Privacy Policy — Tortoise Hosted Service

Scope of this policy

This Privacy Policy describes how personal data is processed in connection with the hosted Tortoise service operated by Premise Labs at tortoise.premiselabs.co (and its API at api.premiselabs.co).

This policy does not apply to self-hosted deployments of the Tortoise software. In a self-hosted deployment, the operator of that deployment is the data controller for any personal data processed there, and that operator's own policies apply.

This policy is written in plain English. It describes current practices truthfully and, where the service may introduce tools in the future (such as analytics instrumentation), it describes those tools now in conditional terms so this document stays accurate when they are activated ("disclose now, instrument later").

1. Controller identity and contact

Data controller: Daniel Ospina, an individual operating the hosted Tortoise service under the name "Premise Labs" (d/b/a "Premise Labs").

Premise Labs is not a registered legal entity. The data controller is the natural person named above, acting in their personal capacity.

Jurisdiction of residence: United Kingdom.

Contact for privacy matters: email [email protected]. This is the controller's designated contact channel for all privacy inquiries and requests.

EU/EEA representative (EU GDPR Art. 27): "We are not currently established in the EU/EEA. If we become subject to EU GDPR Art. 27, we will designate and disclose an EU representative here."

UK GDPR and the Data Protection Act 2018: the controller carries on the business from the United Kingdom, so it is established here, and the UK GDPR and the Data Protection Act 2018 apply to the processing described in this policy. References to "the GDPR" below mean the UK GDPR and, where relevant, the EU GDPR; the EU GDPR articles cited throughout this policy are numbered identically.

Transfers and complaints (UK): the GDPR rights in §8 and the response commitment in §16 apply here as UK GDPR provisions, and in §12 the UK's International Data Transfer Agreement and the UK Addendum stand in for the SCCs — the UK Extension to the EU–US Data Privacy Framework also applies where a recipient participates. You may lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint, or, where one exists, with the supervisory authority of your country of residence.

Mexico: the controller is not established in Mexico. This policy describes the processing for all users, including users in Mexico, and does not limit any right you may have under Mexican law. If you are in Mexico and want to exercise access, rectification, cancellation or objection rights, send the request to [email protected]. A request made under Mexican law is answered within 20 Mexican business days of receipt of a complete request, and the two-month extension in §16 is not applied to it.

2. Data processed by the service

The service processes the following categories of personal data:

• Account data. Account data includes your email address, authentication credentials, and account identifiers. Authentication is managed through an identity and database provider (Supabase), and sign-in may be completed through the GitHub or Google OAuth identity providers. This category is required for account creation, authentication, and billing.
• Usage data. Usage data includes information about how the service is used — for example, API requests made, features used, and performance signals. Usage data is not tied to your identity beyond your account.
• Analytics data. Analytics data includes behavioral and technical signals processed by the analytics tools (PostHog and Google Analytics (GA4)) when you give consent via the consent banner, and by planned tools (Meta Pixel, X (Twitter), and LinkedIn) when those tools are activated — see §3.
• Waitlist data. Email addresses submitted through the waitlist form on premiselabs.co are stored in a subscription database and used solely to send launch notifications and updates related to the waitlist. Consent is given by submitting the form, and every message includes an unsubscribe option.
• Session recordings. Where an organization has session recording enabled, the content of AI agent sessions is captured by a recording extension that a member installs on their own machine, and is stored in the organization's memory. This category is processed as described in §4 and retained as described in §6. Session content may include third-party personal data that a member records — do not record sessions you are not entitled to share.

Sensitive data — expectation. "we expect users not to place sensitive data in the service" — do not place health data, biometric data, government identifiers, or other sensitive personal data in the service. See §13.

Eligibility. The service is intended for use by adults: you must be at least 18 years old to create an account or use the service. The service is not directed to children.

3. Analytics and cookies

Deployed analytics tools. The following analytics tools are deployed on the tortoise funnel pages (product, signup, sign-in, and welcome pages), and they capture data only after you give consent via the consent banner:

• PostHog — product analytics (PostHog Inc.). PostHog is a data processor; data is stored in the United States.
• Google Analytics (GA4) — audience and product analytics (Google LLC), delivered through Google Tag Manager. GA4 loads only after you give consent via the consent banner.

Planned tools, disclosed now. The following analytics tools are not deployed yet and may be activated with your consent; consent is managed via the consent banner:

• Meta Pixel — advertising measurement and conversion tracking (Meta Platforms, Inc.).
• X (Twitter) — advertising and conversion tracking (X Corp.).
• LinkedIn — advertising and conversion tracking (LinkedIn Corporation).

Cookies and similar technologies are used by these tools when activated. You can give or withdraw consent at any time via the consent banner.

Until consent is given, PostHog captures no data, the planned tools are not loaded, and no data is sent to them. Google Tag Manager itself is loaded only after consent, so GA4 and any other tags it contains cannot fire before consent is given.

4. Purposes of processing and legal bases

Purposes of processing: "your email address and account information are used to deliver the service, respond to requests, and manage billing; usage data is used to improve the product"

Legal bases under the GDPR. Processing is based on the following grounds, as applicable:

• Performance of a contract (Art. 6(1)(b)): account data is processed to deliver the service the user signs up for, including authentication and account administration.
• Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)): where an organization has session recording enabled, the session content its members contribute is processed to deliver and operate that organization's stored memory — the service the organization uses. Recording is enabled by default for an organization and is governed by the Terms of Service; it can be switched off for the organization at any time, which stops new captures.
• Legitimate interests (Art. 6(1)(f)): usage data is processed to operate, secure, and improve the product, and to prevent abuse.
• Consent (Art. 6(1)(a)): analytics tools are activated and process data only after consent is given, as described in §3; waitlist email addresses are processed to send the requested launch notifications, with consent recorded when the waitlist form is submitted.
• Legal obligation (Art. 6(1)(c)): billing and transactional records may be processed to comply with tax and accounting obligations, where applicable.

Consent, where given, may be withdrawn at any time with effect for the future. Under PECR, and the equivalent ePrivacy rules where you are in the EU/EEA, non-essential cookies and pixels are subject to the same consent: you can give or withdraw consent at any time via the consent banner.

5. California — CCPA/CPRA disclosures

We do not sell your personal information. Consistent with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA): we do not sell your personal information, and no personal information has been sold in the preceding 12 months. We share limited data with advertising/analytics providers as disclosed in this policy.

"Sharing" disclosure for the Meta Pixel (conditional). If the Meta Pixel is activated, data processed through the Pixel is shared with Meta as an advertising provider, and that may constitute "sharing" for cross-context behavioral advertising under the CPRA. When the Pixel is activated, Meta is a joint controller of personal data processed through the Pixel, and shared data may be used by Meta for its own purposes. Data is shared with Meta only after consent is obtained, as described in §3.

Opt-out rights. No dedicated California opt-out link is offered at this time, because no sale occurs and no sharing occurs until analytics tools are activated with consent. Consent is managed via the consent banner; a dedicated opt-out control will be added if the Meta Pixel is activated. Until then, opt-out and all other California privacy requests may be submitted through the contact channel in §1.

Shine the Light (Cal. Civ. Code § 1798.83). California residents may request, once per calendar year, information about personal information disclosed to third parties for their own direct marketing purposes in the preceding calendar year. Requests may be submitted through the contact channel in §1.

Non-discrimination. You will not be denied goods or services, charged different prices, or provided a different quality of service for exercising your California privacy rights.

6. Retention

Personal data is retained only for as long as needed to deliver the service and to fulfill the purposes described in this policy. When data is no longer needed, it is deleted or de-identified.

Retention carve-outs, stated honestly:

• Billing and transactional records are retained as required by applicable law, including tax and accounting obligations (GDPR Art. 17(3) carve-out for legal compliance).
• Analytics data is handled in accordance with the analytics section (§3) and the retention terms of each analytics provider; analytics data is not silently claimed to be deleted.
• Memory graphs. Deleting a memory graph removes it from your view immediately and revokes its API keys. It stays restorable from the organization's "Trash" for 7 days. After that it is permanently erased, together with its backup copies.
• Session recordings. When an organization has session recording enabled, agent sessions recorded on a member's own machine are retained until they are deleted — there is no retention window and no automatic expiry. This is deliberate rather than an oversight: Tortoise is a memory product, and keeping what has been recorded is the service being delivered, not an incidental retention choice. The purpose of the processing (§4) requires that recorded sessions remain available to the organization for as long as the organization or the member who contributed them keeps them, so retention ends on deletion rather than on a timer. Deletion is performed by the organization's members: any member of the organization can view the organization's recorded sessions and delete them. (Deletion scoped to the member who contributed a session, and organization-wide deletion by an administrator as a separate control, are planned refinements rather than current behaviour.) Turning recording off stops new captures; it does not delete sessions already recorded. A member who leaves an organization loses access when their membership ends, and sessions they contributed before leaving remain part of that organization's stored memory until deleted.
• Accounts. Deleting a team account removes it from your view immediately, revoking its API keys and ending its members' access. It stays restorable for 7 days. After that the team account's live data is permanently erased. Deleting your personal account also deletes every team for which you are the only owner: those teams are removed from your view immediately, with their API keys revoked and their members' access ended. The account's live data is permanently erased after the same 7-day window, during which the deletion can be reversed by contacting the email channel in §16.
• Backups. Our backups cover the last four weeks. A backup taken while your data was live can therefore still contain it for up to four weeks. The two deletion paths differ in how their own backup copies end: a deleted memory graph's own backups are erased when its 7-day window ends, while deleting an account does not actively purge its copies in our backups — those age out on the same four-week cycle. A deleted session recording is likewise not actively purged from snapshots taken before its deletion; those copies age out on the same four-week cycle, so deletion of a recording is complete in the live service immediately and in backups within four weeks.

7. Security

Reasonable technical and organizational measures are applied to protect personal data:

• Data in transit is encrypted using TLS.
• Passwords are stored using salted hashing.
• Access to production systems is restricted to authorized personnel and protected by authentication.
• Access to personal data is limited to what is necessary to operate and support the service.

No security measures are absolute, and the security of the internet cannot be guaranteed. You are responsible for keeping your account credentials confidential.

8. Your rights

GDPR rights. The controller is established in the United Kingdom, so the UK GDPR gives you these rights wherever you are located; where the EU GDPR applies, it gives you equivalent rights. You have the right to:

• Access a copy of your personal data;
• Rectify inaccurate personal data;
• Erasure ("right to be forgotten");
• Restrict processing in certain circumstances;
• Data portability — receive personal data you provided in a structured, machine-readable format;
• Object to processing based on legitimate interests;
• Withdraw consent at any time, where processing is based on consent;
• Lodge a complaint with a supervisory authority where one exists in your country of residence — for the UK that is the Information Commissioner's Office, at ico.org.uk/make-a-complaint.

CCPA/CPRA rights. If you are a California resident, you have the right to:

• Know the categories and specific pieces of personal data processed about you;
• Delete personal data, subject to legal exceptions;
• Correct inaccurate personal data;
• Opt out of the "sale" or "sharing" of personal data — not applicable at this time because no sale or sharing occurs (§5), and exercisable via the contact channel in §1;
• Non-discrimination for exercising these rights.

Where rights under different laws overlap or conflict, the applicable law governs. All requests are subject to identity verification as described in §16.

9. Data Processing Agreement

A copy of the Data Processing Agreement (DPA) is available at https://tortoise.premiselabs.co/dpa.

Under GDPR Art. 28(3), a DPA is required whenever a processor relationship exists — regardless of deal size, including for free-tier users. The DPA applies to the processor relationships described in §10 and takes effect when personal data is submitted to the service.

10. Processors and third-party sharing

Personal data is shared only with the processors and providers listed below, and only to the extent necessary to operate the service. Each processor is engaged under a data processing agreement that complies with GDPR Art. 28, and processors act only on documented instructions.

• Supabase — authentication and account records are processed by Supabase (the processor that holds account personal data: email/login). Used today.
• Cloudflare — the website and API are hosted and delivered via Cloudflare. Used today.
• GitHub — sign-in may be completed through the GitHub OAuth identity provider; when you choose that option, identity data is processed by GitHub. Used today.
• Google — sign-in may be completed through the Google OAuth identity provider; when you choose that option, identity data is processed by Google. Used today.
• PostHog — analytics data is processed by PostHog when you give consent via the consent banner (§3). Used today.
• Google Tag Manager — the consent-gated tag container that delivers GA4 and, when activated, the X and LinkedIn tags; it is loaded only after consent via the consent banner (§3). Used today.
• Google Analytics (GA4) — analytics data is processed by Google when you give consent via the consent banner (§3). Used today, delivered via Google Tag Manager.
• X (Twitter) — if the X advertising tag is activated with consent, data is processed by X Corp. (§3). Not deployed today.
• LinkedIn — if the LinkedIn Insight Tag is activated with consent, data is processed by LinkedIn Corporation (§3). Not deployed today.
• Meta — if the Meta Pixel is activated with consent, data is processed by Meta Platforms, Inc. (§3). Not deployed today.
• Stripe — when paid plans become available, payment data is processed by Stripe for billing. Not deployed today.

No other sharing of personal data occurs, except as required by law or with your consent.

11. AI training

we do not use your content or usage data to train AI models — at any tier, free or paid, now or in the future under this policy. This is a commitment of the product, not a limitation of a plan.

12. International data transfers

Personal data may be transferred to, and processed in, countries other than the country where you reside, including the United States, where the service's infrastructure and processors are located.

Where personal data is transferred from the EU/EEA, the UK, or Switzerland, appropriate safeguards are provided:

• Data Privacy Framework (DPF): transfers to processors that participate in the EU–US DPF, the UK Extension, or the Swiss–US DPF rely on those certifications.
• Standard Contractual Clauses (SCCs): where a processor does not rely on the DPF, transfers are protected by SCCs adopted by the European Commission or equivalent safeguards; for transfers from Switzerland, the Swiss Addendum to the EU SCCs. For transfers subject to the UK GDPR, the equivalent instrument is the UK's International Data Transfer Agreement, or the UK Addendum to the EU SCCs — one of the two is put in place before any transfer that needs it, and both are "equivalent safeguards" for this purpose.

PostHog US residency. PostHog is a data processor; data is stored in the United States. EU- and UK-origin analytics data captured with consent is stored in the United States.

13. Sensitive data

we do not intentionally collect sensitive personal information. Sensitive personal data — such as health data, biometric data, government identifiers, racial or ethnic origin, or other special-category data — is not requested, and is not needed for any feature of the service.

As stated in §2, "we expect users not to place sensitive data in the service." If you place sensitive data in the service despite this expectation, that data is processed at your direction in the same way as other content you submit, and you are responsible for ensuring you are entitled to process it.

14. (Reserved)

Reserved — see §12.

15. Version, effective date, and document history

Current version: 1.3

This policy is versioned. When this policy changes, the version number and effective date are updated, and a new entry is added to the document history below. Material changes are posted before they take effect.

16. Exercising your rights — deletion and other requests

Primary mechanism: email. To make a privacy request other than the in-product account deletion described below (access, correction, export, restriction, objection) — or to request deletion of your account when you cannot sign in — email your request to [email protected].

Response commitment. Requests are answered within one month of receipt, as required by GDPR Art. 12(3). If a request is complex or numerous, the response period may be extended by up to two additional months; you will be informed of any extension within one month of receipt, together with the reasons for the delay. The exception is a request made under Mexican law, which is answered within the 20 Mexican business days stated in §1, or within one month under GDPR Art. 12(3) if that is earlier.

Identity verification. we may request identity verification before acting on any request (GDPR Art. 12(6)). Where a request cannot be verified or is manifestly unfounded or excessive, the request may be refused or a reasonable fee may be charged, as permitted by law.

What this channel covers. The email channel covers: (a) account data, (b) non-account data, (c) users who cannot log in to their account, and (d) access, export, and objection requests. It is the general-purpose rights channel for this release.

Deletion scope. When a deletion request is fulfilled, account and associated data is deleted or de-identified, subject to the retention carve-outs in §6 (billing/transactional records retained as required by law; analytics data handled per the analytics section). Deletion does not extend to content you have already shared publicly or to data that others have lawfully obtained. A deleted memory graph, user account, or team account remains restorable for 7 days. After that, the deleted item's live data is permanently erased; for a deleted account, copies in our backups are not actively deleted and age out on the four-week cycle described in §6. §6 covers how a deleted memory graph and a deleted account are erased, and the retention and deletion policy is the single source of truth for these windows. Session recordings are not governed by the 7-day restore window: they are retained until deleted, as described in §6.

Self-service account deletion. You can delete your personal account yourself from the dashboard's Profile tab. Every team for which you are the only owner is deleted with your account, and those teams are removed from your view immediately with their API keys revoked and their members' access ended. During the recovery window described in §6, a deletion can be reversed by contacting us through the email channel above; after that window the account's live data is permanently erased and — as stated in §6 — its copies in our backups are not actively deleted but age out on the four-week cycle. No in-product restore control is offered: a deleted account is restored only through the channel above, and we do not promise a self-service restore.