1. Scope and roles
Limitless Labs, Inc. (“Limitless,” “Howard,” “we,” “us,” or “our”) operates howard.cx and the Howard engineering decision-support service (collectively, the “Service”).
This Privacy Policy applies to information collected through the Service, our website, demo requests, support, and related business interactions. For account, website, sales, and operational data, Limitless generally acts as the controller or business. When an organization uses Howard to process project content under an enterprise agreement, Limitless may act as its processor or service provider, and that agreement will control where it conflicts with this policy.
2. Information we collect
Information you provide
- Account information: email address, organization, account identifiers, and login activity.
- Customer Content: prompts, conversations, measurements, drawings, CAD or other uploaded files, tool inputs and results, and generated outputs.
- Feedback and communications: ratings, support messages, survey responses, and other correspondence.
- Demo and commercial information: work email, company, the problem you want to evaluate, contract contacts, and billing or transaction records when applicable.
Information collected automatically
- Technical data: IP address, browser and device information, request time, referring page, and security or diagnostic logs.
- Usage data: features used, tool calls, response performance, feedback state, and service errors.
- Essential cookies: Howard uses a secure session cookie to keep signed-in users authenticated. Howard does not use advertising cookies.
3. How we use information
We use information to:
- provide, maintain, personalize, and secure the Service;
- authenticate users, enforce account boundaries, and prevent abuse;
- generate responses, run engineering tools, save conversations, and process feedback;
- respond to demo requests, support questions, and business communications;
- measure reliability, diagnose failures, and improve service operation;
- administer contracts, billing, and customer relationships; and
- comply with law and protect the rights, safety, and integrity of users, Limitless, and others.
Where European data-protection law applies, our legal bases may include performance of a contract, legitimate interests in operating and securing the Service, consent where requested, and compliance with legal obligations.
4. AI processing and model training
Howard sends the content needed to answer a request to contracted AI-model providers. Howard currently uses Anthropic’s business API for response generation and hosted code execution. Model providers process that content under their applicable commercial terms, privacy terms, retention rules, and safety requirements.
Limitless does not use Customer Content or Output to train shared AI models. We do not authorize model providers to use Howard’s API inputs or outputs for model training. If we introduce an optional feature that uses Customer Content for training, we will request separate, explicit consent.
6. Retention and deletion
Saved conversations remain available until you delete them or an account-level deletion is completed. Session records expire after 30 days. We retain account, commercial, support, security, and diagnostic records only as long as reasonably necessary for the purposes described above, including legal, accounting, dispute, and abuse-prevention requirements.
Deletion removes data from active systems. Limited copies may remain temporarily in backups, security records, or records we must preserve by law. Providers may retain data under their own documented retention periods or where needed for safety and legal compliance.
7. Security
We use technical and organizational safeguards designed for the nature of the data and the risk of processing. Current controls include encrypted transport, invite-only passwordless access, expiring login challenges and sessions, rate limiting, secure cookies, user-scoped conversation access, and isolated service credentials. No method of transmission or storage is completely secure. See Security for more detail.
8. International processing
Limitless is based in the United States, and our providers may process information in the United States and other countries. Those countries may have different data-protection laws. Where required, we use recognized transfer mechanisms and contractual safeguards. Enterprise customers may contact us for provider and transfer details.
9. Your privacy rights
Depending on where you live, you may have the right to request access, correction, deletion, portability, restriction, or objection; withdraw consent; or appeal a denied request. You may also have the right to complain to a data-protection authority.
California residents may request to know, correct, or delete personal information and may opt out of sale or sharing. Howard does not sell personal information or share it for cross-context behavioral advertising. We will not discriminate against you for exercising an applicable privacy right.
To make a request, email hello@howard.cx. We may verify your identity and authority before completing it. If your account is managed by your employer or another customer, we may direct a Customer Content request to that organization.
10. Children
Howard is a professional service and is not directed to anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us so we can investigate and delete it where required.
11. Third-party links
Howard may link to standards bodies, manufacturers, databases, publications, and other websites. Their privacy practices are governed by their own policies. Loading web fonts may also send ordinary connection data, such as an IP address, to the font provider.
12. Changes and contact
We may update this policy as the Service, providers, or law changes. We will post the revised policy and update the effective date. We will provide additional notice of material changes when required.
Questions and privacy requests may be sent to hello@howard.cx or Limitless Labs, Inc., 8 The Green, Suite A, Dover, Delaware 19901, United States.