This Privacy Notice for Durable Intelligence Labs Inc. ("Durable Intelligence," "we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
- Visit our website at https://durableintel.com or any website of ours that links to this Privacy Notice
- Use Nenya, our product that sits above the LLM and is designed to help keep a single agent coherent across long horizons, including through third-party platforms such as OpenRouter
- Engage with us in other related ways, including any marketing or events
The Services are offered solely for business and professional purposes and are not directed to consumers.
This Privacy Notice explains your privacy rights and choices. If you do not agree with our policies and practices, do not use our Services. Questions regarding this Privacy Notice may be directed to contact@qwntl.com.
OUR TWO ROLES: CONTROLLER AND PROCESSOR
We process personal information in two distinct capacities, and your rights and our obligations differ between them.
As a controller. Durable Intelligence is the controller (or "business" under US state privacy laws) of personal information it collects for its own purposes, including contact information you provide, account and integration information, and technical log data collected automatically. Durable Intelligence determines the purposes and means of that processing, and this Privacy Notice describes it.
As a processor. Customer Content, meaning prompts, agent inputs, tool outputs, files, and other content submitted through the Services, may incidentally contain personal information, including sensitive personal information, that the submitting customer controls. We do not request, require, or solicit such information. Where Customer Content contains personal information, we process it as a processor (or "service provider") solely on the customer's instructions to provide, maintain, secure, troubleshoot, evaluate, and support the Services, and for no other purpose. The customer is responsible for that information, including any required notices, consents, and lawful bases. Where required, a data processing addendum governs that processing. If you believe your personal information has been submitted to the Services by one of our customers, direct your inquiry to that customer; we will support the customer's response as required by law and our agreements.
We do not use Customer Content to train general-purpose machine-learning models unless you or your organization expressly agree otherwise in writing.
SUMMARY OF KEY POINTS
What personal information do we process? We process contact and account information you provide, and technical information collected automatically, to operate the Services. Customer Content passes through the Services under the processor terms described above.
Do we process any sensitive personal information? We do not request or collect sensitive personal information for our own purposes. Sensitive personal information may be incidentally present in Customer Content, which we process only as a processor on customer instructions.
Do we collect any information from third parties? We may receive information from third-party platforms through which you access the Services, such as account, request, and usage information provided by OpenRouter or similar platforms.
How do we process your information? To provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
In what situations and with which types of parties do we share personal information? With service providers under written contracts, and in specific situations described below.
How do we keep your information safe? We maintain organizational and technical safeguards, but no electronic transmission or storage technology can be guaranteed to be 100% secure.
What are your rights? Depending on where you are located, applicable privacy law may give you rights regarding your personal information, described below.
How do you exercise your rights? Email us at contact@qwntl.com. We will consider and act upon any request in accordance with applicable data protection laws.
TABLE OF CONTENTS
- WHAT INFORMATION DO WE COLLECT?
- HOW DO WE PROCESS YOUR INFORMATION?
- WHAT LEGAL BASES DO WE RELY ON (EEA/UK)?
- WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
- DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
- INTERNATIONAL DATA TRANSFERS
- HOW LONG DO WE KEEP YOUR INFORMATION?
- HOW DO WE KEEP YOUR INFORMATION SAFE?
- DO WE COLLECT INFORMATION FROM MINORS?
- WHAT ARE YOUR PRIVACY RIGHTS?
- CONTROLS FOR DO-NOT-TRACK FEATURES
- DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
- DO WE MAKE UPDATES TO THIS NOTICE?
- HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
- HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
1. WHAT INFORMATION DO WE COLLECT?
Personal information you disclose to us
In Short: We collect personal information that you provide to us.
We collect personal information that you voluntarily provide when you express interest in obtaining information about us or our products and Services, when you create an account or integration, or otherwise when you contact us. This may include:
- Name and business contact details (email address, organization)
- Account, credential, and integration information
- Communications you send us
We do not request or collect sensitive personal information (such as racial or ethnic origin, religious beliefs, health information, or precise geolocation) for our own purposes.
Customer Content. Content submitted through the Services may incidentally contain personal information of any kind, including sensitive personal information. That content is processed under the processor terms described in "Our Two Roles" above and is not collected by Durable Intelligence for its own purposes. Do not submit credentials, regulated data, or highly sensitive information unless your deployment and agreement with Durable Intelligence are designed for that information.
All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes.
Information automatically collected
In Short: Certain information, such as your Internet Protocol (IP) address and browser and device characteristics, is collected automatically when you visit our Services.
We automatically collect certain information when you visit, use, or navigate the Services. This information may include device and usage information, including your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country or region derived from IP address, information about how and when you use our Services, and other technical information. This information is needed to maintain the security and operation of our Services and for internal analytics and reporting.
We use product analytics, including cookies and recordings of how pages are used (with anything you type hidden), to understand how our websites and products are used and to improve them, and we may link it to your account or the contact details you give us. In our products this is limited to usage and technical events, such as which features are used, when, and how they perform, and never includes your prompts, code or project content.
We do not collect precise device geolocation.
The information we collect includes:
- Log and Usage Data. Service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services, recorded in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type and settings, information about your activity in the Services (such as date/time stamps, features used, and other actions), and device event information (such as system activity, error reports, and hardware settings).
2. HOW DO WE PROCESS YOUR INFORMATION?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.
We process personal information for the following purposes:
- To deliver and facilitate delivery of the Services.
- To respond to inquiries and offer support.
- To send administrative information, including details about our products and services and changes to our terms and policies.
- To administer direct subscriptions and billing. Where Durable Intelligence provides paid Services directly, we may process information to administer subscriptions, usage, billing, payments, and applicable taxes. Billing handled by third-party platforms is subject to those platforms' terms and privacy practices.
- To protect our Services, including security monitoring, abuse detection, and fraud prevention.
- To evaluate and improve our Services, including reliability, safety, performance, and user experience, and to identify usage trends.
- To comply with our legal obligations, respond to legal requests, and exercise, establish, or defend legal rights.
Customer Content is processed solely as described in "Our Two Roles" above.
3. WHAT LEGAL BASES DO WE RELY ON (EEA/UK)?
In Short: Where the EU or UK General Data Protection Regulation applies, we process personal information only with a valid legal basis.
Where we act as a controller and the GDPR or UK GDPR applies, we rely on the following legal bases:
- Performance of a contract (Article 6(1)(b)): to provide the Services you or your organization have requested.
- Legitimate interests (Article 6(1)(f)): to secure and improve the Services, prevent fraud and abuse, and communicate about the Services, where those interests are not overridden by your rights.
- Legal obligation (Article 6(1)(c)): to comply with applicable law.
- Consent (Article 6(1)(a)): where we ask for it expressly, which you may withdraw at any time.
Where we process Customer Content as a processor, the customer is responsible for establishing the legal basis for that processing.
4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
In Short: We may share information with service providers under written contracts and in the specific situations described below.
Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work. Our service providers may process personal information only for purposes permitted under their agreements with us and as necessary to provide their services, subject to applicable legal and contractual obligations, and are required to use appropriate safeguards.
The categories of third parties we may share personal information with are:
- AI Platforms
- Cloud Computing Services
- Data Storage Service Providers
- Performance Monitoring Tools
- User Account Registration & Authentication Services
- Website Hosting Service Providers
- Data Analytics Services
We may also need to share personal information in the following situations:
- Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
- Legal Requirements. We may disclose information where required to comply with law, legal process, or enforceable government requests, or to protect the rights, property, or safety of Durable Intelligence, our users, or others.
We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.
5. DO WE OFFER ARTIFICIAL INTELLIGENCE-BASED PRODUCTS?
In Short: We offer products powered by artificial intelligence, and third-party platforms and model providers may process data to enable them.
As part of our Services, we offer products, features, or tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). The terms in this Privacy Notice govern your use of the AI Products within our Services.
Use of AI Technologies. We may provide the AI Products through third-party platforms and model providers, including OpenRouter and the underlying providers selected or routed through the Services. Your input, output, and personal information may be shared with and processed by these providers as necessary to enable your use of our AI Products, for purposes outlined in "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?" You must not use the AI Products in any way that violates the terms or policies of any AI service provider.
Data path. When you access Nenya through OpenRouter, OpenRouter transmits your request to Durable Intelligence; Durable Intelligence processes it to provide continuity and coherence and may forward content to the underlying model provider handling the request; and the response returns through the same path. OpenRouter and each model provider collect, retain, and process data under their own terms and privacy policies, independently of Durable Intelligence. Durable Intelligence's own retention of content is described in "HOW LONG DO WE KEEP YOUR INFORMATION?"
Our AI Products are designed for the following functions:
- AI research
- AI deployment
How We Process Your Data Using AI. Personal information processed through our AI Products is handled in accordance with this Privacy Notice and our agreements with third parties, including the processor terms in "Our Two Roles" above.
6. INTERNATIONAL DATA TRANSFERS
In Short: We are based in the United States, and personal information may be transferred there and to other countries.
We are headquartered in the United States, and personal information may be processed in the United States and in other countries where we or our service providers operate. These countries may have data protection laws different from those of your country.
Where we transfer personal information from the European Economic Area, the United Kingdom, or Switzerland to countries that have not received an adequacy determination, we rely on appropriate safeguards, including the standard contractual clauses approved by the European Commission and, for UK transfers, the UK International Data Transfer Addendum. Copies of the relevant safeguards are available on request at contact@qwntl.com. Where we process Customer Content as a processor, transfer mechanisms are addressed in the applicable data processing addendum.
7. HOW LONG DO WE KEEP YOUR INFORMATION?
In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.
We retain personal information only for as long as necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law.
Prompt and Output Logging. Nenya is designed to maintain agent state and continuity across requests, which requires retaining certain content submitted through the Services for the duration of the applicable session or deployment. Where content logs (prompts, agent inputs, tool calls, tool outputs, and model outputs) are created to operate, secure, troubleshoot, evaluate the reliability, safety, and performance of, or support the Services, they are retained for no more than 180 days, unless a different period or configuration is specified in an applicable customer agreement, after which they are deleted or de-identified, except where retention is required by law. We do not use these logs or any other Customer Content to train general-purpose machine-learning models unless you or your organization expressly agree otherwise in writing.
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because it has been stored in backup archives), we will securely store it and isolate it from further processing until deletion is possible.
8. HOW DO WE KEEP YOUR INFORMATION SAFE?
In Short: We aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, and we cannot guarantee that unauthorized third parties will not defeat our security measures or improperly collect, access, alter, or disclose your information. Transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
9. DO WE COLLECT INFORMATION FROM MINORS?
In Short: We do not knowingly collect data from or market to children under 18 years of age.
The Services are offered for business use only and are not directed to children. We do not knowingly collect, solicit data from, or market to children under 18 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 18. If we learn that personal information from users under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under 18, contact us at contact@qwntl.com.
10. WHAT ARE YOUR PRIVACY RIGHTS?
In Short: Depending on your location, you may have rights to access, correct, delete, or restrict the processing of your personal information.
EEA, UK, and Switzerland. Where the GDPR, UK GDPR, or Swiss data protection law applies and we act as a controller, you have the right to request access to your personal information, rectification, erasure, restriction of processing, and portability, and to object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with your local supervisory authority. Where we process personal information as a processor within Customer Content, direct requests to the customer that submitted it; we will support the customer's response as required by law and our agreements.
Withdrawing your consent. If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time by contacting us using the details in "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?" below. Withdrawal will not affect the lawfulness of processing before withdrawal nor, where applicable law allows, processing conducted in reliance on lawful grounds other than consent.
If you have questions or comments about your privacy rights, email us at contact@qwntl.com.
11. CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.
California law requires us to let you know how we respond to web browser DNT signals. Because there currently is not an industry or legal standard for recognizing or honoring DNT signals, we do not respond to them at this time.
12. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
In Short: If you are a resident of a US state with a comprehensive privacy law, you may have rights to access, correct, delete, and obtain a copy of your personal information.
If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. These rights may be limited in some circumstances by applicable law.
Categories of Personal Information We Collect
The table below shows the categories of personal information we have collected as a business for our own purposes in the past twelve (12) months. Customer Content processed as a service provider is excluded from this table and governed by the processor terms in "Our Two Roles" above.
| Category | Examples | Collected |
|---|---|---|
| A. Identifiers | Contact details, such as real name, alias, telephone number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name | YES |
| B. Personal information as defined in the California Customer Records statute | Name, contact information, employment | YES |
| C. Protected classification characteristics under state or federal law | Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data | NO |
| D. Commercial information | Transaction information, purchase history, financial details, and payment information | NO |
| E. Biometric information | Fingerprints and voiceprints | NO |
| F. Internet or other similar network activity | Log and usage data reflecting interactions with our website and Services | YES |
| G. Geolocation data | Precise device location | NO |
| H. Audio, electronic, sensory, or similar information | Images and audio, video or call recordings | NO |
| I. Professional or employment-related information | Organization affiliation and business contact information | YES |
| J. Education information | Student records and directory information | NO |
| K. Inferences drawn from collected personal information | Profiles reflecting preferences and characteristics | NO |
| L. Sensitive personal information | Racial or ethnic origin, religious beliefs, health data, precise geolocation, contents of communications | NO |
We may also collect other personal information outside of these categories where you interact with us in person, online, or by phone or mail in the context of receiving help through our customer support channels, participation in customer surveys, and facilitation of the delivery of our Services.
We will retain the collected personal information for as long as necessary to provide the Services and fulfill the purposes described in this Privacy Notice. The criteria we use to determine retention periods include: whether we have an ongoing relationship with you or your organization; whether the information is needed to operate, secure, troubleshoot, or support the Services; whether retention is required by law, legal process, or an applicable customer agreement; and whether the information is needed to establish, exercise, or defend legal claims.
Sources of Personal Information
See "WHAT INFORMATION DO WE COLLECT?"
How We Use and Share Personal Information
See "HOW DO WE PROCESS YOUR INFORMATION?"
Will your information be shared with anyone else?
We may disclose your personal information to our service providers pursuant to a written contract between us and each service provider. See "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"
We may use your personal information for our own business purposes, such as undertaking internal research for technological development. This is not considered to be "selling" of your personal information.
We have not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We have disclosed the following categories of personal information to third parties for a business purpose in the preceding twelve (12) months:
- Category A. Identifiers
- Category B. Personal information as defined in the California Customer Records law
- Category F. Internet or other similar network activity
- Category I. Professional or employment-related information
The categories of third parties to whom we disclosed personal information for a business purpose can be found under "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?"
Your Rights
You have rights under certain US state data protection laws. These rights are not absolute, and in certain cases we may decline your request as permitted by law. These rights include:
- Right to know whether or not we are processing your personal data
- Right to access your personal data
- Right to correct inaccuracies in your personal data
- Right to request the deletion of your personal data
- Right to obtain a copy of the personal data you previously shared with us
- Right to non-discrimination for exercising your rights
- Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")
Depending on the state where you live, you may also have:
- Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
- Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
- Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
- Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
- Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)
How to Exercise Your Rights
To exercise these rights, email us at contact@qwntl.com or use the contact details in Section 14 below.
Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof of valid authorization.
Request Verification
Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. If we cannot verify your identity from information we already maintain, we may request additional information for verification, security, or fraud-prevention purposes. If you submit the request through an authorized agent, the agent will need to provide written and signed permission from you.
Appeals
Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at contact@qwntl.com. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons. If your appeal is denied, you may submit a complaint to your state attorney general.
California "Shine The Light" Law
California Civil Code Section 1798.83 permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, submit your request in writing using the contact details in "HOW CAN YOU CONTACT US ABOUT THIS NOTICE?"
13. DO WE MAKE UPDATES TO THIS NOTICE?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last updated" date at the top of this Privacy Notice. If we make material changes, we may notify you by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this Privacy Notice periodically.
14. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
If you have questions or comments about this Privacy Notice, or wish to exercise your privacy rights, email us at contact@qwntl.com.
Durable Intelligence Labs Inc. is the controller of personal information described in this Privacy Notice.
Durable Intelligence Labs Inc. San Francisco, California, United States
15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, email us at contact@qwntl.com.
We do not use customer prompts, agent inputs, tool outputs, files, or other customer content to train general-purpose machine-learning models unless you or your organization expressly agree otherwise.