Privacy Policy

HardLabs Technologies, Inc. (“HardLabs,” “we,” “us,” or “our”) provides software and services for hardware and firmware development, simulation, testing, debugging, and related engineering workflows.

This Privacy Policy explains how we collect, use, disclose, and protect personal information when you visit hardlabs.io, communicate with us, create or use a HardLabs account, participate in a pilot, or use our products and services (collectively, the “Services”).

This Privacy Policy does not govern personal information that we process solely on behalf of a business customer as a processor or service provider. Such processing is governed by our Data Processing Addendum (“DPA”) and the applicable customer agreement.

1. Information We Collect

Information you provide

We may collect information such as:

• name;
• business email address;
• company name;
• job title and team;
• account and authentication information;
• communications with HardLabs;
• support requests;
• sales and pilot correspondence;
• feedback;
• information submitted through forms, demos, onboarding, or waitlists.

Customer Content

Customers may submit technical materials to the Services, including:

• PCB designs;
• schematics;
• bills of materials;
• netlists;
• firmware;
• source code;
• firmware binaries;
• datasheets;
• configuration files;
• logs;
• test files;
• simulation artifacts;
• documentation;
• other engineering materials.

We refer to this information collectively as “Customer Content.”

Customer Content typically relates to engineering projects rather than individuals. However, it may occasionally contain personal information.

Where HardLabs processes personal information contained in Customer Content on behalf of a customer, HardLabs acts as a processor or service provider and our DPA applies.

2. Information Collected Automatically

When you visit our website or use the Services, we may collect:

• IP address;
• browser and device information;
• operating system;
• referring URL;
• pages viewed;
• timestamps;
• session information;
• a pseudonymous visitor identifier stored in your browser;
• approximate geographic location derived from your IP address (country, and city where available) and time zone;
• application and server logs;
• authentication events;
• performance and security information;
• website interaction information.

We use cookies and similar technologies as described in our Cookie Policy.

3. Analytics

We currently use:

Google Analytics

We use Google Analytics to understand aggregated website traffic and how visitors interact with hardlabs.io.

Depending on your consent choices and our configuration, Google Analytics may process information such as browser and device characteristics, page interactions, pseudonymous identifiers, and related usage information.

Microsoft Clarity

We use Microsoft Clarity to understand how visitors interact with our website and the HardLabs application, including through aggregated behavior analytics, heatmaps, and session-replay functionality.

Clarity may collect information concerning website interactions such as clicks, scrolling, mouse movement, page rendering, and browser or device information.

Inside the HardLabs application (hardlabs.io/app), Microsoft Clarity also records how signed-in users use the Services, such as pages visited, clicks, scrolling, and where on a page people get stuck, so we can improve the product. In the application, Clarity is configured to mask all text on the page, including board, project, part, and file names, simulation console output, and anything typed, so that confidential Customer Content is not sent to Microsoft; only labels of fixed menu items and controls are shown. Links that carry a board access token are not recorded until the token has been removed from the page address. To let us find a user's sessions, we pass Clarity the account's pseudonymous user identifier, never its name or email address. Google Analytics is not used inside the application.

Where required by applicable law, non-essential analytics technologies are activated only after consent.

Product usage records

Inside the HardLabs application, including the hardlabs command-line tool and its MCP server, we keep our own records of how the Services are used, so we can see which features help engineers and fix what does not. These records are stored in the HardLabs database described below and are not sent to Google, Microsoft, or any other analytics provider. As records are made, a summary is also posted to HardLabs's internal Slack workspace so our team can see how the Services are used as it happens (see Internal Notifications below). They include:

• when a simulation session starts and ends, how long it stays open, how it ended, and whether it was started from the browser, the command-line tool, or the MCP server;
• which files were used, recorded as file name, size, and a cryptographic fingerprint (hash);
• actions in the application, such as pages viewed and for how long, buttons and links clicked, controls used on a simulated board, and the number, types, and sizes of files selected;
• each request made to a simulation, such as controls used, values set, times waited for and their outcome, and how many times its state was read;
• what is typed into a simulation, in full: commands sent to a simulation console, text waited for in its output, and data written over its simulated Bluetooth connection. After 90 days only the first word and the length of each are kept;
• which function of the HardLabs SDK, command of the command-line tool, or MCP tool made each request to our servers, and a random identifier for the run (one script, command, or MCP session) it belongs to;
• in the command-line tool: which commands you run with their options and values, the lines typed into its shell, and the arguments given to its MCP tools, except that values of options and fields named like a token, password, secret, or key are left out and file paths are reduced to the file name; how each ended; the name and version of the coding agent connecting over MCP; the tool's version, your operating system, processor type and Node.js version; and a random identifier for the computer stored in the tool's settings file; and
• errors, and how long requests took.

These records never include the contents of uploaded files. If you decline analytics cookies on our website, we also stop recording page views and clicks in the application. You can stop the command-line tool sending usage records with `hardlabs telemetry off`, or by setting the environment variable HARDLABS_TELEMETRY=0 or DO_NOT_TRACK=1; those environment variables also stop the SDK and the command-line tool saying which function, command, or run made each request. Records of simulation sessions, uploads, and other requests to our servers are kept regardless, because they are part of operating and securing the Services.

4. Authentication

We use Clerk to provide user authentication and account-management functionality.

Clerk may process information such as:

• name;
• email address;
• authentication credentials or tokens;
• IP address;
• device information;
• login events;
• security and account metadata.

HardLabs also keeps its own record of each account, including name, email address, sign-up time, and last sign-in time, in the HardLabs database described below.

5. Customer Content Storage and Infrastructure

HardLabs currently uses:

• Vercel for application hosting and delivery;
• Fly.io for hosting the HardLabs job-processing API, which receives uploaded Customer Content to run requested analyses and simulations;
• Supabase for our managed Postgres database, which stores account records, the index of jobs and organizations, waitlist and pilot sign-up records, and product usage records; and
• Cloudflare R2 for object storage, including storage of certain Customer Content and uploaded technical files.

Our infrastructure providers may process technical information necessary to operate, secure, store, and deliver the Services.

6. Artificial Intelligence Providers

Some HardLabs features use third-party artificial-intelligence models.

HardLabs currently uses commercial/API services provided by:

• OpenAI; and
• Anthropic.

Where required to perform an AI-assisted operation, relevant portions of Customer Content may be transmitted to these providers.

HardLabs uses commercial/API offerings and intends to configure such services so that Customer Content is not used for generalized model training unless the customer expressly opts in to such use.

See our AI & Customer Data Policy for more information.

7. Communications

Email

We use Google Workspace for business email.

If you communicate with HardLabs by email, Google may process information including:

• your name;
• email address;
• message contents;
• attachments;
• message metadata.

Waitlist and Pilot Sign-ups

Waitlist and pilot sign-up forms are received by HardLabs directly.

When you sign up, we keep a record in the HardLabs database of your email address, the form you submitted, the page you submitted it from, your country, and your pseudonymous visitor identifier.

Internal Notifications

We use Slack for internal team notifications.

When a new visitor arrives, someone signs up, an account is created, a project is uploaded, or the Services are used (the product usage records described in Section 3), HardLabs may post a notification to its Slack workspace containing information such as:

• email address and name;
• approximate (city-level) location and time zone;
• device and browser type;
• pseudonymous visitor identifier;
• account and organization identifiers;
• project names and a summary of uploaded file types; and
• product usage records, including the names and sizes of files used and a count of the requests made in each simulation session, but never the files' contents or the full text of what is typed into a simulation.

8. How We Use Information

We may use personal information to:

• provide and operate the Services;
• create and administer accounts;
• authenticate users;
• run requested hardware and firmware simulations;
• analyze Customer Content at a customer's request;
• generate models, code, tests, reports, and technical outputs;
• store Customer Content;
• provide support;
• communicate about pilots, subscriptions, updates, and security matters;
• understand and improve Service performance;
• improve website usability;
• secure the Services;
• prevent fraud, misuse, and unauthorized access;
• comply with legal obligations;
• establish, exercise, or defend legal claims;
• send business or marketing communications where permitted by law.

9. Customer Content and AI Training

HardLabs does not use Customer Content to train generalized or shared AI models unless the applicable customer expressly opts in.

HardLabs does not authorize its third-party AI providers to use Customer Content for generalized model training where commercial/API settings or contractual terms allow HardLabs to prevent such use.

One customer's proprietary PCB designs, firmware, source code, schematics, BOMs, or other confidential Customer Content are not made available to other HardLabs customers.

HardLabs may use aggregated, de-identified, or Service-generated operational information to improve the reliability, security, and performance of the Services where that information does not identify a customer or disclose Customer Confidential Information.

10. Legal Bases in the EEA, UK, and Switzerland

Where applicable, we rely on one or more of the following legal bases:

Contract

Processing necessary to provide the Services or take steps requested before entering into a contract.

Legitimate Interests

Operating, securing, supporting, and improving HardLabs; communicating with business users; preventing misuse; and protecting our legal rights.

Consent

Where required, including for non-essential analytics cookies and certain marketing activities.

Legal Obligation

Processing required to comply with applicable law or lawful legal process.

11. How We Disclose Information

We may disclose information to service providers that help us operate our business and Services.

These currently include:

• Clerk — authentication and user management;
• Vercel — hosting and application infrastructure;
• Fly.io — hosting of the job-processing API;
• Supabase — database hosting;
• Cloudflare — object storage and infrastructure;
• Slack — internal team notifications;
• OpenAI — AI model processing;
• Anthropic — AI model processing;
• Google — email and website analytics;
• Microsoft — website behavior analytics through Microsoft Clarity.

Our current list of providers that may process customer personal data is available on our Subprocessors page.

We may also disclose information to:

• professional advisers;
• auditors;
• insurers;
• financing sources;
• potential investors or acquirers;
• government authorities where legally required.

12. Sale and Sharing of Personal Information

HardLabs does not sell Customer Content or personal information for money.

HardLabs does not intend to share personal information for cross-context behavioral advertising.

If our practices change in a manner that creates a legal right to opt out of a sale, sharing, targeted advertising, or similar activity, we will provide the required mechanism before engaging in that processing.

13. Cookies

We use essential technologies needed to operate and secure the Services.

We also use Google Analytics on our public website, and Microsoft Clarity on our public website and, with page text masked, in the HardLabs application.

Where legally required, these analytics technologies are activated only after the visitor provides consent.

See our Cookie Policy.

14. Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including:

• providing the Services;
• maintaining customer accounts;
• security;
• legal compliance;
• resolving disputes;
• enforcing agreements.

Customer Content is retained according to the applicable customer agreement and customer instructions.

Following termination or a valid deletion request, Customer Content will be deleted from active systems without undue delay, subject to reasonable technical backup and legal-retention requirements.

15. Security

We maintain administrative, technical, and organizational measures designed to protect information against unauthorized access, disclosure, alteration, destruction, or loss.

Because no electronic system is completely secure, we cannot guarantee absolute security.

Additional information is available in our Security Overview.

16. International Transfers

HardLabs is based in the United States.

Personal information may therefore be processed in the United States and other countries in which our service providers operate.

Where applicable law requires additional safeguards for international transfers, HardLabs uses appropriate legal mechanisms, which may include:

• adequacy decisions;
• the EU-U.S. Data Privacy Framework where applicable;
• Standard Contractual Clauses;
• the UK International Data Transfer Addendum or other applicable UK transfer mechanism.

17. Your Privacy Rights

Depending on your jurisdiction, you may have rights to:

• access personal information;
• obtain a copy of it;
• correct inaccurate information;
• request deletion;
• restrict processing;
• object to processing;
• withdraw consent;
• request portability;
• opt out of certain targeted advertising, sales, or sharing;
• appeal certain privacy decisions;
• lodge a complaint with a data-protection authority.

To make a privacy request, contact:

aga@hardlabs.io

We may need to verify your identity before completing a request.

If HardLabs processes information solely on behalf of one of our customers, you should normally direct your request to that customer. We will assist the customer where required by law and our DPA.

18. California and Other U.S. State Rights

Where applicable, HardLabs will provide the privacy rights required by applicable U.S. state law.

Categories of personal information HardLabs may collect include:

• identifiers;
• business and professional information;
• internet or electronic activity information;
• commercial information;
• communications;
• account information.

The sources, purposes, and recipients of this information are described in this Privacy Policy.

HardLabs does not knowingly use sensitive personal information for purposes requiring a right to limit under California law.

19. Children

HardLabs is designed for businesses and professional engineering users.

The Services are not directed to children under 16.

We do not knowingly collect personal information from children through the Services.

20. Marketing Communications

You may unsubscribe from promotional emails using the unsubscribe mechanism included in those emails or by contacting us.

We may continue sending operational messages relating to:

• your account;
• security;
• transactions;
• pilots;
• active customer relationships.

21. Changes

We may update this Privacy Policy from time to time.

We will update the “Last updated” date and provide additional notice where required by law.

22. Contact

Privacy inquiries: aga@hardlabs.io

General or legal inquiries: adam@hardlabs.io