Legal

Privacy Policy

Effective October 14, 2026 · Last updated October 14, 2026

1. Who we are

Recursive AI Robotics & Engineering Labs Inc., a Delaware corporation ("RARE Labs", "we", "us"), builds AI and robotics for chemical scale-up, including Reflux, our AI copilot for process simulation. This Privacy Policy explains how we collect and use personal information when you visit this website, email us, or deal with us as a business contact.

We are responsible for (the "controller" of) the personal information described here. Our contact details are at the end of this page.

This policy does not cover the Reflux platform at reflux.sh, which has its own terms and privacy notice, or data we handle for customers under a signed agreement (see section 7).

2. What we collect

When you visit this website

The site does not ask you to sign up or fill in forms, and we do not use analytics, advertising or tracking tools. Like any website, some technical information is processed automatically so the pages can be delivered to you:

• Server logs. Our hosting provider records standard request data such as your IP address, browser type, device, the page requested, the referring page and the time of the visit. These logs are used for security and to keep the site running.
• Fonts and code libraries. The site loads fonts from Google Fonts and a 3D graphics library from cdnjs (run by Cloudflare). To send these files, those services receive your IP address and browser details. See section 5 and our Cookie Notice.

When you contact us

If you email us, we receive your name, email address, the content of your message and anything you attach, plus details you choose to share such as your company, role or phone number.

Business contacts and outreach

We contact people at companies, universities, software vendors and investors who may be interested in our work. For this we may collect business contact details (name, job title, employer, work email, work phone, professional profile) from public sources such as company websites, publications and professional networks, from business contact data providers, from events and introductions, and from you directly.

Customers, partners and investors

If you or your organisation work with us, we keep the contact and business details needed to manage that relationship, such as contracts, NDAs, invoices and meeting notes.

3. How we use it, and our legal bases

We do not use your information for automated decisions that have legal or similarly significant effects on you.

4. Marketing and outreach emails

Every outreach email we send tells you who we are and how to reach us. If you do not want to hear from us, reply "unsubscribe" or email us, and we will stop and keep a short note so that we do not contact you again. We follow applicable email marketing laws, including the US CAN-SPAM Act, Canada's Anti-Spam Legislation (CASL) and the UK and EU rules on electronic marketing.

5. Who we share it with

We do not sell your personal information, and we do not share it for targeted advertising. We share it only with:

• Service providers who work for us, such as website hosting and content delivery, email and workspace tools, customer relationship and sales tools, file storage, and payment and accounting providers. They may use the data only to provide their service to us.
• Third-party website resources: Google (Google Fonts) and Cloudflare (cdnjs), which receive technical data when your browser loads their files. Their use is covered by their own privacy policies.
• Professional advisers such as lawyers, accountants and auditors.
• Authorities when the law requires it, or to protect our rights, our users or others.
• A buyer, successor or new company as part of a merger, acquisition, financing, reorganisation or sale of assets. We will tell you if this changes how your information is handled.

6. International transfers

We are a US company with team members in the United States and Canada, and our service providers may process data in other countries. When we move personal information out of the UK or the European Economic Area, we use recognised safeguards such as the UK and EU Standard Contractual Clauses or an adequacy decision.

7. Customer and project data

Process data, chemistry, simulation files and other information that customers share with us for a pilot, study or platform licence are covered by the signed agreement and any NDA with that customer, not by this policy. Where we process personal information on a customer's behalf, we act as their processor and follow their instructions.

8. How long we keep it

• Emails and business correspondence: for as long as the conversation or relationship is active, and then for up to 3 years unless a longer period is needed.
• Outreach contact records: until you ask us to stop, or until they are no longer useful, reviewed at least once a year. Opt-out records are kept so we can respect your choice.
• Contract, tax and accounting records: as long as the law requires (often 6 to 7 years).
• Server logs: kept by our hosting provider for a short period, usually days to weeks.

9. Security

We use reasonable technical and organisational measures to protect personal information, including encrypted connections, access controls and reputable service providers. No method of sending or storing data is completely secure, so we cannot promise absolute security.

10. Your rights

Depending on where you live, you may have the right to:

• ask what personal information we hold about you and get a copy;
• ask us to correct it, or to delete it;
• object to or limit how we use it, including at any time for direct marketing;
• receive it in a portable format;
• withdraw consent, where we rely on consent;
• not be treated differently for using these rights.

To use any of these rights, email us at the address below. We will reply within the time the law allows (usually one month, or 45 days in US states with privacy laws). We may need to confirm your identity first. You can use an authorised agent where the law allows.

UK and EU

You can complain to your data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to sort out your concern first.

Canada

We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA). You can contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

United States

Residents of California, Connecticut and other states with privacy laws can use the rights listed above, where those laws apply to us. In the past 12 months we have collected the categories described in section 2 (identifiers, professional information, internet activity on this site, and the content of your messages) for the purposes in section 3. We have not sold or shared personal information for cross-context behavioural advertising, and we do not knowingly collect sensitive personal information. We treat browser privacy signals such as Global Privacy Control as an opt-out where required, although we have nothing to opt you out of.

11. Children

This website and our services are for businesses and professionals. They are not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has sent us information, contact us and we will delete it.

12. Other websites

This site links to other websites, including reflux.sh. Their privacy practices are set out in their own policies.

13. Changes to this policy

We may update this policy as our company and services change. We will post the new version here with a new "Last updated" date, and tell you directly about important changes where we can.

14. Contact us

Questions or requests about privacy: