Privacy Policy.
Effective date: 2026-09-23
This Privacy Policy describes how Tensorlake, Inc. ("Tensorlake", "we", "us") collects, uses and discloses personal data when you visit tensorlake.ai or docs.tensorlake.ai, subscribe to our newsletter, contact us, apply for a job, or create and use an account on the Tensorlake platform (together, the "Services"). It also explains the rights you have over that data and how to exercise them.
Scope
What this policy covers
Personal data for which Tensorlake decides the purposes and means of processing, acting as a "controller" under European law and a "business" under California law. That is information about visitors to our websites, people who contact us, job applicants, and the people who hold and use Tensorlake accounts, including account, billing, support and usage data.
What this policy does not cover
Content that customers submit to the Tensorlake platform, including files, sandbox state, workflow inputs and outputs, and any personal data they contain, is processed on the customer's behalf and on the customer's instructions. For that data Tensorlake is a "processor" or "service provider", and our Data Processing Addendum governs how it is handled. If you are an end user of a Tensorlake customer's product, please contact that customer with questions about your data.
Websites we link to, such as GitHub, Calendly, LinkedIn, X and Bluesky, have their own privacy policies.
Personal Data We Collect
| Category | What it includes | Where it comes from |
| Account and contact data | Name, email address, company or organization, role, the credentials or identity-provider identifiers you use to sign in, and your account preferences. | You, when you create an account, contact us, or book a meeting with us. |
| Billing data | Billing name and address, payment card details (collected and held by Stripe; we see only the card brand, last four digits and expiry), invoices, payment history and usage-based charges. | You and our payment processor, Stripe. |
| Usage and log data | IP address, browser and device type, operating system, the pages and API endpoints you request, timestamps, request identifiers, error logs, and an approximate location derived from your IP address. | Collected automatically when you use the Services. |
| Website analytics | Pages visited, referring page, time on page, approximate location (country or region), device and browser category, and a first-party analytics identifier. | Collected automatically on tensorlake.ai and docs.tensorlake.ai. |
| Communications | The contents of emails and support requests you send us, and the email address you give us for our newsletter together with delivery and open data from our newsletter provider. | You. |
| Job applicant data | Your resume or CV, work history, contact details and anything else you send us when you apply for a role. | You, by email to hello@tensorlake.ai. |
We do not collect sensitive personal data such as health, biometric or genetic data, precise geolocation, racial or ethnic origin, religious beliefs, or government identification numbers. Account login credentials are treated as sensitive personal information under California law; we use them only to authenticate you and to secure your account.
How We Use Personal Data
| Purpose | Data used | Legal basis under GDPR and UK GDPR |
| Providing and operating the Services, including creating accounts, authenticating users and delivering what you ask for. | Account, billing, usage and log data | Performance of a contract with you |
| Billing, invoicing and collecting payment. | Account, billing, usage data | Performance of a contract; legal obligation (tax and accounting law) |
| Securing the Services, preventing fraud and abuse, and debugging. | Usage and log data, account data | Legitimate interests in keeping the Services and their users secure |
| Responding to your questions and providing support. | Communications, account data | Performance of a contract; legitimate interests in responding to you |
| Understanding how our websites and documentation are used, and improving them. | Website analytics, usage data | Legitimate interests in improving the Services; consent where local law requires it |
| Sending the newsletter and product updates you signed up for. | Newsletter email address | Consent, which you can withdraw at any time by unsubscribing |
| Recruiting and evaluating job applicants. | Job applicant data | Steps taken at your request prior to entering a contract; legitimate interests in hiring |
| Complying with law, enforcing our agreements and protecting rights, safety and property. | Any of the above, as necessary | Legal obligation; legitimate interests |
What we do not do
- We do not sell personal data.
- We do not share personal data for cross-context behavioral advertising, and we do not use advertising or retargeting cookies, pixels or tags.
- We do not use personal data or customer content to train machine learning models, and we do not send customer content to third-party model providers.
- We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
How We Disclose Personal Data
Service providers
We disclose personal data to companies that process it on our behalf and on our instructions, under contracts that restrict how they may use it.
| Provider | Purpose | Data |
| Stripe, Inc. | Payment processing and invoicing | Billing data |
| Cloud infrastructure providers listed on our Trust Center | Hosting and operating the Tensorlake platform | Account, usage and log data; customer content under the Data Processing Addendum |
| Vercel, Inc. | Hosting tensorlake.ai | Usage and log data |
| Mintlify, Inc. and Cloudflare, Inc. | Hosting, delivering and monitoring docs.tensorlake.ai | Usage and log data |
| Google LLC (Google Analytics) | Website analytics on tensorlake.ai and docs.tensorlake.ai | Website analytics |
| Plausible Insights OÜ | Cookieless, aggregated analytics on docs.tensorlake.ai | Website analytics |
| Datadog, Inc. | Monitoring and error tracking for the platform | Usage and log data |
| beehiiv, Inc. | Newsletter delivery | Newsletter email address |
| Calendly LLC | Scheduling, if you book a meeting with us | The contact details you enter |
The current list of subprocessors that handle customer content on the platform is published on our Trust Center at trust.tensorlake.ai.
Legal requirements and protection of rights
We may disclose personal data to courts, regulators, law enforcement or other parties where the law requires it, to enforce our agreements, or to protect the rights, safety or property of Tensorlake, our customers or others.
Business transfers
If Tensorlake is involved in a merger, acquisition, financing, reorganization or sale of assets, personal data may be transferred as part of that transaction. We will notify you of any change in who controls your data or how it is used.
Aggregated and de-identified data
We may create and share aggregated or de-identified data that cannot reasonably be used to identify you. We will not attempt to re-identify it.
Cookies and similar technologies we use
| Technology | Set by | Purpose | Type |
| Session cookie on cloud.tensorlake.ai | Tensorlake | Keeps you signed in to your account | Strictly necessary |
| Theme preference (browser local storage) | Tensorlake | Remembers your light or dark theme choice on the blog; never leaves your browser | Functional |
| Google Analytics cookies | Google, loaded through Google Tag Manager | Counts visits and page views and measures how the website and documentation are used | Analytics |
| Plausible | Plausible | Page-view counting on docs.tensorlake.ai without cookies or persistent identifiers | Analytics |
| Stripe cookies | Stripe | May be set on billing pages for fraud prevention | Strictly necessary |
We do not use advertising, retargeting or social-media tracking cookies. The Google Tag Manager container on tensorlake.ai loads Google Analytics and nothing else.
Your choices
You can block or delete cookies through your browser settings; the Services will still work, though you may need to sign in again. You can opt out of Google Analytics across all websites with Google's browser add-on at tools.google.com/dlpage/gaoptout. Every newsletter we send includes an unsubscribe link.
Do Not Track and Global Privacy Control
Because we do not sell or share personal data and do not track you across other websites, there is nothing for a Do Not Track or Global Privacy Control signal to opt you out of, and these signals do not change how we process your data. If we ever begin selling or sharing personal data, we will update this policy and honor the Global Privacy Control signal as an opt-out request.
Data Retention
| Data | How long we keep it |
| Account and contact data | While your account is active, and afterwards only as required for our legal, accounting and security obligations. |
| Customer content | While your account is active and until you delete it. Deletion through our APIs is immediate from active systems and is not recoverable. When an agreement ends, content is returned or deleted, including copies held in backups, within 90 days, as set out in the Data Processing Addendum. |
| Billing records | For the period required by tax and accounting law after the transaction. |
| Usage and log data | For a limited period for security monitoring and troubleshooting, then deleted or aggregated. Application logs on the platform are kept for seven days by default, or for the longer period configured for your account at your request. |
| Website analytics | Held by our analytics providers under our account settings and used in aggregate. We do not keep individual analytics identifiers beyond what is needed to produce aggregate usage statistics. |
| Communications and support requests | For as long as needed to resolve your request and to keep a record of our dealings with you. |
| Newsletter subscription | Until you unsubscribe. Our provider then keeps a suppression record so that we do not email you again. |
| Job applicant data | For the duration of the recruitment process. If you are not hired, we keep it for future roles only if you agree; otherwise we delete it when the process ends. |
International Transfers
Tensorlake is based in the United States, and personal data covered by this policy is processed in the United States and in the other countries where our service providers operate. Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland, we rely on the European Commission's Standard Contractual Clauses, supplemented by the UK International Data Transfer Addendum where UK law applies, and on equivalent safeguards with our service providers. Where we process customer content as a processor, the Standard Contractual Clauses are incorporated into our Data Processing Addendum. Customers who need their platform data processed in Europe can use our EU region, described in our documentation.
Security
We protect personal data with technical and organizational measures appropriate to the risk, including encryption in transit using TLS and at rest using industry-standard algorithms, access controls that limit access to the people and systems that need it, logging of access, and vulnerability and incident management processes. Tensorlake maintains an annual SOC 2 Type 2 examination by an independent auditor; the report and our current security controls are available on our Trust Center at trust.tensorlake.ai. No system is perfectly secure. If you believe your data or account has been compromised, contact security@tensorlake.ai.
Your Rights
Everyone
Wherever you live, you can ask us to tell you what personal data we hold about you, correct it, or delete it, and you can unsubscribe from marketing at any time. Email legal@tensorlake.ai. We will verify your request by matching it to the account or email address the data relates to, and we will respond within 45 days or tell you if we need longer. You may authorize someone to make a request for you; we will ask for evidence of that authorization. We will not treat you differently for exercising your rights.
European Economic Area, United Kingdom and Switzerland
If European data protection law applies to you, you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing (including processing based on our legitimate interests), to receive it in a portable format, and to withdraw consent at any time where processing is based on consent. You also have the right to lodge a complaint with your local supervisory authority, for example the Information Commissioner's Office in the United Kingdom. The controller for the data described in this policy is Tensorlake, Inc., 450 Townsend St, San Francisco, CA 94107, United States.
California
If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you the following rights.
- To know and access the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties we disclose it to. The tables above describe each of these.
- To delete personal information we have collected from you, subject to legal exceptions.
- To correct inaccurate personal information.
- To opt out of sale or sharing. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the preceding twelve months, so no opt-out is needed.
- To limit the use of sensitive personal information. The only sensitive personal information we collect is your account login credentials, which we use solely to authenticate you and secure your account, purposes for which the right to limit does not apply.
- Not to be discriminated against for exercising any of these rights.
In the preceding twelve months we collected the categories of personal information listed under "Personal Data We Collect", from the sources listed there, for the purposes listed under "How We Use Personal Data", and disclosed them for business purposes to the service providers listed under "How We Disclose Personal Data". We retain each category for the period stated under "Data Retention".
To exercise these rights, email legal@tensorlake.ai or call 1-(628) 227-5255. Under California Civil Code Section 1798.83, you may also ask whether we have disclosed personal information to third parties for their direct marketing purposes; we have not.
Nevada
We do not sell personal information as defined in Nevada Revised Statutes Chapter 603A.
Other US states
Residents of other states with comprehensive privacy laws, including Colorado, Connecticut, Virginia, Utah, Texas and Oregon, have rights to access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, sale and profiling. We do not engage in targeted advertising, sale or profiling that produces legal or similarly significant effects. To exercise your rights, email legal@tensorlake.ai. If we decline your request, you may appeal by replying to our response, and we will answer your appeal within 45 days.
Children
The Services are not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact legal@tensorlake.ai and we will delete it.
Changes to This Policy
When we change this policy we will post the new version here with a new effective date, and prior versions remain available from this page. If a change materially affects how we use personal data we already hold, we will notify account holders by email or by a notice on the website before the change takes effect.
Contact Information
Tensorlake, Inc. 450 Townsend St, San Francisco, CA 94107, United States
Privacy requests: legal@tensorlake.ai Security: security@tensorlake.ai Support: support@tensorlake.ai Phone: 1-(628) 227-5255
Prior versions
Questions about this document?
Reach the Tensorlake legal team at legal@tensorlake.ai, or write to TensorLake, Inc., San Francisco, California.
For security or privacy incidents: security@tensorlake.ai.