Legal
Privacy Policy
Kameron Tanseli (“we,” “us,” or “our”) is the controller of personal information collected through https://garasu.co and Garasu accounts. Garasu is an experimentation knowledge graph operated from London, United Kingdom.
The short version. We collect the email you use to sign up, the experiment history you import, and ordinary website logs. We use processors to host the app, store your data, and run AI jobs that turn tests into learnings. We do not sell personal information for money. The X advertising pixel only loads if you accept marketing cookies. The PostHog analytics cookie is stored only if you accept analytics cookies. If you reject them, PostHog does not store a cookie and counts the visit with a server-side hash.
This notice is for visitors and account holders. If your organisation puts experiment data into Garasu, you are the controller of that customer content and we are your processor — see the Data Processing Addendum.
1. Who this notice is for
- Visitors — anyone who opens the marketing site or legal pages.
- Account holders — people who create a Garasu login.
- Organisation members — people in an org, including agents that use an API key.
2. Personal information we collect
| Category | Examples | Where it comes from | Why we use it |
|---|---|---|---|
| Account | Email, hashed password, user id | You, when you sign up | Create and secure your account (contract) |
| Organisation | Org name, membership role | You or an admin | Run multi-seat workspaces (contract) |
| Customer content | Projects, experiments, hypotheses, results, learnings, API keys | You or your agent via the app or MCP | Provide the knowledge graph (contract; we process this as your processor) |
| Support | Whatever you type in the support form | You | Answer requests (contract / legitimate interests) |
| Usage | Sign-in events, import/lookup counts, pages viewed | The app and, if you consent, PostHog | Operate quotas, debug, and improve the product |
| Device | IP address, browser, device type, approximate city/country | Automatic, from your request | Security, fraud prevention, hosting logs (legitimate interests) |
| Marketing preference | Cookie choice; optional email opt-in | You | Honour PECR/UK GDPR consent; send mail only if you opt in |
We do not collect government IDs, precise geolocation, payment card PAN/CVC, or special-category data. Billing is not live: paid plans are shown on the site, but we do not take payment details yet.
3. How we use it
- Create, authenticate, and administer accounts and organisations.
- Store experiments, map them to learnings, compute evidence strength, and serve MCP / API queries.
- Send customer content through OpenRouter to model providers so we can embed text, match related learnings, and write titles and summaries. All AI endpoints we call are configured not to train on your data. We do not train a Garasu model of our own on Customer Content. OpenAI, Google, and Xiaomi models are hosted on United States servers. All models we call through OpenRouter are served from the United States. We do not extract or redact personal information from experiment hypotheses, names, or other metadata. You are responsible for not putting personal data in Customer Content you send to Garasu.
- Enforce plan limits, debug outages, and keep security logs.
- Answer support requests.
- Send product email only if you opt in. You can unsubscribe in every message.
- Understand how the site and app are used. If you accept analytics cookies, PostHog stores an identifier. If you reject them, it counts the visit without storing one.
- Measure ads on X, if you accept marketing cookies.
4. Cookies and similar storage
Essential cookies keep you signed in. Analytics and marketing storage stay off until you choose them in the cookie banner. Reject is as easy as accept. Details, the cookie table, and how to change your mind: Cookie Notice.
5. Who we share personal information with
We share information with processors who help us run Garasu. The live list is on Subprocessors. Today that includes:
| Recipient | Why | What they receive |
|---|---|---|
| Netlify | Hosts the website and app. | Site traffic, account pages you load, logs |
| Supabase | Authentication, Postgres, row-level security, realtime, and edge functions (including MCP). | Account email, hashed password, sessions, organisation and product data |
| OpenRouter | Routes embeddings, matching decisions, and learning titles/summaries to model providers. Endpoints are configured not to train on your data. | Experiment text, hypotheses, result summaries, learning titles |
| PostHog | Product analytics for the site and app. A cookie and persistent id are stored only after you accept analytics. If you reject, the visit is counted with a server-side hash and nothing is stored in the browser. | Pages viewed, referrer, device, and your account id if you are signed in and accepted analytics |
| X Corp. | Advertising pixel, only after you accept marketing cookies. | Device identifiers, pages viewed, conversion events |
| Google (Forms) | Support form linked from the site. | Whatever you type into the support form, plus Google account signals if you are signed in to Google |
| Resend | Sends account email when experiments are imported or ideas are generated. | Account email address and project name |
OpenRouter routes inference. Customer Content may be processed by Google (embeddings), OpenAI (embedding fallback and learning titles/summaries), Xiaomi (learning-title fallback). Those providers see prompt text from experiment names, hypotheses, result summaries, and learning titles. All AI endpoints we call are configured not to train on your data. We do not train a Garasu model of our own on Customer Content. OpenAI, Google, and Xiaomi models are hosted on United States servers. All models we call through OpenRouter are served from the United States. We do not extract or redact personal information from experiment hypotheses, names, or other metadata. You are responsible for not putting personal data in Customer Content you send to Garasu.
We may also share information with professional advisors, a buyer if we sell or reorganise the business, or authorities when the law requires it.
6. Sale, sharing, and advertising
We do not sell personal information for money. We do not trade email lists.
If you accept marketing cookies, we load the X (Twitter) advertising pixel (id o5gus). That may be “sharing” or a “sale” under some US state privacy laws because X can use device data for cross-context advertising. You can refuse marketing cookies, use Cookie settings in the footer, or send a Global Privacy Control (GPC) signal — we treat GPC as an opt-out of marketing cookies.
We do not honour the older “Do Not Track” header. GPC is the signal we honour.
7. How long we keep it
| Category | Retention |
|---|---|
| Account and organisation | While the account is open, then deleted when you close it |
| Customer content | While the org is open; deleted with the account or on a valid deletion request |
| Support form | Up to 24 months after we close the request |
| Security and hosting logs | About 90 days, unless we need them for an incident |
| Analytics (PostHog) | Cookie and id for about 1 year if you accepted. A rejected visit is not stored in the browser. |
| Cookie consent record | 12 months, then we will ask again |
| Marketing email | Until you unsubscribe, plus a short suppression record |
You can manage email and delete your account at /profile. Backup copies may linger for a short time after deletion.
8. How we protect it
Traffic is encrypted in transit (HTTPS). Passwords are hashed by Supabase Auth. Product tables use row-level security so one org cannot read another. API keys authenticate MCP access. We do not claim a SOC 2 or ISO certificate.
9. International transfers
We are in the United Kingdom. Several processors are in the United States or other countries. OpenAI, Google, and Xiaomi models are hosted on United States servers; all models we call through OpenRouter are served from the United States. When we transfer personal data out of the UK or EEA to a country without an adequacy decision, we rely on the processor’s standard contractual clauses or another lawful safeguard.
10. Automated processing
Mapping experiments to learnings uses embeddings and model decisions. That is how the product works; it does not produce legal or similarly significant effects about you as a person. Evidence strength is computed from experiment statistics in our code, not assigned by a model.
11. Your choices and rights
- Change cookies any time via Cookie settings in the footer or the Cookie Notice.
- Turn off experiment, idea, or marketing email, or delete your account, at /profile.
- Ask us through the support form to access, correct, delete, restrict, or export personal information, or to object to legitimate-interest processing. We will verify against the email on your account. We aim to reply within 30 days (UK/EEA) or 45 days (US state requests, extendable as the statute allows). You may use an authorised agent. We will not discriminate against you for exercising these rights.
12. Children
Garasu is for people 18 and over. We do not knowingly collect personal information from children.
13. Third-party sites
Docs and the marketing site link to other products (for example Claude, ChatGPT, Grok, PostHog, GrowthBook, Statsig). Their privacy notices apply when you leave garasu.co.
14. Changes
We will post material changes on this page and update the date above. If you have an account, we may also email the address on file.
15. Contact
Controller: Kameron Tanseli
London, United Kingdom
Contact support
We do not have a separate data protection officer. UK users can complain to the Information Commissioner’s Office. EEA users can complain to their local authority.
Annex A — US state privacy rights
If you live in California or another US state with a consumer privacy law, you may have the right to know, access, correct, delete, and port personal information, and to opt out of sale, sharing, or targeted advertising. We do not sell personal information for money. Marketing cookies (the X pixel) are the only targeted-advertising sharing we run, and only with consent or until you opt out / send GPC.
Categories collected, sources, purposes, and recipients are in the tables above. We have not sold personal information for money in the past 12 months. We do not use or disclose sensitive personal information for purposes that require a right to limit under CPRA. We do not process personal information of consumers we know are under 16 for sale or sharing.
California residents may also use the support form as a second request method. We will not discriminate against you for exercising these rights.
Annex B — UK / EEA / Switzerland
The controller is Kameron Tanseli, London, United Kingdom. Legal bases are listed with each purpose in section 2. Legitimate interests we rely on: securing the service, debugging outages, understanding aggregated product usage, and establishing or defending legal claims. You may object to legitimate-interest processing.
Providing account data is required to enter the contract for a Garasu account. You can use the public site without an account. Analytics and marketing cookies are optional.
Related: Terms of Service, Cookie Notice, DPA.