Chronotope Labs, Inc.
Privacy Policy
1. Who we are and what this notice covers
Chronotope Labs, Inc. ("Chronotope," "we," "us," or "our") is a Delaware corporation that develops custom computational models, artificial intelligence, simulations, digital twins, and software for materials and industrial processes, including mining, manufacturing, energy, and construction.
This notice explains how we handle personal information through chronotope.ai and other company-operated websites that link to this notice, business communications, customer and supplier relationships, partnerships, and recruitment. Chronotope is responsible for the personal information it processes for these business purposes.
When we process personal information on behalf of a customer, we act within that customer's authorized instructions and the applicable services and data-processing agreements. The customer's privacy notice ordinarily explains that processing to the individuals concerned. Neither a customer agreement nor this notice limits rights that applicable law gives individuals.
Employment administration, payroll, benefits, and separately notified activities are addressed through the notices applicable to those activities. Site recording and dataset-licensing activities require the specific notices and authorizations described below; this general website notice does not authorize them.
2. Information we collect and where it comes from
Depending on the interaction, we collect the following categories:
Business contact and relationship information: names, work email addresses, telephone numbers, job titles, organizations, business addresses, correspondence, meeting details, proposals, contracts, and information supplied during business discussions. Billing and due-diligence records may include information about authorized representatives, payment contacts, and business transactions.
Recruitment information: professional profiles, resumes, employment and education history, qualifications, application materials, interviews, work-trial submissions and evaluations, references, and hiring communications. Information required for employment eligibility or other sensitive onboarding purposes is collected through the appropriate process when needed, rather than through general website inquiries.
Website and security information: IP addresses, browser and device information, request times and pages requested, and technical records generated by website hosting and security services. For business systems, records may also include account identifiers, access events, and administrative actions.
Information supplied in project communications: files, technical descriptions, and other material shared with us may contain names, work contact details, or other information about identifiable people. Industrial measurements, machine telemetry, imagery, or location records can also constitute personal information when linked to an identifiable person.
We receive information from individuals, their organizations, customers, referrals, recruiters, recruitment platforms, professional networking services, public professional sources, and the providers operating our systems. We limit collection to information relevant to the activity. Please do not send government identification numbers, financial credentials, medical records, or other sensitive information through general inquiries unless we have arranged an appropriate collection method.
3. How we use information
We use personal information to respond to requests; evaluate and perform engagements; schedule meetings; manage business relationships, contracts, billing, and due diligence; assess candidates and administer recruitment; operate and secure our website and systems; investigate misuse; meet legal and recordkeeping obligations; and establish, exercise, or defend legal rights.
We may contact business prospects and candidates about relevant services or opportunities. Promotional outreach and consideration for unrelated future opportunities are optional: reply to the message or contact [email protected] to stop that outreach. We may retain limited suppression information to respect your choice and may still send necessary contractual, administrative, or legal communications.
Where applicable law requires a legal basis, we use the basis appropriate to the activity, such as steps requested before a contract, performance of a contract, legal obligations, legitimate interests where available and appropriate, or consent where required. We obtain required consent separately; visiting the website is not consent to unrelated processing.
4. Who receives information
We disclose the categories of information described above to the extent needed for the following purposes:
- Business technology providers supporting hosting, cloud computing, email, document storage, scheduling, development, security, and compliance administration. Our business tools include Google Workspace, GitHub, and Vanta. This list describes business tools and is not a representation that every provider receives every customer's data.
- Recruiting providers and professional references for the relevant recruitment process, subject to applicable permissions and confidentiality requirements.
- Customers, suppliers, or partners when necessary to manage the relevant business relationship or carry out an authorized engagement.
- Legal, accounting, insurance, and other professional advisers for their services, and authorities or other recipients where disclosure is legally required or necessary to protect lawful rights, safety, or security.
- Parties and advisers involved in a proposed or completed financing, acquisition, restructuring, or similar corporate transaction, subject to appropriate confidentiality protections and applicable legal restrictions. Such a transaction does not independently authorize use of customer confidential information beyond existing obligations.
Our requirements for providers handling confidential or personal information include appropriate confidentiality, security, purpose restrictions, and contractual safeguards. Customer data may be disclosed to subprocessors only within the authorization and approval requirements of the applicable customer agreement. Where a disclosure requires consent, we obtain it unless a lawful exception applies.
We do not sell the personal information covered by this notice or share it for cross-context behavioral advertising. We do not use it for targeted advertising.
5. Customer data and artificial intelligence
Customer information is used only for the authorized engagement. This can include preparing data, developing and validating project-specific models, running simulations or inference, and providing agreed support. It does not automatically permit building a general-purpose model or a commercial dataset.
We do not use one customer's confidential data, project-specific models, or proprietary results for another customer's work, general model training, public demonstrations, or publication without that customer's express written authorization. Removing a customer's name or aggregating records does not by itself authorize reuse or eliminate confidentiality obligations. Customer-specific model weights, embeddings, and other derived artifacts are subject to the same restrictions when they contain or reveal protected customer information.
Our policy prohibits entering customer confidential information into public or unapproved AI tools. Use of an external model or AI provider requires authorization for the relevant purpose and review of its access, retention, security, and training terms. Providers must not use customer confidential information for their own general model training unless the customer has expressly authorized that use in writing and applicable privacy requirements have been met.
Customer ownership, licenses, and rights in data, models, results, and deliverables are governed by the applicable written agreement and any binding customer-specific commitments. This notice grants Chronotope no additional ownership, training, publication, or reuse rights and does not reduce rights already granted to a customer.
6. Industrial recordings and separately authorized datasets
Collection of industrial video, photographs, audio, drone imagery, machine telemetry, or sensor data must have a defined purpose and an authorized project scope. Where people can be identified, the responsible parties must arrange the required privacy notices, lawful basis, permissions, and consent before collection or disclosure. Permission from a site owner does not by itself establish all necessary rights concerning workers, visitors, or other individuals.
Licensing or transferring recordings or datasets to an outside research laboratory, model developer, or other recipient is a separate use requiring an express written agreement and the applicable individual privacy protections. A services engagement or site-access permission does not itself authorize that use. The relevant collection notice must identify the intended use, recipients or recipient categories, retention, and available choices. This website notice is not a release for recording, biometric identification, or sale of identifiable recordings.
7. Cookies and browser controls
Our website and its hosting services process technical information to deliver pages, protect the service, and diagnose failures. Cookies or similar browser storage may be used where needed for site functionality or security. Browser settings can restrict or delete cookies, although doing so may affect functionality.
We do not authorize advertising tracking across unrelated websites through our Site. Our stated practices do not change in response to a browser's Do Not Track signal. Global Privacy Control is a separate opt-out signal; our no-sale and no-sharing practices also apply to visitors using that signal, and we honor applicable legal obligations concerning recognized opt-out signals.
Third-party sites reached through external links have their own privacy practices. Introducing analytics, advertising technologies, or new embedded services requires review of the resulting data collection, appropriate updates to notices, and any legally required consent or opt-out controls before use.
8. Retention and deletion
We retain information for as long as reasonably needed for the purpose described in this notice, considering the relationship, the information's sensitivity, contractual requirements, applicable recordkeeping periods, and the need to address legal claims.
Business correspondence and transaction records are retained as needed to administer the relationship and satisfy applicable legal and accounting obligations. Security records are retained according to their investigative purpose, system settings, and applicable contractual or legal requirements.
For recruitment subject to California employment-record requirements, we retain application, referral, evaluation, and hiring-decision records for at least four years after creation or receipt, or the relevant employment action, as applicable, using the later date where both requirements apply. Other recruiting records are retained according to applicable requirements and the purpose of the recruitment activity. Records retained to meet legal obligations are not automatically used for continued recruiting outreach.
Customer project data is returned, deleted, or retained according to the customer agreement and applicable law. This includes relevant working copies and derived artifacts. Where immediate removal from backups is not technically feasible and the agreement and law permit deferred deletion, retained copies remain protected and unavailable for ordinary use until removed through the applicable retention cycle. If a backup is restored, applicable deletion instructions must be reapplied.
Legal holds and mandatory retention obligations can delay deletion. When retention is no longer necessary, information is deleted or de-identified using the applicable system processes. De-identification does not expand our contractual rights to use customer information.
9. Privacy rights and requests
You may contact [email protected] to request access, correction, deletion, or other applicable privacy rights. Depending on the law that applies, rights may also include a portable copy, restrictions on certain processing, objection, withdrawal of consent, limits on certain uses of sensitive information, and appeal of a decision. Withdrawal does not invalidate processing lawfully performed before withdrawal. We do not discriminate against individuals for exercising applicable rights.
Include your name, a way to respond, the nature of your relationship with us, and a description of the request. We request only the information reasonably needed to locate records, verify identity when required, and establish a representative's authority. Please do not initially send identification documents or sensitive records by ordinary email; we will arrange an appropriate method if necessary. Verification is not imposed where the applicable right does not require it.
We acknowledge and respond to requests within the time limits required by applicable law. If a permitted extension is necessary, we provide the required explanation and notice. Requests are generally free, subject only to charges or exceptions permitted by law. We explain any denial or limitation and any available appeal process. Requests can be limited by legal retention obligations, third-party rights, and other applicable exceptions.
Individuals exercising rights under Mexican law may use the same contact for access, rectification, cancellation, and opposition (ARCO), withdrawal of consent, and limitations on use or disclosure. A request should identify the right sought and the information concerned; correction requests should describe the correction and supporting information. We communicate the determination within 20 business days and, where appropriate, implement it within the following 15 business days, subject to extensions and exceptions permitted by law. Applicable access responses are provided electronically after appropriate verification, unless another lawful method is arranged.
Where we process information on a customer's behalf, we coordinate with that customer and direct or transmit the request as appropriate, unless the law requires us to respond directly. You may also complain to the competent privacy authority where applicable.
10. International processing and security
Chronotope operates in the United States. Information may be processed in the United States and other locations used by authorized personnel and service providers, subject to applicable law and contractual restrictions. Customer-specific residency, remote-access, and transfer restrictions continue to apply. We use legally required transfer safeguards or obtain required consent where applicable; use of the website does not waive these requirements.
We maintain a security program designed to protect personal and confidential information against unauthorized access, loss, alteration, and disclosure. Its requirements address authorized access, authentication, encryption, device protection, development practices, incident handling, and provider oversight. Our Security and Customer Data Protection page describes these requirements. No system can guarantee absolute security.
Our business website is not directed to children under 13, and we do not knowingly collect their personal information through it. Contact us if you believe a child has provided information so that we can address it appropriately.
11. Updates and contact
We post revisions with an updated date and give prominent notice of material changes, with additional notice or consent where required by law. A revised notice does not retroactively authorize an incompatible new use of previously collected information. The Chief Executive Officer is responsible for this notice and for arranging review at least annually and when material practices change.
Privacy contact:
Chronotope Labs, Inc.
Attention: Privacy
459 Lagunita Drive
Stanford, CA 94305, United States
[email protected]