Privacy Policy

Last updated: October 14, 2026

This policy explains what personal data 01 Labs, Inc. ("Alpha.sh", "we", "us") collects when you use the website at alpha.sh, the console at console.alpha.sh and the inference API, why we collect it, who receives it, how long we keep it, and the rights you have. Use of the Alpha.sh platform itself is governed by the Terms of Service or the written agreement under which access is granted.

Who we are and how to reach us

01 Labs, Inc., a Nevada corporation, United States. For any question or request about personal data, email hello@alpha.sh with "Privacy request" in the subject line, or use the Talk to us page.

Our two roles

For the website, the console and your account we decide why and how personal data is processed, so we act as the controller (or "business" under US state privacy laws). For the content of inference requests, meaning the prompts, inputs, files and outputs that you or your users send through the API, we process data only on your instructions to provide the service, so we act as your processor (or "service provider"). Processing in that role is governed by our data processing addendum, which includes the EU Standard Contractual Clauses and is available on request to any customer.

What we collect, and why

Website visitors

• Request data. Standard request data (IP address, user agent, requested URL, timestamps) is processed to deliver the site and protect it from abuse. Legal basis: our legitimate interest in running a secure service.
• Analytics. We use Google Analytics to count visits and see which pages and console screens are used. Google receives the pages you view, your approximate location derived from a truncated IP address, and device and browser details. If you are in the European Economic Area, the United Kingdom or Switzerland, Google Analytics runs without cookies or persistent identifiers unless you grant consent; elsewhere it sets first-party cookies named _ga and _ga_* that last up to two years. Advertising features and personalisation are switched off everywhere. You can block analytics with the Google Analytics opt-out add-on or by blocking the googletagmanager.com domain. Legal basis: consent where cookies are used; otherwise our legitimate interest in understanding how the site is used.
• Email you give us. If you submit your email on the maintenance page ("Notify me"), we store that address to send you a single message when the console is available. If you email us, we keep the correspondence to respond to you. Legal basis: the request you make, and our legitimate interest in responding.
• Demo and capacity reservation requests. If you send the "Talk to us" or capacity reservation form, we store your name, work email, deployment preference, the workload notes you write and whether you asked for product updates. Capacity reservations also include your company, phone number, requested monthly token volume, preferred term, reservation reference and receipt timestamp, and any model preferences you give us. We also record how you reached the form: the page and link you sent it from, the referring site (without the query string), campaign tags (utm_*) if the link carried them, and your country and IP address. Our team is notified in our internal messaging tools with your name, email, request and that context, so someone can reply quickly. Legal basis: taking steps at your request before entering into a contract; consent for product updates.

Console accounts

• Sign-in. When you sign in with Google or GitHub, the identity provider you choose shares your name, email address and profile identifier with us so we can create and secure your account.
• Account and organization data. Your organization and role, invitations you send or receive, the API keys you create (stored as one-way hashes; the secret is shown to you once and never kept), your organization's credit balance and transactions, and an activity log of changes made in the console (for example who invited or removed a member and which keys were created or deleted).
• Playground. Conversations you have in the console playground are saved to your organization so you can reopen them; you can delete them at any time. Images attached in the playground are not stored.

Legal basis for console data: performance of the agreement under which you use the service, and our legitimate interest in keeping accounts secure and in keeping records of who did what in a shared organization.

Inference requests

This section covers requests to the inference API (alpha.sh/v1), whether you call it directly or through a marketplace or gateway that routes to Alpha.sh.

• No retention of prompts or outputs. The request is forwarded to the model and the answer is streamed back. Prompts, inputs, attached images and outputs are not stored or logged. They exist only in memory while the request is processed.
• No training. We never use your prompts, inputs or outputs to train, fine-tune or evaluate models, and we do not allow our providers to do so.
• Usage metadata. For each request we record the time, the API key and organization, the model, token counts, latency, status and cost, plus a request id returned in the Inference-Id header. We use this to bill, to enforce rate limits, to show your usage in the console and to keep the service reliable. When a marketplace or gateway routes the request, we give it the cost of the request ids it asks about.
• Where requests are processed. We serve inference requests from our own infrastructure in the United States and the European Union. Each request is processed in one of these regions, in memory only.

Summary of data categories

The same information, grouped the way US state privacy laws and the GDPR describe it. We have collected these categories in the preceding 12 months, for the purposes shown; we sell none of them and share none for advertising.

We do not deliberately collect sensitive personal data. The content of inference requests may contain whatever you choose to send; we do not inspect it and do not store it.

Who receives personal data

We share personal data only with the following categories of recipients, and only for the purposes described above:

• Infrastructure, colocation and content delivery providers that host or connect our servers, the website, the console and the API, including security providers. They process data on our instructions under written agreements that are no less protective than this policy and our data processing addendum. The current list is available to customers under that addendum.
• Identity providers (Google or GitHub) when you choose to sign in with them.
• Analytics (Google Analytics), as described above.
• Payment processors, when you buy credits; they receive the data needed to take the payment and we do not store full card numbers.
• Marketplaces and gateways that route requests to us, limited to request ids and their cost.
• Internal tools we use for email, messaging and support, which hold the business contact data of people who write to us.
• Professional advisers and authorities, where the law requires it, to establish or defend legal claims, or to protect the rights and safety of Alpha.sh and others. If we receive a legal demand for data we process for a customer, we tell the customer unless the law prohibits it, and we disclose only what we are legally required to.
• A successor, if Alpha.sh is involved in a merger, acquisition or sale of assets, in which case this policy continues to apply to the data transferred.

We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use it for advertising of any kind.

Aggregated and de-identified data

We may create aggregated or de-identified statistics from usage metadata, for example tokens served per model or latency distributions, to operate, benchmark and describe the service. These statistics do not identify you or your organization, and we do not attempt to re-identify them.

Marketing communications

We send product updates only if you asked for them on a form or in the console. Every such email carries an unsubscribe link, and you can opt out at any time by using it or by emailing us. Messages about your account, security or billing are service messages, not marketing, and continue while you have an account.

Links to other sites

The website and the console link to third-party sites and services, for example documentation, identity providers and payment pages. Their privacy practices are their own; this policy covers only data collected by Alpha.sh.

International transfers

We are based in the United States and the data we store ourselves, such as console accounts and usage metadata, is held in the United States. Where personal data protected by the laws of the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss variations, or on the EU-US Data Privacy Framework where a recipient is certified under it. A copy of the relevant safeguards is available on request.

Cookies and storage

Google Analytics may set the _ga and _ga_* cookies described above, except in the EEA, UK and Switzerland where it runs cookieless by default. After you sign in, the console sets one strictly necessary session cookie, and a short-lived cookie is used during the sign-in handshake; both are removed when you log out or expire on their own. Our content delivery and security provider may set strictly necessary cookies for security and bot protection. If we enable a maintenance-bypass cookie for our own staff, it contains no personal data. The landing page keeps the campaign tags and referring site of your first page in your browser's session storage (alpha.firstTouch) so a "Talk to us" request can say where you came from; it holds no personal data and is cleared when you close the tab.

How long we keep data

Security

Data in transit is encrypted. Access to production systems is limited to named personnel under confidentiality obligations, with individual credentials and multi-factor authentication. API keys are stored as one-way hashes. If a security incident affects your personal data, we will notify you and, where required, the competent authority without undue delay.

Automated decisions and children

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. The website, the console and the API are intended for businesses and professionals and are not directed at anyone under 18; we do not knowingly collect personal data from children.

Your rights

Depending on where you live, you may have the right to access your personal data, to have it corrected or deleted, to receive a copy in a portable format, to restrict or object to its processing, and to withdraw consent at any time without affecting processing that took place before withdrawal. If you are in the European Economic Area, the United Kingdom or Switzerland, you may also lodge a complaint with your local data protection authority. If you are a resident of California or another US state with a comprehensive privacy law, you have the right to know what personal data we collect and how we use and disclose it, to delete it, to correct it, and not to be discriminated against for exercising these rights; because we do not sell or share personal data, there is nothing for an opt-out request or a Global Privacy Control signal to switch off, and we do not respond to browser Do Not Track signals.

To exercise any right, email hello@alpha.sh. We may ask you to verify your identity, and we respond within the time the applicable law allows. If we hold your data only as a processor for one of our customers, we will refer your request to that customer.

Changes

We will post any changes on this page and update the date above. If a change materially reduces your rights or changes how we use personal data, we will notify account holders by email before it takes effect.

Contact

01 Labs, Inc. · Nevada, United States · hello@alpha.sh