer Data may contain sensitive information that a customer or its users choose to submit. The customer controls that submission, and Palindrome processes it under the customer agreement and DPA.
4. How We Use Personal Information
We use Personal Information to:
- provide, administer, secure, and maintain the Services and customer accounts;
- authenticate users and manage organizations, permissions, and access;
- prevent fraud, abuse, and security incidents;
- provide support and communicate about service, billing, security, and account matters;
- understand feature usage, diagnose errors, and improve the Services;
- send marketing communications where permitted by law and measure their effectiveness;
- comply with law, enforce our agreements, and protect rights and safety; and
- complete a financing, acquisition, reorganization, or sale of all or part of our business.
Legal bases for European processing
If the EU GDPR or UK GDPR applies, Palindrome relies on the following legal bases:
| Purpose | Legal basis |
|---|---|
| Providing accounts, administering customer relationships, support, and service communications | Performance of a contract or steps requested before entering into a contract; Palindrome's legitimate interests in operating its business and serving organizational customers |
| Authentication, fraud prevention, security, logging, and incident response | Performance of a contract; Palindrome's legitimate interests in protecting the Services, customers, and users; compliance with legal obligations |
| Billing, tax, accounting, and recordkeeping | Performance of a contract; compliance with legal obligations; Palindrome's legitimate interests in administering its business |
| Website analytics, product analytics, diagnostics, and service improvement | Palindrome's legitimate interests in understanding performance and improving the Site and Services; consent where law requires it for a device-based technology |
| Marketing communications | Consent where law requires it; otherwise Palindrome's legitimate interests in marketing business services, subject to your right to object |
| Legal claims, compliance, and corporate transactions | Compliance with legal obligations; Palindrome's legitimate interests in protecting its rights and completing a corporate transaction |
Palindrome considers the nature of the information, the effect on individuals, and the safeguards described in this policy before relying on legitimate interests. You may object to processing based on legitimate interests as described in Section 10.
5. How We Share Personal Information
We disclose Personal Information to service providers that perform services for Palindrome. The providers we use may include:
| Service provider | Purpose |
|---|---|
| Amazon Web Services | Cloud hosting, storage, security, and infrastructure |
| Google Cloud Platform | Cloud infrastructure and related services |
| Clerk | Authentication, account administration, organizations, enterprise identity, and directory synchronization |
| ClickHouse | Analytics data storage |
| Vercel | Application deployment and content delivery |
| Fathom Analytics | Privacy-focused website analytics |
| Sentry | Application error, diagnostic, and performance monitoring |
| PostHog | Application and operational analytics and feature management |
| Google Workspace | Business email and productivity |
| Slack | Internal communications and customer support, including information a customer chooses to share with us |
We require service providers to protect Personal Information and use it only to provide services to Palindrome, subject to applicable law.
Some providers also process Customer Data as Palindrome subprocessors. The current list of Customer Data subprocessors appears in our Trust Center. The customer agreement and DPA govern notice, objections, and Palindrome's responsibility for those subprocessors.
We may also disclose Personal Information to:
- Professional advisers: lawyers, accountants, auditors, and insurers;
- Authorities and other parties: when law requires disclosure or when disclosure protects rights, safety, or the integrity of the Services;
- Transaction participants: investors, lenders, acquirers, successors, and their advisers in connection with a financing or corporate transaction; and
- Parties you direct: a third party when you ask us to disclose information or consent to the disclosure.
We do not sell Personal Information for money. We do not currently share Personal Information for cross-context behavioral advertising or process it for targeted advertising. We will update this policy and provide any required rights before changing those practices.
6. Cookies and Similar Technologies
We use essential cookies and similar technologies for authentication, security, preferences, and application delivery.
We use Fathom Analytics for privacy-focused analytics on our public website. Fathom does not place analytics cookies or persistent identifiers on your device, and we do not use it to identify you or follow you across websites. When a page loads, the visitor's browser sends an IP address and user-agent information to Fathom. Fathom uses that information to create a salted visitor hash that rotates daily and to protect its service against abuse. Fathom does not store the raw IP address with website activity or make it available to us. Fathom explains how it processes analytics data.
We do not provide a cookie-preference manager for Fathom because Fathom does not use cookies or other device storage, and we do not use Fathom for advertising or cross-site tracking. We do not rely on consent for this privacy-focused website analytics processing. Where applicable, we process this information based on our legitimate interest in understanding aggregate website performance and improving our website, provided that interest is not overridden by individual rights.
Our authenticated platform may use browser-side and server-side technologies from providers such as PostHog and Sentry to process service activity, security events, diagnostic information, and product telemetry. Our Cookie Policy describes these technologies, their typical duration, and the choices available to you.
7. Data Retention
We retain Personal Information only for as long as reasonably necessary for the purposes described in this policy. We consider the nature and sensitivity of the information, the length of our relationship, security and support needs, and legal, accounting, audit, and dispute-resolution requirements.
Our general retention approach is:
| Information | Retention approach |
|---|---|
| Account and profile information | For the life of the account or business relationship and afterward as needed for account closure, security, disputes, and legal compliance |
| Authentication and organization records | For the life of the account or organization and afterward as needed for security, audit, and legal compliance |
| Communications, support requests, and feedback | For as long as needed to address the communication and maintain appropriate business records |
| Billing contacts and business records | For the business relationship and any period required by tax, accounting, audit, or other law |
| Device, usage, security, and application logs | For periods appropriate to security, fraud prevention, troubleshooting, analytics, and operation of the Services |
| Essential cookie and device-storage data | According to the applicable authentication, security, preference, or delivery configuration described in the Cookie Policy |
| Fathom website analytics | Fathom deletes daily visitor hashes each day; aggregate website statistics may remain in our Fathom account so that we can understand website trends over time |
| Marketing preferences | For as long as needed to honor the preference, including suppression records after an opt-out |
When we no longer need Personal Information, we delete or de-identify it, subject to legal holds and limited retention in backups until those backups are overwritten or expire under our retention schedule.
The Data Processing and Security Addendum governs the retention, return, and deletion of Customer Data.
8. Security
We maintain administrative, technical, and organizational safeguards designed to protect Personal Information, including encryption in transit and at rest, access controls, logging and monitoring, vulnerability testing, and incident response.
Our security program is currently independently audited against the SOC 2 Type II standard; a current report will be available under NDA through our Trust Center.
No system is perfectly secure. If a breach affects Personal Information covered by this policy, we will notify affected individuals and authorities as required by law. The DPA governs notice to customers concerning a Security Incident involving Customer Data.
9. International Processing
Palindrome is based in the United States. We and our providers may process Personal Information in the United States and other locations where we or they operate.
If European data-protection law requires a transfer safeguard, Palindrome uses an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or another approved UK transfer mechanism, or another lawful safeguard. You may request information about the safeguard that applies to your Personal Information by emailing privacy@palindromelabs.ai. Palindrome may redact confidential or security-sensitive information from a copy of a transfer agreement.
10. Your Privacy Rights
Depending on where you live and subject to applicable law, you may have the right to:
- access or know about Personal Information we process about you;
- correct inaccurate Personal Information;
- delete Personal Information;
- receive a portable copy of Personal Information;
- opt out of certain processing;
- withdraw consent where processing relies on consent; and
- exercise your rights without unlawful discrimination.
If the EU GDPR or UK GDPR applies, you may also have the right to restrict processing, object to processing based on legitimate interests or direct marketing, and lodge a complaint with the supervisory authority in the country where you live or work or where you believe a violation occurred. Withdrawing consent does not affect processing that occurred before withdrawal.
To submit a request, email privacy@palindromelabs.ai. We may request information needed to verify your identity or authority. We will respond within the period required by law.
If we deny a request, we will explain why. Where applicable law provides an appeal right, email privacy@palindromelabs.ai with the subject line "Privacy Request Appeal" and identify the request you want us to reconsider.
Automated decision-making
Palindrome does not use Personal Information covered by this policy to make a decision based solely on automated processing that produces legal effects or similarly significant effects for an individual. The Services may produce recommendations and classifications for business customers, but the customer controls decisions made from those Outputs.
California disclosures
The table below describes the categories of Personal Information that we may collect, the sources, our purposes, and the recipients. We do not collect every example from every individual.
| CCPA category | Examples | Sources | Purposes | Recipients |
|---|---|---|---|---|
| Identifiers | Name, work email, phone number, IP address, account identifiers | You, your organization, Clerk or another enabled identity provider, and your device | Accounts, authentication, security, support, and communications | Hosting, identity, security, application, communications, and support providers |
| Cal. Civ. Code § 1798.80(e) information | Name, phone number, and business contact details | You or your organization | Account administration, support, and business communications | Providers supporting those functions and professional advisers |
| Internet or electronic-network activity | Device information, referring URLs, pages viewed, feature activity, and application or security logs | Browsers, devices, and use of the Services | Operation, security, troubleshooting, analytics, and improvement | Hosting, infrastructure, analytics, monitoring, security, and application providers |
| Approximate geolocation | General location derived from an IP address | Device or network connection | Security, fraud prevention, analytics, and service operation | Hosting, security, and analytics providers |
| Professional or employment information | Company, role, and business relationship | You, your organization, or an identity provider | Account administration, support, and business communications | Identity, productivity, communications, and support providers |
We have not sold Personal Information in the preceding 12 months. We have not shared Personal Information for cross-context behavioral advertising in the preceding 12 months. We do not knowingly sell or share the Personal Information of consumers under 16.
11. Marketing Communications
We may send product news and other marketing communications as permitted by law. Marketing emails include an unsubscribe mechanism. An opt-out does not affect service, security, billing, support, or other transactional communications.
12. Children
The Services are a business product intended for organizations and their personnel. They are not directed to children, and we do not knowingly collect Personal Information from anyone under 13. Contact privacy@palindromelabs.ai if you believe a child has provided Personal Information to us.
13. Third-Party Links
The Services may link to third-party sites and tools that we do not control. Their privacy policies govern their practices.
14. Changes to This Policy
We may update this policy as our practices or legal obligations change. We will post the revised version with a new "Last updated" date and provide any additional notice required by law. Where law requires consent before materially different processing, we will obtain it before beginning that processing.
15. Contact Us
Palindrome Labs, Inc.
128 King St, Floor 3
San Francisco, CA 94107, United States
privacy@palindromelabs.ai