Privacy policy
Last updated: 21 August 2026
Imladris Labs is a trading name of Rivendell Technologies Inc. (“Imladris Labs”, “we”, “us” or “our”). We operate imladrislabs.dev and the intake form on it (together, the “Site”). We help software companies license anonymised operational data to AI research labs and their data partners.
This policy explains what personal information we collect through the Site and through the emails we exchange with you afterwards, why we collect it, who else sees it, and what you can ask us to do about it.
If you are in the United Kingdom or the European Economic Area, the Notice to European and UK users at the end adds to everything above it. If you are a resident of a US state with a privacy law, see the State privacy rights notice.
Contents
- Who we are
- Personal information we collect
- Cookies and similar technologies
- How we use your personal information
- Retention
- How we share your personal information
- Security
- International data transfers
- Your choices
- Other sites and services
- Children
- Changes to this policy
- How to contact us
- State privacy rights notice
- Notice to European and UK users
Who we are
Imladris Labs is a trading name of Rivendell Technologies Inc. Rivendell Technologies Inc. is the controller of the personal information described here.
Rivendell Technologies Inc.
522 Congress Avenue, Suite 400
c/o Antler Innovation US LLC
Austin, TX 78701
United States
Email: privacy@imladrislabs.dev
Website: https://imladrislabs.dev
Personal information we collect
Information you give us
The intake form asks for:
- Company details. Company name, website address, company status (operating, winding down, or closed) and, if the company is not operating, when it stopped and who controls its records now; HQ country; year founded; current and peak employee counts; annual revenue range; industry; the company’s LinkedIn page; and a short description of what it does.
- People and languages. The countries where the company’s employees are based, with an optional headcount for each; the share of the company’s data that is in English; and any other languages in the data.
- Tooling details. Which software tools the company uses and, optionally, a rough data volume for each; other tools not on our list; the company’s total data volume; the earliest year the data covers; and whether the data includes regulated or sensitive categories.
- Contact details. Your name, your role, your work email address, and, if you choose to give them, your phone number and LinkedIn profile; whether you can approve a data-licensing agreement for your company; and how you heard about us.
- Free-text notes. Anything else you write in the form’s open fields.
We also keep the emails and messages you send us about an application, and our replies.
Please do not send us special category data (information about health, racial or ethnic origin, religious or political beliefs, trade union membership, biometrics or genetics, or sex life) or government identification numbers. We do not need any of it to evaluate an application.
Information collected or stored automatically
When you use the Site, the following is collected or stored without you typing it in:
- Country. Cloudflare, which serves the Site, derives a country from the IP address your request comes from. We store that country with your submission. We do not put the IP address itself into our own records, though Cloudflare holds it briefly in its request logs, as our provider.
- Bot-check signals. The Site uses Cloudflare Turnstile to tell people apart from automated scripts. Turnstile examines the request and your browser environment and returns a pass or a fail to us. We receive the result, not the underlying signals.
- Aggregate analytics. We use Cloudflare Web Analytics, which counts page views and referrers without cookies and without any identifier that follows you between sites.
- A draft of your answers, held on your own device, which we do not receive. While you fill in the form, your browser saves a draft of your answers in its local storage, so a refresh or a closed tab does not cost you your work. The draft leaves out your contact details, expires after 7 days, stays on your device, and reaches us only if you submit the form.
- Server logs. Our server records the identifier of a submission and the reason a request failed. These logs do not contain the contents of your submission.
Cookies and similar technologies
We set no cookies to analyse how the Site is used, to advertise, or to recognise you on other websites. Our analytics are cookieless, which is why the Site shows no cookie banner (strictly necessary cookies set by Cloudflare to protect the Site do not need one).
Two things do store data:
- Cloudflare, our hosting and security provider, may set strictly necessary cookies to protect the Site against automated abuse and to route requests. Those are needed to deliver the Site you asked for.
- The form draft described above uses your browser’s local storage rather than a cookie, and does not leave your device on its own.
The Site does not respond to “Do Not Track” browser signals, because there is no tracking for them to switch off.
How we use your personal information
- Evaluating and responding to your application. Reading what you sent, checking that it comes from a real company and a real contact, and getting back to you.
- Contacting you about a data partnership. Following up by email, arranging calls, and negotiating an NDA and any licence that follows.
- Security and abuse prevention. Keeping automated submissions, spam and attacks off the Site, investigating incidents, and keeping our systems running.
- Legal compliance. Meeting our obligations under applicable law, responding to lawful requests from authorities, and establishing, exercising or defending legal claims.
We do not use your information for advertising. We do not build profiles of you, and we do not make decisions about you by automated means. We do not use what you send through this form as training data for AI models, ours or anyone else’s. Data that reaches a research lab under a licence is anonymised operational data from your company’s systems, agreed with you in writing beforehand. It is not this form.
The checkbox on the intake form records that you have read this policy. It is an acknowledgement, not consent, and ticking it does not give us a legal basis we would otherwise lack. See Our legal bases for processing.
Retention
We keep a submission, and the correspondence attached to it, for 24 months from the day you send it. If a partnership agreement follows, the submission becomes part of that contract record: we keep it for as long as the agreement is in force, and afterwards for as long as the contract, tax and audit record-keeping rules that apply to us require.
After 24 months we delete the submission from our database automatically. The notification copies in our mailbox and our internal chat tool are deleted when you ask us to, and in our annual clean-up. Copies can survive in encrypted backups for up to 30 days longer, until those backups are overwritten in the ordinary course.
You can ask us to delete your submission at any time, sooner than either of those. See Your choices.
How we share your personal information
We are a small company and we share as little as we can. These providers process personal information on our instructions, under a contract:
| Provider | What they do for us | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the Site, stores submissions in a database located in Western Europe, runs the Turnstile bot check, and provides cookieless analytics | Global network; database in Western Europe |
| Resend | Sends the notification email that carries your submission to us | EU region |
| Google LLC (Google Workspace) | Runs our email, where the notification and any reply we send you sit | United States |
| Slack Technologies, LLC | Posts a short notification to a channel in our internal Slack workspace that our team watches, so an application is not missed. It carries your company’s details, your first name and your role. It does not carry your email address, your phone number or anything you wrote in a free-text field | United States |
We also share personal information with:
- Professional advisers. Lawyers, accountants, auditors and insurers, where they need it to advise us.
- Authorities and others. Law enforcement, regulators, courts and other parties, where we believe in good faith that disclosure is required by law or is necessary to protect our rights, your rights, or someone’s safety.
- A buyer or successor. If we raise investment, sell the business, merge, or go through an insolvency, personal information may pass to the counterparty and its advisers as part of that transaction.
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not hand it to advertising networks.
Security
We use technical and organisational safeguards designed to protect the personal information we hold: encryption in transit and at rest, access limited to the people who need it, and a short list of vetted providers. Security risk is inherent in all internet technologies, and we cannot guarantee the security of your personal information.
International data transfers
We are a United States company, and personal information you send us is accessed and processed in the United States as well as in the countries where the providers listed above operate.
For transfers out of Europe:
- Google and Slack are covered by certifications under the EU–US Data Privacy Framework and its UK Extension (Slack through its parent company, Salesforce, Inc.).
- Every other transfer, including to Cloudflare and Resend, relies on the European Commission’s standard contractual clauses, together with the UK International Data Transfer Addendum for transfers from the United Kingdom.
Email privacy@imladrislabs.dev if you want to know which mechanism covers a particular transfer, or to ask for a copy of the safeguards.
Your choices
Whoever and wherever you are, you can ask us to:
- Tell you what we hold and send you a copy. Email privacy@imladrislabs.dev.
- Correct it. Tell us what is wrong and we will put it right.
- Delete it. We will delete your submission unless we need to keep something to meet a legal obligation or to defend a legal claim.
- Stop contacting you. Reply to any email from us and say so, or write to privacy@imladrislabs.dev, and we will close the file.
You can also leave out any field the form does not mark as required. If you leave out a required one, we cannot evaluate an application.
We do not run a marketing mailing list. The emails we send are about your application.
Rights that depend on where you live are set out in the State privacy rights notice and the Notice to European and UK users.
Other sites and services
The Site links to websites we do not control, such as the tools you tell us about and our providers’ own policies. Those links are not an endorsement, we are not responsible for what those sites do, and we encourage you to read their privacy policies.
Children
The Site is not directed at anyone under 18 years of age, and we do not knowingly collect personal information from children. If you believe a child has sent us personal information, write to privacy@imladrislabs.dev and we will delete it.
Changes to this policy
We may update this policy. If we make a material change we will change the “Last updated” date at the top and post the new version here. Using the Site after a change means the updated policy applies to your dealings with us.
How to contact us
Email: privacy@imladrislabs.dev
Post: Rivendell Technologies Inc., 522 Congress Avenue, Suite 400, c/o Antler Innovation US LLC, Austin, TX 78701, United States
We do not run a phone line for privacy requests. Email reaches us fastest.
State privacy rights notice
This section applies to residents of US states whose privacy laws apply to us (the “State Privacy Laws”). In it, “Personal Information” carries the meaning given to “personal data” or “personal information” in those laws, and “Sensitive Personal Information” the meaning given to “sensitive personal information” or “sensitive data”.
Depending on where you live, you may have the right to:
- Know and access. The categories and specific pieces of Personal Information we have collected, where we got them, why we collected them, and the categories of third parties we disclose them to.
- Correct. Inaccurate Personal Information we hold about you.
- Delete. The Personal Information we collected from you.
- Obtain a copy. In a portable, machine-readable form.
- Appeal. A decision where we decline a request.
These rights are not absolute, and we may decline a request where the law allows it.
Several of the activities these laws regulate are ones we do not carry out:
- Targeted advertising. We do not process Personal Information for targeted advertising.
- Profiling and automated decisions. We do not use Personal Information for profiling or automated decision-making that produces legal or similarly significant effects.
- Sale and sharing. We do not sell Personal Information, and we do not share it for cross-context behavioural advertising, within the meaning of the State Privacy Laws. There is therefore no sale or sharing for a Global Privacy Control signal to stop.
- Sensitive Personal Information. We do not ask for it and we do not process it to infer characteristics about you. Please do not send it.
- Consumers under 16. We have no actual knowledge that we collect, sell or share the Personal Information of consumers under 16 years of age.
You are entitled to exercise these rights free from discrimination.
Making a request. Email privacy@imladrislabs.dev, from the address you used on the form or with enough detail for us to find your submission. We may ask for information to confirm your identity and your state of residence before we act. An authorised agent may make a request for you, and we may ask for proof of their authority, such as a power of attorney or your signed permission.
What we collect, and why. The table below describes our practices as at the “Last updated” date, using the categories in the California Consumer Privacy Act (Cal. Civ. Code §1798.140). Anything you write into a free-text field may contain categories not listed here.
| Personal Information we collect | CCPA statutory category | Purposes | Disclosed for a business purpose to | Sold or shared |
|---|---|---|---|---|
| Name, role, work email, optional phone number and LinkedIn profile | Identifiers; professional or employment-related information | Evaluating and responding to your application; contacting you about a data partnership; legal compliance | Cloudflare, Resend, Google Workspace; Slack (first name and role only); professional advisers; authorities | None |
| Company name, website address, company status, HQ country, year founded, employee counts, revenue range, industry, LinkedIn page, description, employee countries, language details, tooling details, free-text notes | Commercial information; professional or employment-related information | Evaluating and responding to your application; contacting you about a data partnership; legal compliance | Cloudflare, Resend, Google Workspace; Slack (all but the free-text notes); professional advisers; authorities | None |
| Country derived from your IP address, bot-check result, server logs, aggregate page views | Internet or other network activity information; geolocation data, at country level only | Security and abuse prevention; understanding how the Site is used | Cloudflare | None |
We do not attempt to reidentify deidentified information, except to test that our deidentification works as the law requires.
Additional information for California residents
Under California’s Shine the Light law (Cal. Civ. Code §1798.83), California residents may ask a business for the names of third parties to which it disclosed personal information for those third parties’ own direct marketing purposes during the preceding calendar year. We make no such disclosures. If you would like that confirmed in writing, email privacy@imladrislabs.dev with the words “Shine the Light Request”, your first and last name, your mailing address, and a statement that you are a California resident.
Additional information for Nevada residents
Nevada residents have the right under Nevada Revised Statutes Chapter 603A to direct a business not to sell certain information it has collected about them. We do not engage in such sales. To register an objection against any future sale, email privacy@imladrislabs.dev.
Notice to European and UK users
This section applies to you if you are in the European Economic Area or the United Kingdom, which this policy calls “Europe”. It adds to the rest of the policy. “Personal information” here includes “personal data” as defined in the EU General Data Protection Regulation and the UK GDPR (together, the “GDPR”).
Controller
Rivendell Technologies Inc., trading as Imladris Labs, is the controller of the personal information covered by this policy. Our contact details are under How to contact us.
Our representatives in Europe and the UK
We have appointed representatives under Article 27 of the EU GDPR and the UK GDPR. You can contact them directly if you prefer.
EU representative
Instant EU GDPR Representative Ltd.
Contact: Adam Brogden
Tel: +353 1 554 9700
Office 2, 12A Lower Main Street,
Lucan, Co. Dublin, K78 X5P8, Ireland
Email: contact@gdprlocal.com
UK representative
GDPR Local Ltd.
Contact: Adam Brogden
Tel: +44 1772 217800
1st Floor Front Suite,
27-29 North Street, Brighton, England
Email: contact@gdprlocal.com
Our legal bases for processing
The GDPR requires a legal basis for each purpose we use personal information for. Ours are set out below.
| Purpose | Personal information involved | Legal basis |
|---|---|---|
| Evaluating and responding to your application | Company details, contact details, tooling details, free-text notes, correspondence | Steps taken at your request before entering into a contract (Article 6(1)(b)). You send the form because you want to explore a licence with us. |
| Contacting you about a data partnership | Contact details, correspondence | Steps taken at your request before entering into a contract (Article 6(1)(b)), and, once an agreement is in place, performance of that contract (Article 6(1)(b)). |
| Security and abuse prevention | Country derived from your IP address, bot-check result, server logs | Legitimate interests (Article 6(1)(f)). We have a legitimate interest in keeping the Site and our systems free of automated abuse and attack. |
| Understanding how the Site is used | Aggregate, cookieless page view and referrer counts | Legitimate interests (Article 6(1)(f)). We have a legitimate interest in knowing whether the Site works, measured without cookies or cross-site identifiers. |
| Running the business | Any of the above, as relevant | Legitimate interests (Article 6(1)(f)). We have a legitimate interest in keeping records, taking professional advice, and managing corporate transactions. |
| Legal compliance and legal claims | Any of the above, as relevant | Compliance with a legal obligation (Article 6(1)(c)). Where no obligation applies, legitimate interests (Article 6(1)(f)) in establishing, exercising or defending legal claims. |
We do not rely on consent as the legal basis for any of this processing, and we do not process personal information for direct marketing. The checkbox on the intake form is an acknowledgement that you have read this policy, not consent. Where we rely on legitimate interests you can object, as described under Your rights.
Information we do not process
We do not carry out automated decision-making or profiling that produces legal effects for you or similarly significantly affects you. We do not process special category data, and we ask you not to send it. Our retention periods are set out under Retention; when a period ends we delete the personal information, or isolate it from further processing until deletion is possible.
Your rights
If you are in Europe you may ask us to do the following in relation to the personal information we hold about you.
- Access. Tell you how we process it and give you a copy.
- Correct. Update or correct anything inaccurate or incomplete.
- Delete. Erase it where there is no good reason for us to keep processing it, including where you have successfully objected.
- Transfer. Send a machine-readable copy to you or to an organisation of your choice.
- Restrict. Pause processing, for example while we check accuracy or consider an objection.
- Object. Object to processing we base on legitimate interests, on grounds relating to your particular situation.
Email privacy@imladrislabs.dev, write to our postal address, or contact the representative for your region. We may ask for information to confirm your identity. We reply within one month, and we will tell you if we need longer or if we are declining part of a request, and why.
Complaints. If our answer does not satisfy you, you can complain to the data protection authority where you live or work, or where you think something went wrong.
In the EEA, the European Data Protection Board publishes the list of national authorities at edpb.europa.eu.
In the UK:
The Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Tel: +44 303 123 1113
ico.org.uk
Data processing outside Europe
We are a United States company, and so are most of our providers. The United States as a whole is not covered by an adequacy decision under the GDPR: the EU–US Data Privacy Framework decision reaches only those US organisations certified under it, so European bodies do not treat US law on its own as giving personal information protection equivalent to European law. Where personal information leaves Europe:
- Google and Slack are covered by certifications under the EU–US Data Privacy Framework and its UK Extension — Slack through its parent company, Salesforce, Inc. — which the European Commission and the UK government have recognised as adequate for transfers to certified US organisations.
- Every other transfer, including to Cloudflare and Resend, relies on the European Commission’s standard contractual clauses, together with the UK International Data Transfer Addendum for transfers from the United Kingdom.
Email privacy@imladrislabs.dev for a copy of the safeguards that apply to a particular transfer.