Privacy policy

Last updated: 13 October 2026 · Effective: 21 July 2026

Who we are

This website is operated by 8Hats Lab Inc., a Delaware corporation (United States) — the entity responsible for the personal data described on this page. Services in Singapore are provided by 8Hats Lab Pte. Ltd. (UEN 202613872E, 68 Circular Road, #02-01, Singapore 049422) — when you engage us there, your client and contract data sits with that entity. One team runs both, out of Singapore and Silicon Valley, and the same person answers for privacy across the two: see below.

8Hats Lab Inc.
131 Continental Dr, Suite 305
Newark, DE 19713-4324
United States

Privacy questions or requests: hello@8hats.ai. A real person answers.

Our Data Protection Officer is Dmitriy Istomin, who is also our chief executive — at our size the person accountable for privacy should be the person who can actually change what we build. Reach the role at hello@8hats.ai, or write to the postal address above marked for the attention of the Data Protection Officer. This designation is made for the purposes of Singapore's Personal Data Protection Act, and the same person handles privacy questions wherever you are.

This policy covers 8hats.ai, its inquiry forms, and the free and paid ask research services described below. Our sister product sites agents.university and agentscoworking.com are separate properties. Third-party websites and payment providers also have their own privacy policies.

Ask research services and payments

For ask, the responsible seller and organization handling your service data is 8Hats Lab Pte. Ltd., UEN 202613872E, 68 Circular Road, #02-01, Singapore 049422. Contact sales@8hats.ai about orders; privacy and data-rights requests also reach our Data Protection Officer at hello@8hats.ai.

The /ask form collects your work email, optional phone number and name, and company details and research criteria. Your phone number is used only to contact you about your request. When server delivery is enabled, we first send you a confirmation email with a link via Resend. Opening the link confirms the request and sends it via Resend to 8Hats Lab’s mailbox. The link expires after seven days. If you ignore the email, the request is not sent to the mailbox and no research starts. When server delivery is disabled, the form composes the request in your email app for you to send.

The confirmation link contains signed request details; anyone with the link can read and confirm them. Keep it private. The confirmation page is excluded from website analytics. The link uses a URL fragment, which browsers do not send in HTTP requests. Google Cloud request logs and Resend delivery logs may hold request metadata; Resend also processes and may retain confirmation links and email contents according to its service and account settings.

We process your name and email, company details, research criteria, correspondence, materials you provide, orders, reports, usage and delivery records, and payment and refund references. We use these to prepare research, deliver it, administer your order, prevent abuse and resolve corrections, complaints and refunds.

Research uses AI and public business sources. Relevant task text, documents and research context may be processed by OpenAI, Anthropic and Google, depending on the tools used for your task. Search queries may be sent to research and search providers, including Google and Exa. Google Workspace processes service email. Resend delivers ask request confirmation and relay emails. These services, including Resend, may process data outside Singapore; provider storage and retention depend on the service and account settings. Do not send passwords, card details or sensitive personal data unnecessary for the task.

Airwallex processes payments on its hosted payment pages. It receives the information you enter there and processes it under its privacy policy. We receive order and transaction references, amounts, currency, payment status and refund information needed to administer the service. We do not collect full card numbers or card security codes through the ask request form or email order process.

An AI agent prepares and sends reports automatically; people do not proofread each report. We use service data to carry out your request, not to make decisions with legal or similarly significant effects about you. Public business contact details in research come from cited public sources, and are not permission to send marketing to those contacts.

Ask service records are separate from the website inquiry records and their deletion periods below. They are retained for ongoing service and order administration until you request deletion; they are not automatically erased after an inquiry's review period. To request deletion, email ask@8hats.ai from the address you used for the service. We verify the request before deleting service content. Records needed for payments, accounting, disputes or legal duties may have to be retained; we explain any exception when handling your request. Email providers and backups have separate deletion processes, so a service deletion is not a claim of immediate removal from every backup or provider.

For paid orders, we process data to take steps at your request and perform the service contract, and to meet applicable accounting and legal duties. The research and payment providers above are additional to the website providers listed below. Your rights and our contact procedure below apply to ask as well.

What we collect

• Email you send us. Several contact points on this site are a plain email link. When you write to us — to ask about working together, request a consultation, or propose a collaboration — we get your email address and whatever you choose to write. It lands in our email provider's systems.
• What you enter in the general inquiry form. The form on /contact — the same form also appears at the foot of /for-hr-leaders — sends your name, email address, your message and the optional organisation you give to our own Network Keeper intake system. It carries the page and the allowlisted campaign parameters that brought you there and how long you took to complete it. It asks you to acknowledge this notice before sending, and it offers one optional tick: "Send me research updates". Leaving it unticked changes nothing else about your request.
• What you enter in the research request. The form on /research sends the research stream you choose, your email address, your message and the optional name and organisation you give to the same intake system, with the same page and campaign parameters. It also asks you to acknowledge this notice before sending.
• What you enter in the Executive Education inquiry. The form on /for-executive-education sends your email address and the optional name and organisation you give to the same intake system. The Lab overview PDF is delivered through this form: we email a link to the overview to the address you give. The page confirms receipt of the request without displaying a download link. Your email address is the only required field, and it is used for that document delivery and for a reply to your inquiry. There is no acknowledgement checkbox on this form and no subscription behind it.
• What you enter in the first-process inquiry. The form on /for-ceo sends your full name, work email, organisation, role, company size, the process you want to improve, a description of that process and whether you use agents today. Your LinkedIn URL is optional. It carries the page and allowlisted campaign parameters and has no acknowledgement checkbox or subscription behind it.
• What you enter in the design-partner application. The form on /design-partners sends your full name, work email, organisation, role, company size and the document you would bring to the pilot. Your description of the current process and LinkedIn URL are optional. It carries the page and allowlisted campaign parameters and has no acknowledgement checkbox or subscription behind it.
• What the six form definitions do. They do not store your IP address: the intake service recognises repeat abuse through a keyed fingerprint of the network request instead, which is enough to recognise a source and not enough to reconstruct an address. A normal inquiry receives an acknowledgement email and is available for a person to review and reply to. A PDF request link sends a separate document-delivery email for the requested document. Each message is addressed to the email you provide and carries an internal BCC to di@8hats.ai for handling. The submitted inquiry details are also sent to sales@8hats.ai through Resend for internal review. No form subscribes you to anything on its own.
• Ordinary server logs. Our web host records standard request logs — IP address, browser type, page, timestamp — as every web server does. We don't profile them, connect them to you, or use them for anything but keeping the site up.
• The country your network appears to be in. On one page pair only — /consulting and /consulting-sg — we read the country our network provider derives from your IP address, so a visitor in Singapore lands on the Singapore page. It is read from the request and used to redirect; it is not stored, not written to a cookie, and not attached to anything else about you.
• Measurement. One third-party analytics script, and no advertising scripts. The full list is below — no guessing required.

Cookies and measurement

Here is every cookie we set and every third-party script we load, as of the date at the top of this page. We keep this table current: if we add or change anything that sets a cookie or loads a third-party script, we update this table and move the date.

Where each runs. PostHog runs on every page 8hats.ai renders through the site application. It does not run on this page or on the terms page: those two are plain HTML files served as they are, with no script of any kind. That is the whole list. We removed PostHog and Google Analytics site-wide on 21 July 2026; in August 2026 we brought PostHog back for the consulting and founder pages and added Google Ads, LinkedIn and Reddit tags to a handful of pages. With the September 2026 rebuild of this site, the advertising tags are off everywhere and PostHog is the single remaining third party.

Your choice

When a test runs, we set the ab cookie without asking, on the view that remembering which version of a page you saw is a functional use rather than tracking. We should be honest that a regulator could take a narrower view: it serves our testing, not something you asked for. Deleting it, or blocking cookies for this site, costs you nothing and breaks nothing — and while no test is running we do not set it at all.

What you can do today. There is no cookie banner on this site. The only thing a banner would gate is PostHog, which loads for everyone. We are not going to describe that as a choice we offered you: it is one script we have not yet put behind consent. What does work right now: any standard content blocker, or blocking third-party scripts in your browser, stops it. The site's content, every form and every contact link keep working. A blocker is genuinely the reliable route: because we don't know who you are as you browse, there is no name or address for us to exclude at our end. If you have written to us or sent one of the six forms, then we do hold data tied to you — email hello@8hats.ai and we will delete it and stop processing it.

We run PostHog session recording and heatmaps as described above, with every form input masked. We do not run keystroke capture, advertising pixels, or data brokerage, and we never exchange your personal information for money.

Do Not Track and Global Privacy Control

Browser Do Not Track was never agreed as a standard and this site does not act on it. Global Privacy Control (GPC) is different — it is a recognised opt-out signal under California and several other US state laws — and this site does not currently detect or act on it either. We would rather tell you that than claim a control we haven't built. We are implementing GPC handling; when it is live, this page will say so, and not before. In the meantime any standard content blocker stops the one analytics script above completely, and that is the control we would actually point you to.

How we use it

• To read your inquiry and reply to you, as a person, using the address you gave.
• To review and answer research, Executive Education, first-process and design-partner inquiries.
• To understand who's interested and what they need — which shapes what we build.
• To see which pages actually work, in aggregate.
• We don't send you anything you didn't ask for or agree to. If you tick the optional research-updates box on the contact form, any update we send has a one-click unsubscribe. If you request free sales leads on 8hats.ai/ask, sending the request means you agree to emails from us about your request and related offers; you can opt out at any time by replying or emailing hello@8hats.ai.

You don't have to give us anything

There is no account to create, and reading the pages of this site requires no personal data. The one document we send rather than link is the Lab overview PDF on /for-executive-education, which we email to the address you give. Giving us your email is voluntary — no law and no contract requires it. Without your email, we cannot reply, send the requested document or deliver an ask service.

What we send you, and leaving the list

A normal inquiry triggers an acknowledgement email and is read by a person at 8Hats who may reply to you. A PDF request link triggers the separate document-delivery email for the document you named. The submitted inquiry details are also sent to sales@8hats.ai through Resend for internal review, with an internal BCC to di@8hats.ai. Neither visitor-facing message is a drip sequence, and neither adds you to a list.

For the contact form, updates require a box you tick yourself: "Send me research updates" on the contact form. Tick it and we may write to you when we publish something; every such email has a one-click unsubscribe, and leaving changes nothing else — we'll still answer if you write to us. Leave it unticked and that contact inquiry does not subscribe you to updates. Separately, a free ask request includes agreement to emails about the request and related offers, as described above; reply to opt out at any time.

Where your data comes from

Website inquiry and browsing data comes from you directly or from your browser. Ask research also uses cited public business sources, and order records include payment and refund information from the payment provider. We don't buy contact lists, and we don't append data about you from brokers. If we are preparing for a conversation you asked for, we may read what you or your company have published publicly — a website, a public profile, a paper — the same way any person would before a meeting. We don't build a profile on you from that, and we don't merge it into an advertising audience.

Who else sees it

Our providers are: our web host, Google Cloud (site hosting and server logs); our email provider (the mail you send us); Resend (acknowledgement, requested-document, internal owner-notification, and ask request confirmation and relay email delivery); PostHog (product analytics, as described in the table above); and Network Keeper, our own intake system running on our Google Cloud account, which holds what you send through the six forms. No advertising network receives anything from this site. Ask additionally uses the research and payment providers described in its service section above.

Beyond those providers, nobody else receives your data — with two honest exceptions. If we are legally required to hand something over under a valid court order or lawful demand, we will, and we will tell you unless we are barred from doing so. And if 8Hats Lab is ever acquired or merged, your data moves with the business, along with the promises on this page, which bind whoever ends up holding it. We do not sell it to anyone.

How we protect it

The site is served over HTTPS. The mail you send us sits in our email provider's systems, reachable only by the handful of people at 8Hats who need it, on accounts with two-factor authentication. We deliberately keep the number of systems holding your data small — that is the main control, and it is a real one.

No system is perfectly secure and we will not pretend otherwise. If a breach ever puts your data at risk, we will notify the relevant regulator within 72 hours where the law requires it, and we will email you directly rather than post a notice and hope you see it.

How long we keep website inquiry data

• Email you send us: while the conversation is live, and up to 24 months after the last message, then deleted — sooner if you ask, longer only if we need it for a live engagement or a legal claim.
• Research-update addresses: until you unsubscribe, and no more than 24 months after the last update we sent.
• Executive Education inquiries: up to 90 days while under review. If accepted, they may be kept for up to 180 days as part of that relationship; rejected inquiries are deleted within 90 days. We delete sooner if you ask, unless a live agreement or legal duty requires a narrow record.
• Contact and research requests: up to 90 days while the request is under review. If it becomes a working relationship, we may keep it for up to 180 days as part of that relationship; rejected requests are deleted within 90 days and spam within 7 days. We delete sooner if you ask, unless a live agreement or legal duty requires a narrow record. A scheduled job runs daily and enforces these periods; it is not a promise we keep by hand.
• First-process and design-partner requests: up to 90 days while under review. If accepted, they may be kept for up to 180 days as part of that relationship; rejected requests are deleted within 90 days and spam within 7 days. We delete sooner if you ask, unless a live agreement or legal duty requires a narrow record.
• Server logs: our host's standard rotation window, which we are confirming and will state here.
• Cookies and analytics: the periods in the table above.

Your rights

Email hello@8hats.ai to see, correct, export, delete or restrict anything we hold about you, to object to how we use it, or to withdraw consent you've given. No process theatre — we will do it, or tell you plainly why we cannot. We answer within one month, as Article 12(3) GDPR requires, and within 45 days where US state law sets that clock. If a request is complex, or you have made several, we may extend — we will tell you inside the first period, and why. Two honest caveats: we may ask a question or two to check the request really comes from you, and we may have to keep a narrow slice of data where the law or a signed agreement requires it, in which case we will say exactly what and why. If someone is asking on your behalf, say so and we will handle it. We do not use automated decisions with legal or similarly significant effects about you. Ask reports are generated automatically as described above. We won't treat you differently for asking.

If you are unhappy with how we handled it

Write to hello@8hats.ai and say so. We will look again and answer in writing within 45 days, with our reasons if we still say no. Several US state laws give you that right of appeal; we extend it to everyone.

If you're in the EU or the UK

For general website data, 8Hats Lab Inc. is the data controller; for ask service data, it is 8Hats Lab Pte. Ltd. Our legal bases for website inquiries are:

• Consent (Art. 6(1)(a) GDPR) when you acknowledge this notice and send a contact or research request, when you send a free sales leads request from 8hats.ai/ask, when you send an Executive Education inquiry, or when you tick the optional research-updates box — you can withdraw it at any time by replying or emailing hello@8hats.ai. Withdrawing doesn't affect anything we did before you withdrew.
• Legitimate interest (Art. 6(1)(f)) in answering you when you write to us, and in keeping the site secure and available.
• The PostHog script has no consent basis today. Under Article 5(3) of the ePrivacy Directive it needs your prior consent, and there is no consent banner on this site, so we are not going to claim a legal basis we don't have. We have narrowed the problem rather than written around it: the advertising tags this site used to load are switched off, leaving one analytics script. Until a consent mechanism ships, a content blocker stops it at your end — which is the only reliable control available to you meanwhile.

You have the rights of access, rectification, erasure, restriction, portability and objection.

8Hats Lab Inc. is a US company with no establishment in the EU or the UK. When you email us or visit this site, we collect your data directly in the United States — under Article 3(2) GDPR that is a direct collection, not a transfer out of the EEA. Where we pass data to providers, Google LLC and PostHog are US companies. We rely on the EU-US Data Privacy Framework and its UK Extension where a provider is certified under it, and on the European Commission's Standard Contractual Clauses where it is not. Ask us at hello@8hats.ai for a copy of the safeguards that apply. You may complain to your supervisory authority — in the EU your national authority, in the UK the ICO (ico.org.uk). You do not have to come to us first. We would just rather you did, so we can fix it.

If you're in California or another US state

We never exchange your personal information for money, and this site no longer loads any advertising tag — so there is nothing here we would describe as "sharing" for cross-context behavioural advertising. You have the right to know, delete, correct, take your data with you, and opt out. For anything we hold that is tied to you — mail you have sent us, an inquiry you submitted — email hello@8hats.ai and we will act on it. On the analytics script we have to be straight with you: we do not yet detect Global Privacy Control, and while browsing you are anonymous to us, so there is no request we could apply at our end. A content blocker stops it outright, and that is the working opt-out until GPC handling ships. When it does, this page will say so.

In the categories California law uses, we collect identifiers (the email address you write from or give a form, your name and organisation if you give them, and your IP address in ordinary server logs), commercial information (that you sent an inquiry, a research request, an Executive Education inquiry, a first-process inquiry or a design-partner application), and internet activity (which pages you read on this site). We collect them from you directly and from your browser, for the purposes and periods set out above. We do not collect sensitive personal information as California law defines it, and we do not knowingly sell or share the personal information of anyone under 16.

Children

This site is for professional audiences. We don't knowingly collect data from anyone under 16. If you think a child has written to us, tell us and we'll delete it.

Research data and diagnostic engagements

Published datasets. We publish research datasets on Zenodo. Each is de-identified before release, and the method used is documented in that dataset's own Zenodo record — read the record, not this page, for what a given dataset contains. Our published datasets come from our own products and our own operations — not from client engagements. Where a future dataset ever does derive from client work, we would publish it only under the terms of our agreement with that client, and we would say so in the record. If you believe a published dataset contains something that identifies you, write to hello@8hats.ai: we will act on it, including pulling the record while we check.

Diagnostic engagements. A paid diagnostic runs on a separate written agreement between 8Hats Lab and the client organisation, and that agreement governs the evidence collected during it. Those terms sit alongside this page — they add detail about a specific engagement, they don't replace the rights described here. If you took part in a diagnostic at your employer and want to know what we hold about you, write to us: we will tell you what we have and route you to the right place, rather than leave you guessing.

When the self-check ships, we may publish aggregate statistics from it — for example the distribution of results. Never anything that identifies you or your organisation. If that changes, this page changes first.