Privacy Policy

Effective date: October 26, 2026
Controller: nudgIQ Inc., doing business as Tier3 Labs (“Tier3 Labs”, “we”, “us”, “our”).

This policy explains how we handle personal information when you visit tierthree.ai, contact us, evaluate or buy our services, or otherwise interact with us. It applies to the personal information of visitors, prospective customers, customers and their personnel, and business contacts. It does not apply to information we process on a customer’s behalf under a signed agreement, which is governed by that agreement.

Our environments contain no real personal data. The companies, people, tickets, records and configuration inside every Tier3 Labs environment are fictional and generated from a fixed seed. We do not collect, scrape or license support transcripts, customer records or other personal data to build them, and we check generated names against the public record so that they do not refer to real organizations.

1. Information we collect

Information you give us. When you submit a contact form, email us, book a call, or sign an agreement, we collect what you provide: your name, work email address, organization, role, the content of your message, and anything else you choose to share. During an evaluation or engagement we may also collect the names, email addresses and roles of the people we work with.

Information collected automatically. When you visit the Site, our hosting provider records standard server logs: IP address, browser type and version, operating system, referring page, pages requested, and the date and time of each request. We use these for security, debugging and aggregate traffic measurement. We do not run analytics scripts, advertising pixels or social-media trackers on the Site.

Spam protection. Our contact form may use Cloudflare Turnstile to distinguish people from bots. When it is enabled, Cloudflare processes your IP address, browser signals and a short-lived token under Cloudflare’s privacy policy. The form also includes a hidden field that only automated submitters fill in; a filled-in field causes the submission to be discarded.

Cookies. The Site does not set cookies of its own. Turnstile may set a functional cookie needed to complete its check. We do not use cookies for advertising or cross-site tracking. Because we do not track visitors across sites, there is nothing for a “Do Not Track” or Global Privacy Control signal to switch off; we honor the signal by default.

Information from other sources. If you contact us or we contact you in a business context, we may look up publicly available professional information, such as your role and organization, to understand your inquiry. We do not buy personal data from data brokers.

2. How we use information

We use personal information to:

• respond to inquiries, schedule calls and follow up on conversations you have started with us;
• evaluate whether and how we can work together, scope and prepare proposals, and perform agreements;
• send service-related messages, such as a confirmation that we received your inquiry;
• send occasional messages about our services to business contacts who have inquired, where permitted by law, with an opt-out in every message;
• operate, secure and improve the Site, including detecting and preventing spam, abuse and security incidents;
• comply with legal obligations, enforce our terms, and establish, exercise or defend legal claims; and
• keep business records.

We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not use it to train machine-learning models.

3. Legal bases (EEA, United Kingdom and Switzerland)

Where the General Data Protection Regulation or the UK GDPR applies, we rely on the following legal bases: performance of a contract or pre-contractual steps you have asked for, when we respond to your inquiry and prepare or perform an agreement; legitimate interests, when we secure the Site, keep business records, understand who is contacting us, and communicate with business contacts about our services, balanced against your rights; legal obligation, when the law requires us to keep or disclose information; and consent, where we ask for it, which you may withdraw at any time.

4. Who we share information with

We share personal information only as described here.

• Service providers that process information on our behalf and under contract, limited to what is needed to provide their service: website hosting and server logs (Vercel), transactional email delivery (Resend), form storage (Neon), DNS, spam protection and network security (Cloudflare), business email and documents (Google Workspace), and, where we schedule a call, the scheduling tool we link to.
• Professional advisers, such as lawyers, accountants and insurers, bound by confidentiality.
• Legal and safety, where disclosure is required by law, subpoena or court order, or is reasonably necessary to protect the rights, property or safety of Tier3 Labs, our customers or the public.
• Business transfers, if we are involved in a merger, acquisition, financing or sale of assets, in which case we will require the recipient to honor this policy.

We do not share personal information with third parties for their own marketing.

5. Retention

We keep inquiry details and correspondence for as long as the conversation is active and for up to three years after our last contact, so that we can recognize you if you return and keep business records. Information relating to a signed agreement is kept for the term of the agreement and for the period afterwards required by tax, accounting and limitation rules, typically seven years. Server logs are kept by our hosting provider for a short rolling period. We delete or anonymize information sooner on request where we have no overriding legal reason to keep it.

6. Security

We protect personal information with measures appropriate to its sensitivity, including encryption in transit, access limited to the people who need it, hosted services with independent security certifications, and multi-factor authentication on our accounts. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information we will notify you and the relevant authorities as required by law.

7. International transfers

We are based in the United States and process information there. If you are in the EEA, the United Kingdom, Switzerland or another jurisdiction with data-transfer rules, your information will be transferred to the United States and to the countries where our service providers operate. Where required, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, and our service providers commit to equivalent safeguards. You may ask us for a copy of the relevant safeguards.

8. Your rights

Depending on where you live, you may have the right to access the personal information we hold about you, to correct it, to delete it, to receive a portable copy, to restrict or object to certain processing, to withdraw consent where processing is based on consent, and to opt out of marketing messages. You also have the right not to be discriminated against for exercising these rights.

To exercise a right, email us at the address below from the email address we hold for you, or tell us how we can verify that the request is yours. We respond within the period required by applicable law, generally within 30 days, and within 45 days for California residents. You may authorize an agent to make a request on your behalf; we will ask for evidence of the authorization. If we decline a request we will explain why, and you may ask us to reconsider.

California. Under the California Consumer Privacy Act, in the past twelve months we have collected the categories of personal information described in section 1 (identifiers, professional information, internet activity, and the contents of your communications) for the purposes in section 2, from the sources in section 1, and disclosed them to the service providers in section 4. We do not sell or share personal information as those terms are defined in California law, and we have not done so in the past twelve months. We do not use or disclose sensitive personal information to infer characteristics about you.

EEA, United Kingdom and Switzerland. You may lodge a complaint with your local supervisory authority. We would appreciate the chance to address your concern first.

Other US states. Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with privacy laws have similar rights, including the right to appeal a decision we make about your request, by emailing us at the address below.

9. Marketing communications

If you have inquired about our services, we may follow up by email about those services. Every marketing message includes a way to opt out, and you can opt out at any time by replying to the message or emailing us. Opting out does not affect service-related messages, such as replies to a question you asked.

10. Children

The Site is for business use and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. We will post the revised version here with a new effective date, and, for material changes, we will tell existing business contacts by email or a notice on the Site before the change takes effect.

Contact

nudgIQ Inc., doing business as Tier3 Labs

We have not appointed a data-protection officer or an EU or UK representative, because our processing does not require one. Privacy questions sent to the address above reach the people responsible for this policy directly.