How Purfect Labs handles personal data when you use Shield or this site: what we process, who helps us process it, and the rights you keep. We keep it short and accurate.
What this is
This page summarizes the Data Processing Addendum between Purfect Labs Inc. (processor) and you or your organization (controller) for the Shield app and purfectlabs.com. A signed execution copy is available on request at info@purfectlabs.com. If there is any conflict, the signed copy governs.
Roles
You are the data controller. Purfect Labs Inc. is the data processor, acting only on your documented instructions as described in our Terms of Service and this addendum.
What we process
- →Anonymized machine IDs: one-way hashes used to run the Shield trial clock. Not a name, email, file, or prompt, and not reversible to one.
- →A trial usage counter, deletable from the app's License panel at any time.
- →Contact and intake form data you submit on purfectlabs.com (name, email, company, message).
We never receive your prompts, files, secrets, or model responses. Shield removes matched secrets and PII on your machine before anything is forwarded to your model provider.
Subprocessors
We engage the following subprocessors. Each is bound by its own data protection terms, linked from our Privacy Policy.
Subprocessors
Security measures
- →Encryption in transit on all service traffic (TLS).
- →Card data goes directly to Stripe; it never touches our servers.
- →Form submissions are delivered as notifications, not stored in a database.
- →Access to production systems is limited to named Purfect Labs personnel.
Data subject rights
We assist you in honoring access, correction, deletion, and portability requests, including rights under GDPR and CCPA. Trial records are self-service: delete them from the app's License panel. For anything else, email info@purfectlabs.com.
Retention and deletion
Trial records persist only while the trial or license is active and are deleted on request or in-app. Contact data is kept for the duration of the service relationship, then deleted on request. On termination of an engagement, remaining personal data is returned or deleted at your choice.
Breach notification
If we confirm a personal data breach affecting your data, we notify you without undue delay, with the nature of the breach, the data involved, and the steps we are taking.
International transfers
Our subprocessors operate primarily in the United States. Where GDPR or UK law requires a transfer mechanism, standard contractual clauses are incorporated into the execution copy on request.
Governing law
This addendum is governed by the laws of the State of Delaware, matching our Terms of Service.