Privacy policy
Last updated:
Counterfact Labs, Inc. ("we") runs Counterfact. This policy covers the console at app.counterfactlabs.com, the command-line tool and plugin, and this website.
What we collect
- Account: your email address, your name if you give it, and when you sign in.
- Your agents: the files you send for an analysis, or that we read from a GitHub repository you connect, and the findings, questions, and tests produced from them.
- Billing: your balance and its history. Stripe handles card and bank details; we never see them.
- Technical: request logs with IP address and browser, kept to run and protect the service.
- Contact form: what you write to us, relayed by email and not stored on this site.
- Website visits: we record which pages of this site you open and where you came from, under a random visitor number kept in your browser, to see which steps of getting started people finish; this uses no cookies, and nothing is recorded if your browser asks not to be tracked.
How we use it.
To provide analyses and show you results, to sign you in, to bill you, to keep the service secure, and to answer you. We don't sell your data, and we don't use your agents to train AI models.
Who processes it for us
- Google Cloud: hosting, database, and email delivery (United States).
- Anthropic: the AI models that analyze your agents. Under its commercial terms it doesn't train on this data.
- OpenAI: AI models used when you run conversations with your agents. Under its API terms it doesn't train on this data.
- Stripe: payments, tax, and receipts.
- GitHub: only if you connect a repository.
Security
Counterfact is aligned with SOC 2 controls, and we are in the process of SOC 2 certification.
How long we keep it.
Your agents' files, findings, and history are kept while your workspace exists, and deleted when you delete the analysis or the workspace. To avoid paying twice for the same work, we also keep the AI models' answers about your agents for up to 90 days, and delete them sooner if you delete the workspace. Database backups expire after 7 days. Billing records are kept as long as tax law requires.
Cookies.
The console uses one sign-in cookie. This website sets no cookies.
Your choices.
You can ask us to show you, correct, export, or delete your data by writing to hello@counterfactlabs.com. We answer within 30 days.
Changes.
We'll post updates here with a new date.
Contact.
Counterfact Labs, Inc., hello@counterfactlabs.com