Legal
Privacy
This notice describes what CogNEXUS Labs collects on cognexuslabs.ai, why, who else handles it, how long we keep it, and the rights you have under the GDPR, the UK GDPR, and the California Consumer Privacy Act. It is written for the people who will actually read it (Legal, Compliance, and Security), not as a wall of generic clauses.
Who we are
CogNEXUS Labs LLC, a Washington limited liability company, operates this site and the ArtzAIn product as CogNEXUS Labs, and is the controller of the personal data described on this page. Postal address: 29261 SE 5th Street, Fall City, WA 98024, United States. For anything about personal data, including a request to exercise a right, write to privacy@cognexuslabs.ai. For everything else, hello@cognexuslabs.ai. Both inboxes are read by the founding team.
We are not required to appoint a data protection officer and have not appointed one. The address above reaches the people responsible for this notice.
What we collect, why, and how long we keep it
The marketing site is static HTML. We run no analytics, no advertising pixels, no tag manager, and no embedded third-party widgets, and we set no cookies. Everything we hold about a visitor comes from one of the rows below.
| What | Where it comes from | Why, and the legal basis | How long |
|---|---|---|---|
| Pilot request: name, company, work email, role or title, company-size bracket, the workflow category you pick, plus the request id we generate and the time we received it | You, through the form on /artzain | To reply about a pilot and run the conversation that follows. Nothing else: no marketing sequence, no profiling, no automated decision-making, no enrichment from other sources. Basis: our legitimate interest (GDPR Art. 6(1)(f)) in answering an inquiry you chose to start. | 24 months after our last exchange. If a pilot or contract follows, the retention terms in that agreement take over. |
| Email you send to hello@ or privacy@, and our replies | You | To answer you. Basis: legitimate interest, as above. | 24 months after our last exchange |
| Requests to exercise a privacy right, and how we handled them | You, or an agent you authorize | To act on the request and to show that we did. Basis: legal obligation (GDPR Art. 6(1)(c)); California regulations require us to keep these records for 24 months. | 24 months |
| Connection data: IP address, request headers, the URL requested | Your browser, automatically, on every request | To deliver the page and keep the site up. Basis: legitimate interest in running a secure site. | We keep no access logs. Our hosting provider handles this data for the duration of the request and for its own network security, under our contract with it. |
| Theme preference: artzain_theme in your browser's localStorage (an older cognexus_theme value is migrated once) | You, when you press the theme toggle | So the next visit matches your last choice. This is strictly necessary for a feature you asked for, so no consent banner is needed. The value never leaves your device. | Until you clear your browser's storage |
All six fields on the pilot form are required; without them the form does not send and we cannot reply. We accept work email addresses only, because the request is about your organization rather than about you as a consumer. We judged that our interest in answering does not override yours: you chose to get in touch, we use the data for nothing else, and you can object at any time (see below).
The form posts to POST /api/contact/enterprise. That endpoint validates the submission and relays it as an email to our inbox. It never writes the submission to a log or a database: the only record it keeps is the request id shown to you on success and, if delivery fails, the error status.
Who else handles it
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have not done either in the preceding twelve months. We do not pass it to data brokers, advertising networks, analytics vendors, or a marketing platform. The record lives in our mailbox. The processors that touch it on our behalf are:
- Amazon Web Services (United States, us-east-1): hosts the site and runs the form endpoint (S3, CloudFront, Lambda), under the AWS data-processing addendum.
- Resend (United States): the transactional email service that delivers the pilot request to our inbox, under Resend's data-processing addendum.
- Microsoft 365 (Microsoft Corporation, United States): hosts our mailboxes (Exchange Online), where the request and any follow-up correspondence are stored, under the Microsoft Products and Services Data Protection Addendum.
Beyond that, we disclose personal data only to professional advisers bound by confidentiality, or where the law, a court, or a regulator requires it. If we add a processor that handles pilot-request data, we will update this page before it does.
Where it goes
We are established in the United States, and so are our systems. If you are in the European Economic Area, the United Kingdom, or Switzerland, your pilot request or email travels to the United States when you send it and is processed there. For AWS, Resend, and Microsoft we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum and the Swiss amendments where they apply), which are built into their data-processing addenda. Ask privacy@cognexuslabs.ai for details of the safeguards in place.
Your rights
Wherever you are, you can ask us to tell you what we hold about you, correct it, delete it, give you a copy in a portable format, or restrict what we do with it. Write to privacy@cognexuslabs.ai. There is no fee, no form to fill in, and no account to log into.
Verification. We confirm a request by replying to the email address on the record. If you write from a different address, we will ask you to confirm from the one you used with us. An authorized agent may submit a request for you; we will ask for your written permission and may confirm with you directly.
Timing. We acknowledge requests within ten business days and answer within one month. If a request is complex we may take up to two further months and will tell you why. For California residents the statutory window is 45 days, extendable once by a further 45 with notice.
No penalty. Exercising a right does not change how we treat you or any pilot conversation.
Your right to object
Because we process pilot requests on the basis of legitimate interest, you have the right to object at any time, on grounds relating to your particular situation. Email privacy@cognexuslabs.ai. When you object we stop, unless we can show compelling legitimate grounds that override your interests, rights, and freedoms. We do not use personal data for direct marketing; if that ever changed, you could object to it without giving a reason and we would stop.
European Economic Area, United Kingdom, and Switzerland
The GDPR and the UK GDPR give you the rights of access, rectification, erasure, restriction, portability, and objection described above, and the right not to be subject to a decision based solely on automated processing (we make none). We do not rely on consent for anything on this page, so there is no consent to withdraw; if we ever ask for consent, withdrawing it will be as easy as giving it. You also have the right to lodge a complaint with a supervisory authority: in the EU, the authority in the member state where you live or work, listed by the European Data Protection Board; in the UK, the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would rather hear from you first.
California
The California Consumer Privacy Act applies to businesses above revenue and data-volume thresholds that CogNEXUS Labs does not currently meet. We extend its rights to California residents anyway. In the preceding twelve months we collected the categories of personal information below, from you directly and from your browser, for the purposes described above. We sold none of it and shared none of it, so this site carries no "Do Not Sell or Share My Personal Information" link. We collect no sensitive personal information, so there is no "Limit the Use" link either. We do not knowingly collect personal information from anyone under 16.
| CCPA category | Collected | What, here | Disclosed to |
|---|---|---|---|
| Identifiers | Yes | Name, work email address | Service providers: hosting, email delivery, mailbox |
| Professional or employment-related information | Yes | Company, role or title, company-size bracket | Same |
| Commercial information | Yes | The workflow you want governed; the pilot conversation | Same |
| Internet or other network activity | Transiently | IP address and request headers, to serve the page; not retained by us | Service provider: hosting |
| Geolocation, biometric, audio or visual, health, inferences, protected classifications, sensitive personal information | No | None | None |
California residents have the right to know what we collect and how we use and disclose it, to delete it, to correct it, to opt out of sale or sharing (we do neither), to limit the use of sensitive personal information (we collect none), and not to be discriminated against for exercising any of these. We honor opt-out preference signals such as Global Privacy Control, though with no tracking on the site there is nothing for the signal to switch off. Under California's "Shine the Light" law (Civil Code §1798.83) you may ask whether we disclosed personal information to third parties for their own direct marketing: we have not. Residents of other US states with privacy laws may use the same address and will receive the same treatment.
Security
The site is served over TLS only. There is no database of visitors to breach: the pilot record exists as an email, and access to it is limited to the founding team. The form endpoint runs with the minimum permissions it needs and never logs what you typed. If a breach ever affected your personal data, we would notify the relevant authority and, where the law requires it, you, within the statutory deadlines.
ArtzAIn deployments
When ArtzAIn runs as an enterprise control plane, it deploys in your VPC. Customer data, policies, and decision records stay inside your perimeter. CogNEXUS Labs does not take a copy of that data as a condition of the product. In a pilot or deployment your organization is the controller of that data; where CogNEXUS Labs processes any of it on your behalf (during support, for example), it does so as a processor under the data-processing terms in the pilot or commercial agreement, not under this page.
The public SDK
The artzain Python package is installed from PyPI, and the @cognexuslabs/artzain TypeScript package from npm, under those projects' terms. PyPI, npm, and GitHub publish their own privacy notices for what they collect when you visit them. Running the Python package locally does not send your prompts or actions to CogNEXUS Labs unless you configure an endpoint that does.
Changes
We review this notice at least every twelve months and whenever the site's data flows change. If we intend to use information we already hold for a new purpose, we will tell you before we do. When this notice changes we update this page, the date below, and the lastmod in the sitemap. The date below is when this version took effect.
Effective 2026-08-21. Replaces the version of 2026-08-14.