Privacy Policy
Effective date: April 24, 2026 Last updated: April 24, 2026
This Privacy Policy explains how Ambit Labs Ltd ("Primitiv", "we", "us") collects, uses, and protects personal data when you visit primitiv.design or join our waitlist.
We wrote it in plain language. If anything is unclear, email hello@ambitlabs.ai.
1. Who we are
Ambit Labs Ltd, a company registered in England and Wales (company number 16980164), operates primitiv.design and the Primitiv waitlist. For GDPR purposes we are the data controller for the personal data described below.
- Contact: hello@ambitlabs.ai
- Postal address: Flat 2, 1 Clephane Road, London, England, N1 2TJ
2. What we collect
Waitlist form
When you submit the form at /contact, we collect:
- Name
- Email address
- Role (e.g. Product Designer, Engineering Lead)
- Team size (e.g. Solo, 2–10)
- Pain-point description (free text you provide)
We also record the timestamp of your consent when you tick the opt-in box, to demonstrate lawful basis under GDPR.
Automatically collected
When you visit primitiv.design, we process:
- IP address and user-agent (server-side) for rate-limiting, security, and abuse prevention. Retained up to 30 days.
- Aggregate page analytics via Vercel Web Analytics and Vercel Speed Insights: page visited, referrer, device type, approximate country, anonymous visit counts. Cookieless and not tied to an individual.
- Custom event counts via Vercel Analytics for specific site actions (e.g. waitlist submission). No personal identifiers are included.
When a cookie-consent banner is shown on the site
When a cookie-consent banner is displayed and you choose Accept, we additionally collect product-analytics data via PostHog (EU region):
- Pageviews and in-page interactions (clicks, form submissions — form values are not captured)
- A pseudonymous identifier stored in your browser to understand user journeys across sessions
- Device and browser metadata (screen size, OS, browser)
IP addresses are not stored by PostHog (we configure ip: false). If you choose Reject or your browser signals Global Privacy Control, PostHog is not loaded and no product-analytics data is collected.
When no cookie-consent banner is displayed on the site, PostHog is not active.
3. Why we collect it — purposes and lawful bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Responding to waitlist signups and keeping you informed about Primitiv | Consent — Art. 6(1)(a), via the opt-in checkbox |
| Security, rate-limiting, abuse prevention | Legitimate interests — Art. 6(1)(f) |
| Aggregate, cookieless site analytics (Vercel) | Legitimate interests — measuring and improving the site |
| Product analytics via PostHog (when banner is shown and accepted) | Consent — Art. 6(1)(a) |
4. Who we share it with — processors
We do not sell personal data. We use the following processors, each under a data-processing agreement:
| Processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Loops (Loops Inc.) | Email delivery, waitlist management | United States | EU–US Data Privacy Framework / SCCs |
| Vercel (Vercel Inc.) | Website hosting, Web Analytics, Speed Insights | United States | EU–US Data Privacy Framework / SCCs |
| PostHog (PostHog Inc., EU region) | Product analytics — only when a cookie banner is displayed and consent is given | European Union (Frankfurt) | Intra-EU — no cross-border transfer |
Each processor's privacy documentation:
- Loops — loops.so/privacy
- Vercel — vercel.com/legal/privacy-policy
- PostHog — posthog.com/privacy
5. International transfers
Loops and Vercel are US-based. We rely on the EU–US Data Privacy Framework where applicable and Standard Contractual Clauses (SCCs) to safeguard transfers. PostHog data stays within the European Union.
6. How long we keep your data
- Waitlist data — until you withdraw consent, or 24 months of inactivity, whichever comes first.
- Security logs (IP, user-agent, request metadata) — 30 days.
- Aggregate analytics in Vercel and PostHog — each provider's default retention window (typically 12 months rolling).
- Consent records (opt-in timestamp) — as long as we hold the underlying data, to demonstrate lawful basis.
7. Your rights
Depending on where you live, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your data (right to be forgotten)
- Object to processing based on legitimate interests
- Port your data to another provider
- Withdraw consent at any time (withdrawal does not affect processing that already occurred)
- Lodge a complaint with your local data-protection authority
To exercise any right, email hello@ambitlabs.ai. We respond within 30 days.
8. California privacy rights (CCPA / CPRA)
If you are a California resident, you have the right to:
- Know what personal data we have collected and how we use it
- Delete personal data we hold
- Correct inaccurate data
- Opt out of "sharing" — although we do not "sell" personal data as defined by CCPA, certain analytics may constitute "sharing" under CPRA. Where a cookie-consent banner is shown, choose Reject to opt out.
- Limit use of sensitive personal information — we do not collect sensitive categories
- Non-discrimination — exercising your rights does not change your access to the site
We honor the Global Privacy Control (GPC) signal. If your browser sends GPC, we treat it as an opt-out of analytics automatically.
To make a request, email hello@ambitlabs.ai. We verify identity via the email associated with your waitlist record when applicable.
9. Children
primitiv.design is not directed at children. We do not knowingly collect personal data from anyone under 16 (GDPR) or under 13 (COPPA). If you believe a child has submitted data, email us and we will delete it.
10. Cookies and similar technologies
Strictly necessary (always active)
Session or preference cookies required for the site to function. No consent needed.
Aggregate analytics — cookieless (always active)
Vercel Web Analytics and Vercel Speed Insights — no cookies, no individual identifiers, aggregate data only. Processed under legitimate interests.
Product analytics (only when you consent)
PostHog (EU region) — stores a pseudonymous identifier in your browser to measure pageviews and interactions. Loaded only after you accept on the cookie-consent banner. Cleared when you change your choice.
You can change your cookie preferences at any time via the "Cookie preferences" link in the site footer when the banner is active.
11. Changes to this policy
We may update this policy from time to time. Substantive changes will be communicated by email (if you are on the waitlist) or posted on this page with an updated effective date. Please review it periodically.
12. Governing law and how to contact us
This policy is governed by the laws of England and Wales. Nothing in it limits the rights granted to you by mandatory consumer-protection laws in your place of residence.
- Email: hello@ambitlabs.ai
- Postal: Flat 2, 1 Clephane Road, London, England, N1 2TJ