1. Who we are
Magnet Labs LLC (“Magnet Labs,” “we,” “us,” “our”) is a Virginia limited liability company. We provide facilitated workshops (Insight Labs™ and Applied Thinking Labs™), AI strategy advisory, published research, a self-assessment Scorecard and an online community.
This Privacy Policy explains how we handle personal information in connection with our website at magnetlabs.io (the “Site”) and our workshop and advisory services (the “Services”). It does not apply to the websites, products or services of our customers or of any third party.
2. Our two roles
How we handle personal information — and who you should contact about it — depends on the context.
As a controller. For personal information about visitors to our Site, prospective customers, community members, business contacts, our own personnel and applicants, we decide why and how the information is used. This Policy governs that handling directly, and you can exercise your rights with us.
In engagements. When we run workshops or advisory engagements for a customer organization, we handle information about that customer's participants on the customer's behalf and under our agreement with the customer. What participants write in a lab stays with them unless they choose to share it, and our follow-up records use participant codes, not names. If your personal information was collected in a customer's engagement and you want to exercise a privacy right, please contact that organization; if you contact us instead, we will refer your request to the relevant customer and support them in responding.
3. Information we collect
3.1 Site visitors. Our Site is an informational marketing website hosted on Vercel and served through Vercel's content delivery network. We do not operate a customer login, account area or application on the Site itself.
Forms. The Site offers forms to start a lab, book a 60-Minute Challenge Lab, take the AI and Human Advantage Scorecard, and download our research papers. When you submit one, we collect the information you enter: typically your name, business email address, company and your message or answers — and for the Scorecard, your ratings, from which we build the report we email you. Form submissions are processed by our website host (Vercel) and delivered to us by email through our email delivery provider (Resend); the Scorecard also sends you your report by email through Resend. Resend keeps a record of the emails it delivers in line with its own retention settings. We use form submissions only to respond to you and to manage the business relationship you are asking about.
Server logs. Our hosting infrastructure records standard technical information when a page is requested, which may include IP address, browser and device type, the page requested, the referring page and the time of the request. These records exist for security, abuse prevention and operational purposes. We do not use them to identify individual visitors or for advertising.
Analytics and cookies. We use analytics tools to understand how visitors use the Site. Google Analytics, which uses cookies, runs only if you accept it. See Section 8.
3.2 Community members. Our Insights Community at join.magnetlabs.io is hosted by Circle. When you join, Circle collects your registration information (such as name and email address) and hosts what you post, on our behalf. The community widget on the Site is served by Circle; see Section 8.
3.3 Business and prospect contacts. When you contact us, or we contact you, we collect the information you provide — typically name, business email address, telephone number, employer, job title and the content of our correspondence. We may also collect business contact information from public sources such as company websites and professional networking sites.
3.4 Engagement and workshop information. In an engagement we collect discovery notes about the customer's business challenge and, for outcome tracking, each participant's if-then commitment, whether it was kept at the follow-up, and a short before-and-after self-rating. Follow-up records use participant codes, not names, and commitments are shared only if the participant chooses. We collect no biological or neurological data: no neurofeedback, brain stimulation or biometric monitoring of anyone, ever. We ask customers not to send us sensitive categories of information — government identifiers, financial account numbers, health information or biometric data — because our Services are not designed to process them.
3.5 Personnel and applicants. We collect information necessary to engage personnel and evaluate applicants, used only for employment, contracting and legal compliance purposes.
4. How we use information
We use personal information to:
- deliver, operate and improve the Services, the Site and the community;
- communicate with customers and prospects about engagements, proposals and support;
- send you what you asked for, such as a research download or your Scorecard report;
- secure our systems and detect, investigate and respond to security incidents and abuse;
- maintain business records, invoice, and manage vendor relationships; and
- comply with legal obligations and enforce our agreements.
We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not use customer or participant information for our own marketing.
5. Artificial intelligence
Our workshops and advisory are delivered by people. In our AI strategy work, people keep the decisions that need human judgment.
We do not use customer or participant information to train, fine-tune or improve any AI model, and we do not put customer-confidential or participant personal information into external AI tools.
7. Where information is stored, and for how long
Magnet Labs operates from the United States, and our service providers store and process information in the United States. If you access our Site from outside the United States, your information will be transferred to and processed in the United States, where data protection laws differ from those of your country.
Engagement information is retained for the period set out in the applicable customer agreement; where the agreement is silent, we retain it only as long as needed to deliver the Services and the agreed follow-ups.
Business and prospect contacts are retained while the relationship is active and for a reasonable period afterward.
Records we must keep — contracts, invoices, tax and corporate records — are retained for the periods required by law.
Backups are overwritten on their normal cycle, so information may persist in backups for a limited period after deletion. A legal hold suspends deletion for the information covered by it.
8. Cookies and similar technologies
8.1 Where cookies are used. Cookies are small text files a website stores on your device. We use them only on our public website at magnetlabs.io. No cookie, tag, pixel or tracker is used in the course of delivering a workshop or advisory engagement.
8.2 What we use on the Site. The Site sets cookies only for Google Analytics, and only if you accept them in the cookie banner (see Section 8.4). Until you choose, and if you decline, no analytics cookies are set. We remember your choice in your browser's local storage (not a cookie) under the name magnetlabs-consent, so we don't ask on every page.
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
| _ga | Google Analytics | Distinguishes one visitor from another using a random identifier | 2 years |
| _ga_<container-id> | Google Analytics | Keeps track of the current visit | 2 years |
8.3 What we do not use. We do not use advertising cookies, cross-site tracking, retargeting or advertising pixels. Google Analytics runs on our Site with Google signals and ad personalization turned off, and its advertising storage is always disabled. We do not permit third parties to place advertising technologies on our Site. We do not sell personal information or share it for cross-context behavioral advertising.
8.4 Analytics. We use two tools to understand, in aggregate, how visitors find and use the Site. We use this information to improve the Site, not to identify you or for advertising.
Vercel Web Analytics records which pages are viewed, the referring page, and the visitor's country, browser, operating system and device type. It does not use cookies and does not identify you individually; visitors are distinguished only by a hash derived from the incoming request, which is discarded within 24 hours.
Google Analytics 4, provided by Google LLC, runs with cookies only if you accept analytics cookies. It records the pages you view, how you arrived, your approximate location (country, region and city, derived from your IP address), your browser and device, and interactions such as scrolling and clicking, linked to the random identifier in the _ga cookie. Google Analytics 4 does not log or store IP addresses. We keep Google Analytics data for no longer than 14 months. Google processes this data on our behalf; see Google's Privacy Policy and How Google uses information from sites that use its services.
If you decline, or have not yet chosen, Google Analytics sets no cookies and stores no identifier on your device. Your browser may still send Google a basic signal that a page was viewed, without any cookie or identifier, which Google uses only to estimate overall visitor numbers.
8.5 The community widget. Pages on the Site load our community widget from join.magnetlabs.io, operated by Circle. If you are a signed-in member of our community, Circle may set its own cookies in connection with your membership, governed by Circle's privacy policy. The widget is not used to track your browsing on the Site.
8.6 Managing cookies. You can accept or decline analytics cookies in the banner, and change your choice at any time using Cookie settings at the bottom of every page. If you decline after accepting, we remove the Google Analytics cookies from your browser for our Site. Most browsers also let you see, delete and refuse cookies through their settings. Blocking cookies will not prevent you from using the Site or submitting a form. You can also use a browser or extension that transmits a Global Privacy Control signal: where we receive one, we treat it as declining analytics cookies and as a request to opt out of any sale or sharing of personal information; as stated in Section 4, we do not sell or share personal information in any event.
8.7 Changes. If we add a cookie, an analytics tool or an embedded third-party feature to the Site, we will update this Section and the “Last updated” date above before or at the time the change goes live.
9. Security
We maintain reasonable administrative and technical safeguards for the information entrusted to us, including: least-privilege access on a need-to-know basis; multi-factor authentication on our accounts; encryption in transit and at rest through our service providers; participant codes rather than names in outcome records; and separation of engagement information from marketing.
No system is completely secure and we cannot guarantee absolute security. If you believe you have found a security issue, contact security@magnetlabs.io.
10. Your rights
Depending on where you live and on our role, you may have the right to request access to the personal information we hold about you, correction, deletion, a portable copy, restriction of or objection to certain processing, and withdrawal of consent where processing relies on it. You have the right not to be discriminated against for exercising these rights.
How to make a request. Email privacy@magnetlabs.io describing your request. We will acknowledge it and respond within 30 days of receipt, unless a longer period is permitted by law and we notify you. We verify identity before acting on a request, and will explain if we must decline. You may use an authorized agent, with proof of authorization. Where we hold information on a customer's behalf, we will refer your request to that customer, as described in Section 2.
Virginia. If we decline a request from a Virginia resident under the Virginia Consumer Data Protection Act, you may appeal by replying to our response; we will answer the appeal within 60 days. We do not process personal information for targeted advertising, do not sell it, and do not profile anyone in furtherance of decisions with legal or similarly significant effects.
California. We do not sell personal information and do not share it for cross-context behavioral advertising, and have not done so in the preceding twelve months.
11. Children
Our Services are business tools for organizations. They are not directed to children and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.
12. Changes to this Policy
We may update this Policy. We will revise the “Last updated” date and, where a change is material and affects customers, notify affected customers by email to the designated contact. Material changes take effect 30 days after notice, except where an earlier date is required by law. Prior versions are available on request.
13. Contact us
Magnet Labs LLC
For privacy inquiries: privacy@magnetlabs.io
For security inquiries: security@magnetlabs.io
We respond to privacy and security inquiries promptly.