Kameleon

Privacy Policy

Last updated: 14 February 2026

At Kameleon Labs (AscendLabs OU) we are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (GDPR, Regulation EU 2016/679) and Estonian data protection legislation (Isikuandmete kaitse seadus — IKS).

1. Data Controller

  • Legal name: AscendLabs OU
  • Trading as: Kameleon Labs
  • Registry code: 17145085
  • Registered address: Seebi tn 1-1501, Kristiine linnaosa, Tallinn, Harju maakond, 11316, Estonia
  • Contact email: hello@kameleonlabs.ai
  • Data Protection Officer (DPO): privacy@kameleonlabs.ai

2. Data We Collect

We process the following categories of personal data:

a) Account data

Name, email address, company name, job title, and password (stored as a hash) that you provide when you register or contact us.

b) Usage data

Information about how you interact with our platform: pages visited, features used, date and time of access, and session duration.

c) Technical data

IP address, browser User-Agent, operating system, device type, and connection data collected automatically when you access our services.

d) Cookies

Identifiers stored in your browser. Please refer to our Cookie Policy for further details.

3. Purposes of Processing

We process your data for the following purposes:

  • Service delivery: creating and managing your account, providing access to the AI Agents platform, and delivering technical support.
  • Marketing communications: sending you product updates, news, and relevant content (only with your prior consent).
  • Analytics: analysing website and platform usage to improve the user experience (Vercel Analytics, only with your consent).
  • Security: detecting and preventing unauthorised access, fraud, and security threats, and complying with our legal obligations.

The processing of your data is based on the following legal bases (Art. 6 GDPR):

  • Performance of a contract (Art. 6(1)(b)): necessary for providing the service you have contracted or requested.
  • Consent (Art. 6(1)(a)): for marketing communications and analytics cookies. You may withdraw your consent at any time.
  • Legitimate interest (Art. 6(1)(f)): to ensure the security of our systems, prevent fraud, and improve our services.
  • Legal obligation (Art. 6(1)(c)): when necessary to comply with applicable legislation.

5. Recipients of Data

Your personal data may be disclosed to the following recipients:

  • Amazon Web Services (AWS) — Data processor. Our servers are located in the eu-west-3 (Paris, France) region, within the European Economic Area (EEA).
  • Vercel Inc. — CDN and analytics provider for the corporate website.

We do not sell or share your personal data with third parties for commercial or advertising purposes.

6. International Data Transfers

Our primary infrastructure is located in AWS eu-west-3 (Paris, France), within the EEA, which does not constitute an international data transfer.

Vercel Inc., based in the United States, may process certain data (such as analytics and web traffic data) outside the EEA. These transfers are safeguarded by Standard Contractual Clauses (SCCs) approved by the European Commission, which ensure an adequate level of data protection.

7. Retention Periods

We retain your personal data for the following periods:

  • Account data: for the duration of the contractual relationship and, thereafter, for the legally prescribed limitation periods.
  • Access and security logs: 12 months from generation.
  • Analytics data: 26 months from collection.

Once these periods have elapsed, the data will be deleted or irreversibly anonymised.

8. Your Rights

Under the GDPR, you may exercise the following rights in relation to your personal data:

  • Access: obtain information about what personal data we process about you.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: request the deletion of your data when it is no longer necessary for the purpose for which it was collected.
  • Objection: object to the processing of your data in certain circumstances.
  • Portability: receive your data in a structured, commonly used, and machine-readable format.
  • Restriction: request the restriction of processing in certain situations.

To exercise any of these rights, please contact us at privacy@kameleonlabs.ai. We will respond to your request within a maximum of 30 days.

If you believe your rights have not been adequately addressed, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): www.aki.ee.

9. Cookies

Our website uses essential cookies and, with your consent, analytics cookies. For detailed information about the cookies we use, their purposes, and how to manage your preferences, please refer to our Cookie Policy.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page with the date of the last update. We recommend reviewing it periodically. If the changes are significant, we will notify you by email or through a notice on the platform.