Studio Launch Signup — Privacy Notice

Effective: October 29, 2026

This notice covers the signup form at crystalpalacelabs.ai/signup ("the form"). The form is operated by Crystal Palace Labs, Inc. ("we", "us"), the maker of Crystal Palace Studio.

In short: when you sign up, we store the information you submit, exactly as you submitted it, so we can tell you when Crystal Palace Studio launches. We keep it on Google Cloud, a copy goes to our team's mailbox, we never sell it, and you can ask us to delete it at any time.

1. What we collect

When you submit the form, we store:

• your first name, last name and email address (required);
• your company or organization and phone number, if you give them;
• your message to our team, if you write one (up to 1,000 characters);
• a record of your consent: that you ticked the box, when, and which version of the consent text and of this notice you saw;
• that you came to the form from Yong's site (holistic-path.ai);
• the time of your first and latest signup, and how many times you signed up with the same email address.

We store your information as you submitted it. We do not check or enrich it with other sources.

What we do not collect: the form uses no cookies, no analytics, no advertising trackers and no browser storage, and loads nothing from other companies. We do not store your IP address. To limit abuse, our service turns your IP address into a scrambled code with a random key that changes every day. The codes are kept only in the service's working memory and are never written to storage. The hosting platform's own request log for the signup service, which would hold IP addresses, is switched off.

2. Why we use it

• To email you when Crystal Palace Studio launches: one launch notice. We do not use your details to send you other news.
• For our team to read and, where useful, answer your message if you wrote one (a person on our team reads it; Clarity does not).
• To keep the form working and protect it from abuse.

We do not use your information for advertising, we do not combine it with information from other sources, and we do not use it to train AI models.

Legal basis (where laws such as the GDPR apply): your consent, given by ticking the box. You can withdraw it at any time (section 8). Withdrawing does not affect anything done before.

3. Where it is stored

• The form sends your information over an encrypted connection (HTTPS) to our service on Google Cloud Run, in our own Google Cloud project.
• The service saves it in Google Cloud Firestore, a database in the same project, in Google Cloud's us-west1 (Oregon, USA) region.
• Google acts as our service provider (data processor) under Google Cloud's data processing terms. Google does not use our stored data for its own purposes.
• We do not keep backups or point-in-time copies of the signup database, so when we delete a record, it is gone from the database.

4. The email copy to our team

Each signup is also copied, in an email, to our team mailbox clarity@crystalpalacelabs.ai, hosted by Google Workspace. This means your information exists in two places: the database and that mailbox. Both are covered by this notice: the same retention period applies, and a deletion request covers both.

The copy is sent by our own scheduled job, on our own computer, which reads new signups and mails each one through our own mail tool and our Google Workspace account. No other company is involved in sending it. The copy can take up to about 15 minutes to arrive. It goes only to clarity@crystalpalacelabs.ai.

5. Who can see it

• Our team at Crystal Palace Labs who work on the Studio launch.
• Clarity, the Crystal Palace Labs team's AI Personal Assistant, which runs our team mailbox. Signup copies are moved by automated, rule-based steps and are kept out of Clarity's reading: Clarity never reads or summarizes signups. If you email clarity@crystalpalacelabs.ai directly, your email may be read by Clarity, our AI Personal Assistant, which runs on Anthropic's Claude under Anthropic's commercial terms, which do not allow Anthropic to train its models on our data.
• Our service providers, only to run the form and the mailbox: Google (Google Cloud and Google Workspace). No email delivery company is used.
• Others only if the law requires it, or to protect our rights or the safety of others. If Crystal Palace Labs is merged or sold, the signup list moves with the company under this same notice.

6. We don't sell it

We do not sell or share your personal information, including as those terms are used in California law. We do not give it to advertisers or data brokers.

7. How long we keep it

We keep your information no longer than 18 months after your latest signup, and everything is deleted within 90 days after we send the launch notice, whichever comes first. Records are then deleted automatically (normally within a day of their expiry date). The email copies in our team mailbox are deleted on the same schedule by a mailbox retention rule. If you ask us to delete your information sooner, we do (section 8).

8. Unsubscribe, deletion and your rights

• Delete or unsubscribe at any time: email clarity@crystalpalacelabs.ai from the address you signed up with, and ask us to delete your signup. To protect you, we act only on a request sent from that address. We then delete your record from the database, and a member of our team deletes the email copy from our mailbox, within 30 days, and tell you when it is done. We keep no list of deleted addresses: once deleted, your details are gone. If you sign up again later, that is a new signup.
• We send you no confirmation email when you sign up. The launch notice will include a link to unsubscribe, which deletes your signup.
• You can also ask us what we hold about you, or correct it. Signing up again with the same email address updates your record.
• Depending on where you live (for example California, the EEA or the UK), you may have further rights, such as to object or to complain to your data protection authority. We will not treat you differently for using them.
• We respond within 30 days.

9. Security

We use encrypted connections, keep the database closed to the public internet except through our signup service, limit access to the people and systems named above, and use no passwords or keys that could be copied from our code. No system is perfectly secure, but we take care to protect your information.

10. Age

The form is only for people aged 16 or older (the same minimum as holistic-path.ai); the consent box asks you to confirm "I am 16 or older." We do not knowingly collect information from anyone under 16. If you believe a child under 16 has signed up, write to us and we will delete it.

11. Visitors outside the United States

The form is available worldwide. Your information is stored and processed in the United States (section 3), and our team mailbox is hosted by Google Workspace. Where the GDPR or UK GDPR applies, we rely on your consent (section 2).

12. Changes to this notice

If we change this notice, we will post the new version on this page with a new effective date. If a change is material, we will email you before it applies to information you already gave us, since we have your address.

Contact

Questions or comments? Write to Clarity, the Crystal Palace Labs team's AI Personal Assistant, at clarity@crystalpalacelabs.ai. Clarity passes every message to our team.