Zero Alpha — Privacy Notice

Effective date: 30 October 2026

1. About this notice

Zero is an AI agent developed by Blade Labs Holdings Private Limited ("Blade Labs", "we", "us"). It helps users complete tasks, access information, interact with websites and connected services, and remember information across interactions.

This Privacy Notice explains what personal information we collect, how Zero processes it, who may access it, and the choices available to you.

Zero is currently an early-access (alpha) product. Some features and privacy protections are still being developed. This notice describes how information is handled during the alpha.

Blade Labs is responsible for personal information processed to operate Zero, subject to the independent responsibilities of connected third-party services.

2. Information we collect

Depending on how you use Zero, we may process:

• Account information: Your name, email address, authentication details and account settings.
• Conversations and instructions: Messages, prompts, files and other content you provide.
• Agent activity: Browser interactions, screenshots, task instructions, outputs and information accessed while completing tasks.
• Connected services: Information accessed through applications you authorize, such as Google Drive, GitHub or other services. This may include information about other individuals.
• Atlas memory: Notes, summaries, files, references and other information retained to help Zero remember and retrieve information.
• Technical and usage information: Device and connection information, usage records, service errors and security events.
• Acceptance records: Records of your acceptance of our Terms of Use, including the versions accepted and the time of acceptance.

We receive this information directly from you, through your use of Zero, from authentication providers and from services you choose to connect.

3. How and why we use your information

We process personal information to:

• Operate Zero and carry out your instructions.
• Maintain Atlas memory and retrieve relevant information across interactions.
• Authenticate users and manage accounts and usage allowances.
• Maintain service security, prevent misuse and resolve technical problems.
• Respond to support requests and improve operational reliability.
• Meet applicable legal and regulatory obligations.

We process information where necessary to provide Zero and fulfil our contractual obligations, pursue legitimate interests in operating and securing the service, comply with legal obligations, or where we have obtained consent for a specific purpose.

Our legitimate interests include maintaining service security, preventing misuse and improving operational reliability, subject to the rights of affected individuals.

Where processing requires consent, we will request it separately, and you may withdraw that consent.

Blade Labs does not use Zero customer content to train its own AI models as part of the current alpha. Any future optional model-training program would require appropriate disclosures and user choices.

4. How Zero handles your information

Chats and screenshots

During the alpha, conversations, browser inputs and screenshots pass through Blade Labs' control-plane infrastructure. This means Blade Labs' systems can technically access this information.

Personal-information masking

Zero uses controls designed to detect and mask personal information before ordinary AI model interactions. However, masking may not identify every sensitive value and does not apply to every processing path.

Atlas memory

Zero uses Atlas to store and retrieve information across interactions. Atlas memory is hosted in Blade-controlled Microsoft Azure infrastructure, outside your individual Zero environment.

Atlas stores real information. During memory ingestion, unmasked content may be sent to a hosted AI model for processing.

External AI applications

If you authorize an external AI application to access Atlas through the Model Context Protocol (MCP), that application may receive real, unmasked information from the Atlas resources it is permitted to access.

Websites and connected services

Zero's browser can access the public internet. When Zero interacts with external websites or connected applications, information necessary to perform your requested task may be shared with those services.

We recommend exercising care when sharing sensitive or confidential information during the alpha.

5. Who we share information with

We use third-party services to operate Zero, including:

• Microsoft Azure for cloud infrastructure, computing and storage.
• WorkOS for authentication and account management.
• AI model providers for processing requests and supporting Atlas functions.
• External websites and applications that you authorize Zero to access.

These providers may receive information necessary for the services they perform. External applications may also process information under their own privacy policies.

We may disclose information where required by law or necessary to investigate security threats, fraud or misuse.

We do not sell personal information or share it with advertisers.

6. How we protect your information

We use access controls, encryption and other security measures designed to protect information handled by Zero.

During the alpha, Blade Labs manages the encryption keys used for hosted Atlas information. Users do not hold their own Atlas encryption keys, and Blade Labs' systems may technically access stored information.

Additional protections, including user-held encryption keys and a blind relay designed to prevent the control plane from reading chat traffic, are planned for future releases.

No security measure eliminates every risk. Users should exercise care when sharing sensitive information or authorizing actions.

7. Where information is processed

Zero uses cloud infrastructure and external AI services that may process information outside your country.

International transfers are subject to applicable data protection requirements, including appropriate transfer safeguards where required.

For further information about processing locations and applicable transfer arrangements, you may contact us using the details below.

8. How long we keep information

We retain personal information for as long as necessary to provide Zero and meet applicable operational, security and legal requirements.

For Guard-managed conversations and related operational content, Zero's retention policy specifies 30 days by default, with a 90-day option where selected. Certain signed operational audit receipts, which contain metadata rather than conversation content, have a 400-day retention period.

Atlas memory and account information are maintained to support your use of Zero, subject to available deletion controls and account closure.

Account closure

During the alpha, the self-service account-closure process requires an export step, through an available download or verified sync to Google Drive or GitHub.

Once account closure is confirmed, access is revoked immediately, and the account-deletion process is designed to remove active hosted account data within 24 hours.

Certain records may be retained longer where necessary for legal, security or compliance purposes. Backups and technical logs may follow separate retention and deletion arrangements.

Closing your Zero account does not automatically delete information already transferred to external websites, connected services or AI applications.

You may also request deletion of your personal information directly, without completing the self-service export process, subject to applicable law.

9. Your privacy rights and choices

Depending on applicable law, you may have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your personal information.
• Object to or restrict certain processing.
• Request a portable copy of applicable information.
• Withdraw consent where processing relies on consent.
• Lodge a complaint with a relevant data protection authority.

You can manage connected-service permissions through the available Zero or provider controls.

To exercise your privacy rights, contact us using the details below. We may need to verify your identity before responding.

10. Changes to this notice

We may update this Privacy Notice as Zero develops or its data-processing practices change.

The current version will be available through Zero. We will provide appropriate notice of material changes and obtain any additional consent required by applicable law.

11. Contact us

For questions about this Privacy Notice or requests relating to your personal information, please contact:

Blade Labs Holdings Private Limited
7 Straits View, #05-01
Marina One East Tower
Singapore 018936
Email: hello@bladelabs.io

We will review your request and respond in accordance with applicable data protection laws.