Privacy policy
Resolute Labs AI, Inc., a Delaware corporation operating as Experiential Labs ("Experiential Labs", "we", "us", or "our") publishes this privacy policy (the "Policy") to describe the personal data we collect through the website at experientiallabs.ai (the "Site"), how we use and disclose it, and the choices and rights you have in relation to it. "Personal data" means information that identifies you or could reasonably be linked to you, such as an email address, an IP address, or a cookie identifier. By visiting the Site you acknowledge that we collect, use, and disclose personal data as described in this Policy.
1. Scope
This Policy applies to the Site only. The Experiential Labs platform at platform.experientiallabs.ai (the "Platform") is a separate service that this Policy does not cover. Anything you do after signing in to the Platform, including creating an account, generating an API key, and sending requests through the gateway, is outside this Policy. Where the Site hands you off to the Platform, this Policy explains what the Site sends in the handoff, and this Policy stops there.
2. Personal data we collect
2.1 Information you give us
The Site has four forms. Each takes only what is listed here, and we receive what you type.
- Get API key. The buttons on the home page and elsewhere ask for an email address. Your browser is redirected to the Platform's signup page with the address included in the URL, together with the campaign parameters, click identifiers and referrer of your visit so the Platform can record which campaign led to the account, and the Platform creates the account. If you have accepted the optional category, the Site also records that the address belongs to our visitor id (section 6.1a); otherwise the Site does not store the address. Our analytics remove the address from the URL before recording the page view.
- Waitlist and evaluation requests. The custom models and intelligence pages ask for an email address so that we can follow up. The address is emailed to us through Resend and, if you have accepted the optional category, recorded against our visitor id (section 6.1a).
- Startup program application. The startups page asks for a company name, a team size band, an expected monthly AI spend band, and an email address. The application is posted to a private Slack channel through a webhook; if Slack cannot be reached, it is emailed to us through Resend instead. Your browser is then redirected to the Platform signup with the address and the campaign parameters of your visit included in the URL, and the section 6.1a record is made if you have accepted the optional category.
- YC sign-in. The unlisted page for Y Combinator founders asks for an email address, or lets you continue with Google or GitHub. The Site posts a notification to a private Slack channel containing the email address, or the name of the sign-in method you chose, and then redirects you to the Platform's sign-in, with the address and the campaign parameters of your visit in the URL when you chose email. No password or OAuth credential passes through the Site.
Booking a call. The "Book a call" links open a scheduling page hosted by Cal.com in a new tab. Whatever you enter there is collected by Cal.com under its own privacy policy, and Cal.com passes the booking details to us. Where the Site books a time on your behalf from a form, it sends your email address and the chosen time to Cal.com from our server.
Email. If you write to us, we keep the correspondence and whatever personal data it contains.
2.2 Information collected automatically
- Server logs. Our hosting provider, Vercel, records each request to the Site: IP address, browser user agent, the page requested, the referring page, and the time.
- Analytics. PostHog records page views, clicks on the Site's buttons and forms, device and browser details, approximate location derived from your IP address, and the URLs you visit. It sets the identifiers listed in section 5.
- Advertising measurement. Google Tag Manager loads the Reddit pixel, which records page views and conversion events against the _rdt_uuid identifier so that Reddit can attribute visits and signups to Reddit advertising.
- Visitor identification. The RB2B script sends information about your visit to RB2B. Section 2.3 describes what comes back.
- Preferences. The Site stores your theme choice, the country your request came from, and your consent choice in your browser, as listed in section 5.
2.3 Information from third parties
For visitors in the United States, RB2B matches a visit against its own records and returns business contact information about the visitor to us: name, company, and work email address, where RB2B holds them. RB2B sends the match to us, and we keep it as described in section 10. We do not receive a match for visitors outside the United States. You can stop this identification as described in section 6.
3. How we use personal data
We use the personal data described in section 2 to:
- respond to the request you made through a form, including reviewing a startup application, following up on an evaluation request, and handing you off to the Platform;
- operate, maintain, and secure the Site, including detecting and investigating abuse, and debugging errors;
- understand how the Site is used, which pages are read, and which calls to action lead to a Platform signup;
- measure whether our advertising on Reddit leads to visits and signups;
- identify businesses whose staff visit the Site so that we can contact them about the Platform;
- send you marketing about the Site or the Platform where you have asked for it or where the law allows it, with an opt-out in every message;
- comply with law, respond to lawful requests, and establish or defend legal claims; and
- enforce our terms of use and protect our rights.
We do not use personal data collected through the Site for automated decisions that produce legal or similarly significant effects about you.
4. How we share and disclose personal data
4.1 Service providers
We disclose personal data to the providers below so that they can perform services for us. Each receives only what is listed and is bound by its own terms to use the data to provide the service.
| Provider | Role | What it receives |
|---|---|---|
| Vercel | Hosting and content delivery | Every request to the Site, including IP address, user agent, page requested, referrer, and time, in its server logs; and, through its cookieless Web Analytics and Speed Insights beacons, page paths, referrer origin, country, device class, and page timing metrics, without an identifier. |
| PostHog | Product analytics | Page views, button clicks, form events, device and browser details, and the URLs visited, with the email query parameter removed before the event leaves your browser. |
| Google Tag Manager | Tag delivery | Page loads, so that it can deliver the Reddit pixel. The container is the only place advertising tags are configured. |
| Advertising measurement | Page views and conversion events, together with the _rdt_uuid identifier, to attribute visits and signups to Reddit advertising. | |
| RB2B | Visitor identification | Data about your visit, which RB2B matches against its own records to return business contact information about United States visitors. |
| Neon | Database | The consent and opt-out records described in section 6, and, where you have agreed, the first-party page views and actions described in section 6.1a. Hosted in the United States (AWS us-east-2). |
| Resend | Transactional email | The contents of a waitlist or evaluation request, and of a startup application when Slack delivery fails, in order to email them to us. |
| Slack | Internal notifications | Startup applications and YC sign-in notifications, posted to a private channel through an incoming webhook. |
| Cal.com | Scheduling | Whatever you enter on the Cal.com booking page, and, where the Site books a time for you, your email address and the chosen time. |
| GitHub | Repository metadata | A request from our server for the star count of the gateway repository, cached for an hour. No visitor data is included. |
4.2 The Platform
When you use a form that continues into the Platform, the Site passes your email address, together with the campaign parameters, click identifiers and referrer of your visit, to the Platform in the URL of the redirect, at your direction. This Policy does not cover what happens to them there.
4.3 Corporate transactions
If Experiential Labs is involved in a merger, acquisition, financing, reorganization, or sale of some or all of its assets, personal data may be disclosed to the counterparty and its advisers as part of that transaction, and transferred to the successor.
4.4 Legal requests and protection of rights
We may disclose personal data where we believe in good faith that the disclosure is required by law, subpoena, court order, or a lawful request by a public authority, or is necessary to protect the rights, property, or safety of Experiential Labs, our visitors, or others.
4.5 Advertising partners
The Reddit pixel described in section 2.2 discloses page views and conversion events to Reddit, and the RB2B script discloses visit data to RB2B. Section 7 explains how state privacy laws treat those disclosures.
We do not sell the form data you send us, and we do not disclose personal data to third parties for their own marketing.
5. Cookies and trackers
The Site sets the cookies, local storage entries, and scripts listed below. Each row states who writes it and whether it is first-party (set on experientiallabs.ai) or loaded from a third party, how long it lasts, and whether it is necessary or optional. Product analytics, advertising measurement, our own first-party visitor tracking (section 6.1a), and visitor identification are one optional category, switched on and off together by the choices in section 6; the theme preference, the region marker, and the consent records are necessary for the Site to remember what you chose. Nothing optional is set for a visitor who meets the consent banner until that visitor accepts. Rejecting or withdrawing clears the optional cookies and local storage entries in this browser; session storage entries end when the tab closes.
| Name | Purpose | Set by | Duration | Necessary or optional |
|---|---|---|---|---|
ph_* (cookie, local storage, session storage) | Product analytics: pages viewed, buttons clicked, and whether a visit continues into a Platform signup. | First-party, on experientiallabs.ai, written by PostHog's script (PostHog, United States) | 1 year for the cookie and the local storage entry; the session storage entries end when the tab closes | Optional (marketing) |
_rdt_uuid (and _rdt_em where an email address is passed) | Advertising measurement: tells Reddit that a visit or signup followed a Reddit ad. Delivered through Google Tag Manager. | First-party, on experientiallabs.ai, written by the Reddit pixel (Reddit, via Google Tag Manager) | 90 days | Optional (marketing) |
RB2B script and its identifiers (_reb2b*, rb2b_*, cookies and local storage) | Visitor identification: matches a visit to business contact information (name, company, work email) so we can follow up. Resolves visitors in the United States only. | First-party identifiers on experientiallabs.ai, written by RB2B's script, which loads from a third-party host (RB2B) | RB2B publishes no lifetime for its identifiers; they persist until you opt out, which clears them, or clear your browser storage. The script is fetched on each page view while marketing is on. | Optional (marketing) |
Vercel Web Analytics and Speed Insights beacons | Page-view counts and page performance timings without an identifier. Vercel counts visitors from a request hash it discards after 24 hours; nothing that could join two visits reaches us. | First-party requests to experientiallabs.ai, handled by Vercel (Experiential Labs, Vercel) | No cookie or storage is set | Not consent-controlled: sets nothing on your device and carries no identifier |
experiential-theme (local storage) | Remembers whether you chose the light or dark theme. | First-party (Experiential Labs) | Until you clear your browser storage | Necessary |
el_consent | Remembers the choice you made in the cookie banner or on the Your Privacy Choices page. | First-party (Experiential Labs) | 12 months | Necessary |
el_region | Remembers the country your request came from, so the Site knows which consent treatment applies without asking again. | First-party (Experiential Labs) | 24 hours | Necessary |
el_fp_optout | A standing marker, set only when you reject all tracking on the Your Privacy Choices page, that stops the Site's own identifiers being set again. | First-party (Experiential Labs) | 12 months | Necessary |
el_gpc_logged, el_notice_seen, el_revoke_reloaded (session storage) | One-tab bookkeeping: whether a Global Privacy Control signal has been recorded in this session, whether the cookie notice was dismissed, and whether the page was reloaded after a withdrawal. None carries an identifier. | First-party (Experiential Labs) | Until the tab closes | Necessary |
__ph_opt_in_out_* (cookie or local storage) | PostHog's own marker that capture is switched off for this browser, written when you withdraw after having accepted. | First-party, on experientiallabs.ai, written by PostHog's script (PostHog, United States) | Until you clear your browser storage; Reject all on the Your Privacy Choices page also clears it | Optional (marketing) |
el_cdp_id, el_cdp_attr | Our own visitor id and first-touch attribution (campaign parameters, click ids, referrer, landing page), so we can see which pages and channels lead to a signup. Set for experientiallabs.ai and its subdomains, so the Platform sees the same id. Described in section 6.1a. | First-party (Experiential Labs) | 13 months for el_cdp_id, 90 days for el_cdp_attr | Optional (marketing) |
el_cdp_session (session storage) | Groups the page views and actions in one visit under one id. | First-party (Experiential Labs) | Until the tab closes | Optional (marketing) |
5.1 Tracking across other websites and over time
Third parties collect personal information about your online activities over time and across different websites when you use the Site. Reddit does so through the pixel that Google Tag Manager delivers: the _rdt_uuid identifier lets Reddit connect your visit here with your activity on Reddit and on other websites that carry its pixel. RB2B receives data about your visit and matches it against records it has assembled from other sources. Neither runs for a visitor who meets the consent banner until that visitor accepts, and either can be switched off on the Your Privacy Choices page or by the Global Privacy Control signal, as described in section 6.
5.2 Do Not Track and Global Privacy Control
The Site does not respond to "Do Not Track" browser signals, for which there is no settled standard. It does honor the Global Privacy Control signal, as described in section 6.3.
6. Your rights and choices
6.1 The consent banner
Visitors in the European Economic Area, the United Kingdom, and Switzerland see a banner on their first visit. PostHog analytics, the Reddit pixel, and RB2B visitor identification stay off until you choose "Accept all". Choosing "Reject all" keeps them off. You can change the choice at any time on the "Your Privacy Choices" page.
6.1a Our own first-party visitor tracking
Separately from the vendors above, the Site records its own first-party event stream: which pages you visit and which buttons or forms you use, tied together by a visitor id we set (el_cdp_id) and, on your first visit, the campaign parameters or referrer that brought you here (el_cdp_attr). This is not shared with PostHog, Reddit, Google, or RB2B; it is stored in our own database (Neon, section 4) and used to understand which pages and channels lead to a signup. It is switched on and off by the same choice as the rest of this section, never before you make it, and cleared the same way when you refuse or withdraw. We retain these rows for 90 days. The visitor id cookie is set for experientiallabs.ai and its subdomains, so the Platform can connect a signup to the pages on the Site that led to it. If you submit a form that carries your email address while this category is on, we also record, in the same database, that this visitor id belongs to that email, so we can connect a later conversation to the visit that started it. That one record is kept under the form-submission retention in section 10; the email itself is handled as a form submission (sections 2.1 and 3) whether or not this category is on.
6.2 The "Your Privacy Choices" page
Any visitor can open the Your Privacy Choices page from the link of that name in the footer of every page, marked with the opt-out icon, and switch the optional category off. Doing so stops PostHog capture, withdraws advertising consent in Google Tag Manager so the Reddit pixel no longer fires, and stops the RB2B script from loading on later page views. The choice is recorded in your browser for 12 months and applies to that browser only. This page is also where a California resident opts out of the sale or sharing of personal information, as described in section 7.
6.3 Global Privacy Control
If your browser sends the Global Privacy Control ("GPC") signal, the Site treats it as an opt-out of the optional category (analytics, advertising measurement, and visitor identification) for that browser, and as a valid request to opt out of the sale or sharing of personal information under the state laws described in section 7.
6.4 Browser settings
You can block or delete cookies and local storage for the Site through your browser settings. The Site works without them, though it will not remember your theme choice or your consent record.
6.5 Marketing email
The Site does not send marketing email. If we begin to, each message will carry an unsubscribe link, and you can also write to the address in section 14. Messages that answer a request you made, such as a reply to a startup application, are service messages and are sent regardless of marketing preferences.
6.6 Access, correction, and deletion
You can ask us to tell you what personal data we hold about you, correct it, delete it, or give you a copy, by emailing the address in section 14. We will confirm your identity by replying to the email address on record before acting on the request, and we will respond within the time the applicable law allows. An authorized agent may make a request on your behalf with your written permission, which we may ask to see.
7. California and other US state disclosures
This section applies to residents of California and of other states with comprehensive privacy laws, and supplements the rest of this Policy.
7.1 Categories of personal information
In the preceding 12 months we have collected the following categories of personal information, from the sources, for the purposes, and with the recipients shown. We do not collect sensitive personal information, and we do not offer financial incentives in exchange for personal information.
| Category | Examples | Sources | Purposes | Disclosed to |
|---|---|---|---|---|
| Identifiers | Email address, IP address, cookie and device identifiers, and, from RB2B, name and work email | You; automatic collection; RB2B | Respond to your request; operate and secure the Site; measure advertising; identify business visitors for follow-up | Service providers; advertising partners (Reddit); the Platform, at your direction |
| Professional or employment-related information | Company name, team size band, and expected AI spend band from the startup application; employer from RB2B | You; RB2B | Evaluate a startup application; identify business visitors for follow-up | Service providers |
| Internet or other electronic network activity | Pages viewed, buttons clicked, referring site, browser and device details, server request logs | Automatic collection | Operate and secure the Site; understand how the Site is used; measure advertising | Service providers; advertising partners (Reddit); RB2B |
| Geolocation data (approximate) | Country or region derived from IP address | Automatic collection | Decide which consent treatment applies; understand where visitors come from | Service providers |
7.2 Disclosures in the preceding 12 months
For each statutory category, the table states whether we collected it in the preceding 12 months, to which recipients we disclosed it for a business purpose, and whether we sold or shared it and to whom. "Sold" and "shared" carry the meanings given in the California Consumer Privacy Act as amended ("CCPA"); the same two disclosures are a sale or targeted advertising under other state laws. We do not sell personal information for money.
| Category | Collected | Disclosed for a business purpose, to | Sold or shared, to |
|---|---|---|---|
| Identifiers | Yes | Vercel (hosting and server logs); PostHog (analytics); Resend, Slack, and Cal.com (form handling and scheduling); the Platform, at your direction | Yes. Cookie and device identifiers and IP address, to Reddit (advertising measurement) and to RB2B (visitor identification) |
| Professional or employment-related information | Yes | Slack and Resend (startup applications) | No |
| Internet or other electronic network activity information | Yes | Vercel (hosting and server logs); PostHog (analytics); Google Tag Manager (tag delivery) | Yes. Page views and conversion events, to Reddit; data about your visit, to RB2B |
| Geolocation data (approximate, derived from IP address) | Yes | Vercel (hosting and server logs); PostHog (analytics) | No |
| All other statutory categories, including sensitive personal information, precise geolocation, biometric information, and inferences | No | None | No |
We do not knowingly sell or share the personal information of consumers under 16 years of age.
7.3 How to opt out
To opt out of the sale or sharing of your personal information, and of targeted advertising, open the Your Privacy Choices page linked in the footer and switch measurement off, or enable the Global Privacy Control signal in your browser, which we honor as a valid opt-out request for that browser. An opt-out made on the Site applies to the browser you make it in; it does not carry to another browser or device, and it does not carry to the Platform.
7.4 Your rights
Depending on your state of residence, you have the right to:
- know the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties to which we have disclosed it;
- receive a copy of that personal information in a portable form;
- correct inaccurate personal information;
- delete personal information we have collected from you;
- opt out of the sale or sharing of personal information and of targeted advertising, as described in section 7.3; and
- exercise these rights free from discrimination. We will not deny you the Site, charge a different price, or provide a different level of service because you exercised a right under this section.
To exercise any right other than the opt-out, email the address in section 14. We verify requests as described in section 6.6. If we decline a request, our response will explain why and, where your state provides one, how to appeal.
7.5 Retention
Section 10 describes how long we keep each category of personal information.
8. EEA and UK legal bases
If you are in the European Economic Area or the United Kingdom, the EU General Data Protection Regulation and the UK General Data Protection Regulation (together, "GDPR") apply, and Experiential Labs is the controller of the personal data described in this Policy. We rely on the following legal bases:
- Consent (Article 6(1)(a)) for PostHog analytics, the Reddit pixel, RB2B visitor identification, and our own first-party visitor tracking (section 6.1a, including the record linking your email to our visitor id when a form gives us both), which are one optional category. These stay off until you accept them in the banner, and you can withdraw consent at any time on the "Your Privacy Choices" page. Withdrawal does not affect processing that took place before it.
- Legitimate interests (Article 6(1)(f)) for server logs, security, abuse investigation, and debugging, where our interest in running a working and secure Site is not overridden by your interests or rights. You may object to this processing as described below.
- Contract (Article 6(1)(b)) for the steps you ask us to take through a form: creating your Platform account, reviewing a startup application, answering an evaluation request, or booking a call.
- Legal obligation (Article 6(1)(c)) where we must keep or disclose personal data to comply with law.
Subject to the exemptions in applicable law, you have the right to access your personal data and receive a copy, to have inaccurate data rectified, to have data erased, to restrict processing, to receive the data you provided in a structured and machine-readable format, to object to processing based on our legitimate interests, and to withdraw consent. You also have the right to lodge a complaint with the supervisory authority in your country of residence or work, such as the Information Commissioner's Office in the United Kingdom. To exercise any of these rights, email the address in section 14.
9. International transfers
Experiential Labs processes personal data in the United States, and the Site and the service providers named in section 4 are hosted there. If you visit from outside the United States, your personal data is transferred to and processed in the United States, whose laws may differ from those of your country. For transfers from the EEA, the United Kingdom, or Switzerland, we rely on the standard contractual clauses approved by the European Commission and the UK addendum to them where a provider offers them in its data processing terms, and on your consent for the optional trackers you accept. You can ask for a copy of the safeguard relied on for a given transfer by emailing the address in section 14.
10. Data retention
For each category of personal data, the table states where it is held and either the period we keep it or the criterion that decides when it is deleted.
| Category | Where it is held | Period or criterion |
|---|---|---|
| Form submissions, email correspondence, and the RB2B matches delivered to us | Our email inbox (delivered by Resend) and a private Slack channel | Until we delete them from the inbox and the channel. We delete a submission once the request it carries is closed and we no longer need a record of it; a submission that leads to a Platform account is kept for as long as that relationship lasts. |
| Server logs | Vercel only; we configure no log drain, so no copy leaves Vercel | Vercel's published retention for runtime logs: 1 hour on its Hobby plan, 1 day on Pro, 3 days on Enterprise (Vercel documentation, read 2026-09-03). |
| Analytics events | PostHog, hosted in the United States | PostHog's published retention for our plan: 1 year on the free plan, 7 years on paid plans (PostHog pricing page, read 2026-09-03). The identifiers set in your browser expire after the periods in section 5 and are cleared when you opt out. |
| Our own first-party visitor tracking (section 6.1a) | Neon, hosted in the United States | 90 days from when we recorded the row, then deleted. If a form gave us your email while the category was on, the single row linking that email to the visitor id is kept under the form-submission rule in the first row of this table instead. The identifiers set in your browser expire after the periods in section 5 and are cleared when you opt out. |
| Advertising and identification data | Reddit and RB2B, under their own retention rules | We hold none of it ourselves beyond the RB2B matches listed in the first row. The identifiers those services set in your browser expire after the periods in section 5 and are cleared when you opt out. |
| Consent records | Your browser (the el_consent cookie) and our consent proof log | 12 months in your browser. Server-side, each choice is written to an append-only proof log and kept without a deletion date, because the record is what shows the choice was made; California's regulations (11 CCR 7101) require at least 24 months. An email opt-out or deletion request stays in the suppression register for as long as the opt-out is in force, because the entry is what enforces it. |
| Preferences | Your browser only | The theme choice until you clear browser storage; the region marker for 24 hours; the standing opt-out marker for 12 months (section 5). |
We may keep personal data for longer where the law requires it or where it is needed to establish or defend a legal claim.
11. Security
We take reasonable technical and organizational measures to protect personal data against loss, misuse, and unauthorized access, including serving the Site over HTTPS, limiting who can read the inboxes and channels that receive form submissions, and holding provider credentials outside the codebase. No method of transmission or storage is completely secure, and we cannot guarantee the security of personal data.
12. Children
The Site is not directed at anyone under 18 years of age, and we do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has given us personal data, email the address in section 14 and we will delete it.
13. Changes to this policy
We may update this Policy from time to time. When we do, we will change the date at the top of this page and, where a change is material, give additional notice on the Site. Continued use of the Site after a change takes effect means you have read the updated Policy.
14. Contact
Questions about this Policy and requests relating to your personal data should be sent to Experiential Labs at silen@experientiallabs.ai.