01
Who we are
Ylem Labs, Inc. builds the agent stack: Harness, Gateway, Box, Guard, and the World research line. We work from San Francisco and Astana. For this site and the products named here, Ylem Labs, Inc. decides why personal data is processed and how.
Questions about this page go to privacy@ylemlabs.com.
02
The site
A request to these pages writes a server log: IP address, user agent, the URL, and the time. We use the log to keep the site up and to see which requests fail. The log lives for 30 days.
The site does not run advertising cookies, and we do not sell visitor data. If you email us or send a note through the contact path, we keep the message, your name, and the address you wrote from so we can answer.
03
Accounts
A workspace on Gateway, Box, Guard, or Harness stores:
- the name and email of the person who opened it, and the people they invite
- roles inside the team
- API key labels, a hash of the secret, and a short prefix. The full secret is shown once, at creation
- usage: model, token counts, latency, cost, and the budget that applied
- the configuration you save: routes, policies, tools, and knowledge-base names
04
Customer content
Prompts, completions, documents, tool arguments, and traces that pass through Gateway, Box, Harness, or Guard are customer content. We process them to run the call, apply the Guard policy on that key, serve a cache hit when caching is on, and show the trace back to the workspace.
We do not train World models on customer content. Using customer content for training or evaluation takes a separate written agreement.
When Gateway routes a call to a third-party model, that provider receives the payload the route sends. Their terms cover that hop. A Guard policy can strip a secret, a personal-data span, or a marked document passage before the payload leaves.
The semantic cache stores embeddings and responses for the workspace that turned it on. You can turn the cache off and delete what it holds.
05
Careers
An application includes the CV and the contact details you send. We use them to assess the role. An unsuccessful application is kept for 12 months and then deleted, sooner if you ask.
06
Why we process it
We process personal data to run and secure the products, to bill Gateway usage, to answer you, and to keep records the law requires.
Where the GDPR applies, the basis is the contract for the product, a legitimate interest in site logs and security, consent where we ask for it, or a legal obligation where a statute requires the record.
07
Who else receives it
- model providers on the routes you select
- infrastructure vendors that host compute, storage, and email for the control plane
- an adviser, when a dispute or an audit actually needs the record
- a public authority, when the law requires the disclosure
We do not sell personal information. We do not share it for cross-context behavioral advertising. A current list of infrastructure vendors is available from privacy@ylemlabs.com.
08
Where it sits
The control plane runs in the United States. Staff in Astana may access it to operate the service, under the same access rules as staff in San Francisco. A transfer out of the EEA or the UK that needs a mechanism uses the standard contractual clauses.
09
How long we keep it
SERVER LOGS30 days
ACCOUNT DATALife of the workspace, then 30 days
BILLING RECORDS7 years
TRACES30 days, or a shorter window the workspace sets
CACHEThe TTL set on that workspace
APPLICATIONS12 months
INCIDENT RECORDSThe investigation, plus 1 year
A legal hold or an unpaid invoice can keep a copy past these windows. The hold covers the record the dispute needs, and it ends when the dispute ends.
10
Your requests
You can ask for access, a correction, a deletion, a copy, or a limit on processing. We answer within 30 days. If a law gives you a complaint to a regulator, you can file it. California residents can send a request under the CCPA to the same address.
Write to privacy@ylemlabs.com from the address on the account, or from the address the request concerns. We may ask for enough detail to find the workspace.
11
Children
The products are for companies and for adults at work. We do not knowingly open an account for anyone under 16. If you believe we have, write to privacy@ylemlabs.com and we will delete it.
12
Changes
The next version is posted on this page with a new date. If a change covers how we use customer content, we email workspace owners before it takes effect. Security practices sit on the security page.
