Data Collection & Processing
Effective date: July 15, 2026
A developer-facing companion to the Privacy Policy: precisely what Estelle collects, where each piece flows, which sub-processors touch it, and the concrete controls to get it out or delete it. If you only read one privacy document, read the policy; if you want the data map, this is it.
What this is
This notice describes the actual data flow through Estelle so a security reviewer or a privacy-conscious developer can evaluate it quickly. It is consistent with, and subordinate to, the Privacy Policy.
Data categories
Estelle handles five categories of data. Nothing else is collected.
Where data flows
The path a request takes:
- Your agent or tool calls Estelle over MCP or the OpenAI-compatible API at
api.fatelabs.ca/v1with your account key. - Estelle retrieves the grounded slice of your namespace, then calls your model provider using your decrypted provider key, for that request only.
- The model's response passes back through Estelle's grounding and verification, and the cited answer returns to you.
- Derived memory is written back under your namespace so recall works next session. Usage metadata is recorded for metering.
Note. The prompts and code sent onward to your model provider are governed by that provider's data terms. Estelle transmits them to reach the model you chose; it never adds itself, or anyone else, as a recipient for training.
In transit, all traffic to and from Estelle is served over TLS. At rest, your data lives in our providers' encrypted storage, and your BYOK provider key is additionally encrypted by Estelle before it is written to the database, so the database only ever holds ciphertext.
Controller vs processor
For your account and billing data, Fate Labs acts as a data controller. For the code and content you ingest and the memory derived from it, Fate Labs acts as a data processor, processing it on your instructions to provide the service, and you are the controller of that content. Enterprise customers who need this allocation captured in a signed Data Processing Addendum can request one at khai@fatelabs.ca.
Sub-processors
These are the third parties that process data on our behalf, as integrated in the product today. We maintain a dated list and give notice of additions (for example, by email or an in-product notice) before a new sub-processor begins handling your data.
Your chosen model provider is not our sub-processor: it is reached with your key under your agreement with them. Our sub-processors process data primarily in the United States; if you require specific processing regions or transfer safeguards, contact khai@fatelabs.ca.
Isolation & tenancy
Every customer has a dedicated namespace. Stored queries append the tenant predicate at the database layer, so a query physically cannot span tenants by accident, and recall for your team only reads your namespace. This is the structural basis for the isolation guarantee in the Privacy Policy.
Export & deletion controls
The controls below are real product capabilities, not manual promises:
Use the dashboard, or email khai@fatelabs.ca. When you delete a source or a namespace, it is removed from active storage promptly; residual copies in encrypted backups age out on our standard 30-day rotation.
Product-improvement signals
The only data used to improve Estelle for everyone is aggregated, anonymized usage metadata (which capabilities are used, error rates, latency, feature demand), plus public market research. Your code content is never in that set. Opt out anytime; see How Estelle improves itself for the full, honest account.
Contact
Data questions and security reviews: khai@fatelabs.ca. We will share the current sub-processor list and answer security-review questions on request.