Privacy Policy
Last updated · 22 September 2026
These describe how the site and the platform actually work today. They are reviewed by counsel before contract signature; the contracted terms of an engagement are set out in the agreement itself.
1. Who we are
Ultramar Labs LLC is a custom-software practice based in Dallas–Fort Worth, trading as Ultramar Labs and reachable at hello@ultramarlabs.io. When you engage us, Ultramar Labs LLC is the party you contract with, and the entity named on any insurance or Business Associate Agreement we hold or sign.
2. What we collect
What you send us: the contact form, the Working Session intake, anything you share during an engagement, and — if you become a client — your account details and the material your work produces. Payment card details go directly to Stripe and never reach our servers; we see only the last four digits and the card brand. We keep standard server logs. We do not run advertising trackers.
3. How we use it
Only to do the work and run the business: answer you, prepare and deliver an engagement, take payment, and meet legal obligations. We do not sell your information, we do not share it beyond the subprocessors listed on our security page, and we do not use it to train any model — ours or anyone else’s.
4. Where it lives
In the United States. The application runs on Vercel; the database, file storage and sign-in are Supabase, hosted on AWS in the us-east-2 region. We will tell you before moving anything outside the US.
5. Who else touches it
A finite, public, dated list is published at /security — every company involved in running this and what each one handles. We keep it current in the same change that adds a vendor, and we notify clients of material additions.
6. Meetings, recordings and notes
Meetings are not transcribed unless you are told and agree in the room; consent is recorded and can be withdrawn at any point, which stops it immediately. Where live notes are on, the transcript is processed to produce notes and a session recap. Recordings and transcripts are kept 90 days unless you ask otherwise.
7. How long we keep it
Engagement materials, briefs and delivered work: the life of the engagement plus two years, so you can come back to them. Recordings and transcripts: 90 days. Financial records: as tax law requires. Everything else is deleted when it stops being useful.
8. Deleting it
Ask and it goes — removed from production within 30 days, and from backups as those age out. You get written confirmation of what was removed. Anything we must keep for tax or legal reasons is named to you rather than quietly retained. We do not claim instant erasure from immutable backups, because nobody can honestly do that.
9. Your choices
Ask us what we hold, ask for a copy, ask for a correction, or ask us to delete it — email hello@ultramarlabs.io. Where we act as a processor for a client, we pass such requests to that client and support them in answering.
10. Security
Encryption in transit and at rest, multi-factor authentication required on every account behind the sign-in, database-level isolation between clients, audit logging, and backups with restores that are actually rehearsed. The detail, including what we have not done yet, is at /security.
11. If something goes wrong
If your data is involved in a security incident you will hear from us within 72 hours of us confirming it — what we know, what we do not yet know, and what we are doing. You will hear it from us rather than from someone else.
12. Children
This site is for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 13. Where we build software for a school, student data is handled under the institution’s direction and its own agreement with us.
13. Changes and contact
We date this page whenever it changes. Questions, or a security questionnaire that needs completing: hello@ultramarlabs.io.
14. Mobile numbers and verification texts
If you choose text-message verification, we collect your mobile number and your request to receive sign-in codes. Supabase and our verification provider process the number, delivery information and verification attempts to secure your account. We do not sell or share mobile information, text-message opt-in data or consent with third parties or affiliates for marketing or promotional purposes. We share only what our service providers need to deliver and secure the service. You can choose an authenticator app instead, and can remove a phone method after verifying a replacement.
15. Co assistant text messages
Co SMS is separate from sign-in verification. At /co/sms, the mobile number identifies a private-pilot request and the separate SMS consent checkbox is optional and unchecked by default. We store the number, whether the box was selected, the disclosure and version shown, request time, and source page. An unchecked request does not authorize messaging. We use a keyed hash of your network address to limit abuse; we do not store the raw address in the request. Pilot access and control of the number must be confirmed before activation. Pending requests can be withdrawn by contacting kevin@ultramarlabs.io; old requests are purged during subsequent enrollment processing after 90 days. For active messaging, Telnyx and carriers process numbers, message content and delivery information. We do not sell or share mobile information or SMS opt-in data and consent with third parties or affiliates for marketing or promotional purposes. Information is shared with service providers only as needed to operate and secure the service.