Privacy at ValidLab

Effective August 1, 2026.

ValidLab helps you validate an idea on evidence. That only works if you trust us with your thinking — so here is plainly who controls your data, what we collect and why, how long we keep it, who processes it on our behalf, and the rights you have.

Who is responsible (data controller)

The controller of your personal data is ValidLab, Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA. For any privacy question or to exercise a right below, contact support@validlab.ai.

What we collect, why, and the legal basis

• Account details (email, name) — to create and secure your account and sign you in. Legal basis: performance of our contract with you.
• Your idea content (problem, market, validation work, evidence) — to provide the product and generate your readiness score and AI coaching. Legal basis: performance of contract.
• Billing details (handled by Stripe; we store a customer reference and subscription status, never card numbers) — to take payment and manage your plan. Legal basis: performance of contract.
• Product usage & diagnostics (events, error reports) — to keep the service reliable and improve it. Legal basis: our legitimate interest in a working, improving product.

How your work is secured

If you bring your own Anthropic API key, it is encrypted at rest with AES-256-GCM and is never shown back to you in full. Your idea content is accessible only to your account and any team you explicitly join.

How AI processing works

When you ask the coach or generate a synthesis, the relevant idea content is sent to Anthropic's API to produce that response. Per Anthropic's API terms, inputs sent through the API are not used to train their models, and we do not use your content to train models of our own.

We don't sell your data

We do not sell or rent your personal information or idea content, and we do not share it for cross-context behavioural advertising. We share data only with the sub-processors below, to run the service.

Sub-processors

We use a small set of vendors to operate ValidLab. Each processes data only on our instructions:

• Stripe — payments and subscription billing.
• Anthropic — the AI model that powers the coach.
• Resend — transactional email (sign-in links, receipts, notifications).
• PostHog — privacy-respecting product analytics (cookieless on our marketing pages; no session recording).
• Sentry — error monitoring; a report may include your account email so we can reach you about an issue.
• Railway — application hosting and our database.
• Cloudflare R2 — storage for exported documents.

Some of these providers are based in the United States. Where your data is transferred outside your region, we rely on the providers' Standard Contractual Clauses (or an equivalent approved transfer mechanism) as the safeguard for that transfer.

How long we keep it

• Account & idea content — for as long as your account is active. Deactivating retains your data so it can be restored; a full deletion request purges it (see your rights below).
• Billing records — retained as required by tax and accounting law after a subscription ends.
• Diagnostic logs — retained for a short operational window (typically up to 90 days) and then rotated out.
• Encrypted backups — data can persist in rolling backups for a limited period after deletion before those backups expire.

Your rights

Subject to applicable law, you can request to access, correct, export (portability), restrict or object to the processing of, and delete your personal data, and to withdraw consent where we rely on it. You can export your work and deactivate or request deletion of your account directly from Settings, or email us. You also have the right to complain to your local data protection authority.

Cookies & analytics

Our marketing pages set no advertising cookies. Product analytics (PostHog) run cookieless on those pages and honour Do-Not-Track; fonts are self-hosted, so simply reading a page makes no third-party request. Signed-in app pages use only the cookies strictly necessary to keep you logged in.

Changes & contact

If we make a material change to this notice we will update the effective date above and, where appropriate, tell you in-product or by email. Questions, or want your data deleted? Email support@validlab.ai.