Almita Limited, trading as Decisions Lab ("we," "us," or "our"), operates a behavioural simulation platform. Customers describe an audience, we typically build the personas for the individuals in it, and simulations run against those personas.

This Privacy Policy explains how we collect, use, store, and protect personal data when you visit decisionslab.io or use the platform (together, the "Services"). It covers account holders, other people in a customer organisation, and persona subjects, the individuals whose professional information is used to build a persona.

Persona subject data

Decisions Lab is the data controller for persona subject data, whether we identified the individual or a customer named them. We decide what information is collected, from which sources, and how long it is kept. Requests from a persona subject come to us at privacy@decisionslab.io and we action them directly.

Customer content

For Customer Content, including your brief, materials, simulation configuration, and account and billing data, you are the controller and Almita Limited is the processor. Customer Content excludes persona subject data, including audience records you supply. We process Customer Content only on your documented instructions, subject to the de-identified data use described in section 5.

When you create an account, join an organisation, or contact us, we collect:

• Contact and account details, such as name, work email address, and company name.
• Organisation identity and authentication data handled through WorkOS (WorkOS, Inc.), including session metadata.
• Billing and subscription metadata stored in our application database. Customers are invoiced. We do not collect or store payment card details.
• Content you submit to run the Services, including briefs, materials, and simulation configuration.
• Usage data, including IP address, browser and device information, pages visited, and product events.

Cookies and analytics

We use cookies and similar technologies to operate the site, keep you signed in, and measure product usage through PostHog (PostHog, Inc.). You can manage cookies through your browser settings. Some cookies are required for the Services to function.

In most engagements we build the audience. You describe the audience you want to understand, and we identify individuals who fit and build personas from publicly available professional information about them. Some customers supply their own records instead, typically name, job title, company, company website, and public professional profile URL. In both cases we collect the public source material ourselves. It is held internally rather than shown in the product or included in exports. You receive insights and, as agreed, access to a model of the audience for further simulations. This access does not include the underlying persona records, raw source material, or individual modelled responses.

Persona subject data is used to build personas and run simulations, and for nothing else. We do not contact persona subjects. We do not sell persona subject data, use it for our own marketing, or use it to train, fine-tune, or improve general-purpose or foundation models, our own or those of any third party.

We use personal data to:

• Provide, operate, and maintain the Services, including accounts and organisations.
• Build personas and run simulations on a customer's instructions.
• Collect public source material needed to build those personas.
• Analyse aggregated product usage to operate and improve the Services.
• Communicate about the Services, including support and, where relevant, marketing.
• Bill for the Services and keep accounting records.
• Comply with law and enforce our Terms of Service.

We may retain and use data derived from Customer Content solely for internal research and development to improve the Services once it has been de-identified in accordance with the CCPA. It must not reasonably allow information about an individual or household to be inferred or linked to them. We document a risk assessment confirming that no re-identification risk exists using means reasonably likely to be used, prohibit ourselves and our providers from attempting re-identification, and comply with applicable law and CCPA service provider restrictions. We may use AI providers or other tools to create this de-identified data under the safeguards in section 7. This permission does not extend to persona subject data.

Where data protection law requires a legal basis, we rely on the following.

• Legitimate interests for persona subject data, so we can build personas and run simulations.
• Contract performance for account, organisation, and billing data.
• Consent where we rely on it for marketing communications.

We use AI services from Vercel AI Gateway (Vercel Inc.), OpenAI (OpenAI OpCo, LLC), and AWS Bedrock (Amazon Web Services, Inc.). Vercel AI Gateway and our OpenAI account use zero data retention (ZDR), so prompts are not stored by those services. AWS Bedrock does not store prompts or use them for training. We do not use your Customer Content or persona subject data to train, fine-tune, or improve general-purpose or foundation models, our own or those of any third party.

Decisions Lab makes no automated decisions producing legal or similarly significant effects about individuals. Simulation outputs describe a modelled persona rather than assessing a real person.

We share personal data with the subprocessors that host and operate the platform. This list is maintained on our Trust page and mirrored here.

• Vercel (Vercel Inc.): Application hosting and AI inference services (United States)
• Convex (Convex, Inc.): Database services (United States)
• WorkOS (WorkOS, Inc.): Authentication and user management services (United States)
• AWS (Amazon Web Services, Inc.): Cloud storage and generative AI inference services (United States (Virginia))
• OpenAI (OpenAI OpCo, LLC): Generative AI and AI model inference services (United States)
• Axiom (Axiom, Inc.): Log aggregation and monitoring services (United States)
• PostHog (PostHog, Inc.): Analytics services (United States)

We may also disclose information if required by law, or as part of a merger, acquisition, or sale of assets, with notice where the law requires it.

Almita Limited is incorporated in Hong Kong. Our infrastructure and subprocessors are located in the United States, so personal data submitted to the platform is transferred to and processed there. Where required, we use applicable transfer safeguards, including EU Standard Contractual Clauses and the UK Addendum. Our enterprise Data Processing Agreement distinguishes transfers of Customer Content to us as processor from transfers of persona subject data to us as controller and addresses onward transfers to our providers. It is available on request.

Customer Content, audience records, audience models, and simulation results are kept while needed to provide the Services. Within 30 days of a deletion request, account closure, or termination, we delete or render permanently anonymised the affected data across our databases, object storage, and backups. We may retain data where required by law or necessary for the establishment, exercise, or defence of legal claims. Such retained data is restricted to those purposes and deleted or permanently anonymised when that need ends.

After account closure or termination, you may export Customer Content and Insights during the same 30-day period, unless you request earlier deletion. Access during that period is limited to export; further simulations require an active agreement. The export window does not extend the deletion or anonymisation deadline. We will confirm deletion or anonymisation in writing on request. De-identified data meeting section 5 may be retained for the permitted internal research and development.

Prompts sent to our AI providers are not retained by them. Operational logs hold request metadata only and follow our logging provider's standard retention.

All traffic between your browser, our services, and our subprocessors uses TLS 1.2 or higher. Customer data is encrypted at rest using AES-256 across our databases and object storage. Production credentials are held in a dedicated secrets manager and are never stored in source code or version control. Access to production systems and logs is limited to named personnel.

Depending on your location, including the EU and UK under GDPR, California under CCPA / CPRA, and Hong Kong under the Personal Data (Privacy) Ordinance, you may have rights to access, correct, or delete personal data, to opt out of marketing, to request portability, or to restrict or object to certain processing.

Hong Kong residents may exercise rights under the Personal Data (Privacy) Ordinance (Cap. 486), including access and correction. Requests will be handled within the 40-day period prescribed by the Ordinance.

To exercise these rights, contact us at privacy@decisionslab.io. We will respond within the timeframes required by applicable law.

The Services are offered to businesses and their authorised users. They are not intended for consumers or for anyone under 18.

This Privacy Policy is effective from 9 September 2026. We may update it to reflect changes in our practices or legal requirements. We will notify you of material changes by email or a notice on the site. Continued use of the Services after those changes take effect constitutes acceptance of the updated policy.

For privacy questions and data subject requests, contact privacy@decisionslab.io.