What data reaches Purfect Labs when you use Transmute, and what never does. Short, because there is almost nothing to disclose.
Summary
Purfect Labs stores only the Transmute App trial and licensing records described below. It never receives what you send through Transmute, and the Platform editions send it nothing at all. Payments are processed by Stripe.
Because of that, there is no customer data for a data processing addendum to govern. This page records the facts for your procurement, vendor-risk, and privacy review. The full Transmute App privacy policy is at /privacy.
Transmute Platform
Purfect Labs does not process, receive, store, transmit, or have access to any customer data, including personal data, prompts, source code, credentials, model responses, logs, or analytics, in connection with the operation of the Platform. This is an architectural property of the product, not a policy promise.
- →Platform is supplied through a client engagement without App licensing checks. Source delivery is a separate Source offering under a perpetual source license; it is not included in Platform by default.
- →Zero egress to Purfect Labs. Platform contains no telemetry, no crash reporting, no update checks, no license server, and no phone-home of any kind. Its outbound connections are only those you configure, such as the LLM providers you select and your own storage, cloud accounts, and model infrastructure.
- →No Purfect Labs infrastructure in the data path. Purfect Labs operates no service the Platform communicates with, so there is nothing of ours to add to your attack-surface or subprocessor registers for Platform operation.
- →For the separate Source offering, provenance markers are inert. Per-customer watermarks and canary patterns identify the delivered source tree; they transmit nothing.
With respect to data the Platform handles, Purfect Labs is not a processor, subprocessor, service provider (CPRA), or business associate (HIPAA), and no DPA or BAA applies to Platform operation. You remain the controller and operator of all data the Platform touches. There are no international transfers by Purfect Labs, because there is no data to transfer.
Platform professional services and business records
The one exception: engagement access
During a paid Implementation Engagement, Purfect Labs personnel may, at your direction, access your systems or observe your data. That access is scoped by the engagement's statement of work, and the parties execute whatever access, confidentiality, or data-protection terms your program requires for that engagement. It is ordinary services access, distinct from product operation, and ends with the engagement.
What we hold about Platform customers
Ordinary business records only: contacts, contracts, order forms, invoices, support correspondence, and delivery and manifest records. These are unrelated to data the Platform handles.
Scope note
This statement says Purfect Labs receives nothing. It does not say your data never leaves your network: the Platform forwards sanitized requests to the third-party LLM providers you configure, and content the detection packs do not match is forwarded to those providers unchanged. Detection is pattern- and configuration-based; the Platform supports, but does not confer, regulatory compliance.
Transmute App (Core, Pro, Max)
The App runs on your machine. It does not send Purfect Labs your prompts, source code, files, credentials, model responses, redaction maps, audit logs, crash reports, or any content it processes. License validity is verified locally by cryptographic signature. The App sends only two things:
- →Trial usage counters (trial installs only). About once an hour, while running without a license key inside the free trial, the App sends a pseudonymous report: a non-reversible, salted hash of a hardware identifier, a report timestamp, the edition, the operating-system name, the App version, a monthly token-consumption counter, a random single-use challenge value, and the requested lease duration. It contains no name, no email, no content, and no account or license information. Each successful report returns a short-lived signed trial lease. Entering a license key ends this reporting permanently.
- →License renewal fetch (licensed installs). About once a day, a licensed App checks the unique per-license renewal address inside its license for the next-period license file. The host sees that URL and normal connection metadata, including your IP address. There is no license-validation server call.
Records Purfect Labs holds for the App
- →License records: your name and email (read from Stripe to issue your license and embedded in the signed license file), license identifier, edition, seat count, license serial number, expiry date, renewal address, and renewal history, with subscription and payment status held in Stripe. Kept while your subscription is active and afterward as long as needed for license support, fraud prevention, accounting, tax, and legal compliance.
- →Trial usage record: pseudonymous machine marker, edition, OS name, App version, usage counters, first and last report timestamps, and report count. Kept until you erase it.
- →Trial eligibility record: pseudonymous machine marker, trial start and end dates, and whether the trial has ended. Kept without a fixed end date, including after erasure, so the trial cannot be restarted on the same machine.
- →Transient connection data: the licensing service uses your IP address only for abuse rate-limiting, in a counter that expires within one hour, and does not store it in trial or license records.
Trial records are stored separately from purchase and license records and are not linked to them. Through Stripe, Purfect Labs can see your name, email, billing address, and subscription and payment status, never your full payment card number.
Service providers
These providers operate parts of the App's point of sale and licensing service and of this website, each under its own terms. None of them receives traffic you send through Transmute.
Service providers
Your requests
You can erase your trial record at any time from the App's License panel ("delete my trial data from the server") or by emailing us the marker shown in that panel. Erasure deletes the usage record, stops future reports, and ends the trial; the minimal eligibility record remains. For access, correction, deletion, or other requests about license, order, or website records, email shawn@purfectlabs.com. We respond within the time your law requires.
Security and international transfers
License records are minimal by design. Signed license files are held in access-restricted Cloudflare storage so renewals can be delivered; each renewal address is an unguessable, single-purpose URL that can be retrieved only a limited number of times. The license-signing key is held as a Cloudflare Worker secret, never in source code. Transport is TLS.
Our providers, including Stripe and Cloudflare, operate primarily in the United States and may process license, billing, and website records there and in other countries where they operate. Where required, transfers rely on appropriate safeguards, such as Standard Contractual Clauses in the providers' data processing terms.
Vendor-risk questionnaire or other question?
shawn@purfectlabs.comMail: Purfect Labs Inc., c/o Harvard Business Services, Inc. (registered agent), 16192 Coastal Highway, Lewes, DE 19958
All legal documents