Privacy Policy

This Privacy Policy explains how Immortal Company Inc. (“Immortal,” “Chariot,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use Chariot’s websites, command-line tools, APIs, hosted compute, AI-agent runtimes, marketplace, documentation, and related services (the “Service”). It also applies when you contact us or interact with us about Chariot.

Immortal Company Inc., 11273 Colinward Ave, Las Vegas, NV 89135, USA, is the controller of account, billing, security, website, and marketplace information described here. When an organization uses Chariot to process personal information on its behalf, that organization determines the purpose and means of processing Customer Content and may be the controller; Chariot processes that content as its service provider or processor, subject to the customer’s instructions and any applicable written agreement.

This Policy does not cover third-party websites, models, tools, integrations, or services, which operate under their own privacy policies. Our Terms of Service govern use of the Service.

Depending on how you use Chariot, we collect the following categories of personal information:

• You and your organization, including through the website, CLI, APIs, support, billing, and workload configuration.
• Your devices and software, which send technical and usage information when they connect to the Service.
• Your workloads and integrations, including agents, webhooks, tools, model providers, and other destinations you configure.
• Other users, when they share an image or fleet with you, deploy your Published Content, or otherwise interact with your account through Service features.
• Service providers, such as payment processors, email providers, hosting and storage providers, model routers, model providers, and scheduling services.
• Public sources, when reasonably necessary for security, compliance, or support.

• provide, provision, authenticate, maintain, and support the Service;
• run and preserve workloads, route messages, and deliver outputs;
• process purchases, meter usage, maintain credit and charge ledgers, and audit billing;
• verify, publish, share, fork, and deploy images and fleet recipes at your direction;
• communicate about accounts, security, billing, support, policy changes, and requested demos;
• detect, investigate, prevent, and respond to fraud, abuse, security incidents, and Terms violations;
• debug, analyze, improve, and develop Service performance, reliability, safety, and usability;
• comply with law, enforce agreements, resolve disputes, and protect rights and safety; and
• complete a merger, financing, acquisition, reorganization, or sale of assets.

We may aggregate or de-identify information so it can no longer reasonably identify you and use it for analytics, research, capacity planning, and product improvement. We will not attempt to re-identify it except to test our de-identification safeguards or as permitted by law.

When a workload makes a model request, Chariot may route the input through OpenRouter to the model provider selected by you or by applicable routing settings. The provider returns an output to Chariot and may receive request metadata needed to provide and account for the service.

Chariot does not use Customer Content to train its own generalized AI models unless we separately disclose the program and obtain any consent required by law. We may use limited content when you ask us to troubleshoot, when necessary for security or abuse response, or when content has been de-identified.

We may disclose information for another purpose with your consent.

Publishing a fleet or related page is a deliberate public action. The public may be able to view, copy, link to, index, or deploy Published Content. Public pages may show an email-derived owner label, a stable public namespace, fleet details, content you provide, and deployment activity. Authenticated catalog and deployment features may show your account email to other Chariot users. Search engines and third parties may retain copies beyond our control.

Private shares expose the sender’s and recipient’s account email addresses to each other as needed to offer, accept, and manage the share. Publisher-supplied media and links may load directly from third-party hosts, which can receive technical information such as a visitor’s IP address and browser data. Do not publish or share secrets, personal information, confidential data, or third-party material unless you have permission.

Unpublishing generally stops new public discovery or deployments, but existing forks, image shares, cached copies, and running workloads may continue until separately removed or revoked. See the Terms of Service for the licenses that support these features.

Chariot uses browser local storage and similar essential technology to keep you signed in, preserve security credentials on your device, remember theme preferences, and maintain basic Service functionality. Hosting providers may also process request logs and use security technology needed to deliver the site.

The embedded Calendly scheduler may use cookies or similar technology when you open the demo-booking page. Calendly controls that technology under its own policy. We do not currently use third-party advertising cookies or pixels on Chariot. If we introduce non-essential analytics or advertising technology, we will update this Policy and provide choices where required.

Chariot does not currently take action in response to browser “Do Not Track” or Global Privacy Control signals because we do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. If those practices change, we will update this Policy and honor legally recognized opt-out signals where required.

Third parties embedded in or reached through the Service—including Calendly and hosts of publisher-supplied media—may collect information about your activities over time and across different websites under their own policies. Chariot does not control those practices.

We keep personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Service, preserve customer-directed workloads, maintain security and billing records, comply with law, resolve disputes, and enforce agreements. Retention depends on the type of information, its sensitivity, the feature you use, and legal or operational requirements.

• Account and configuration data is generally kept while the account or resource remains active and for a limited period afterward as needed for recovery, security, or legal obligations.
• Persistent workload data and custom images generally remain until you delete the resource or account. Copies and verification artifacts may remain in backups, caches, and provider systems after active deletion until overwritten or removed under applicable system and provider retention processes.
• Agent replies and message records remain available to support delivery and polling until the related resource or account is deleted, unless a shorter setting or agreement applies.
• Authentication, diagnostic, and security records are kept for limited operational periods based on fraud, abuse, troubleshooting, and security needs.
• Billing, charge-audit, transaction, tax, and accounting records are retained as needed for reconciliation, fraud prevention, legal compliance, and claims.
• Published Content remains until unpublished or deleted, but copies already shared, forked, cached, or indexed may persist as described in Section 7.

When retention ends, we delete or de-identify information, subject to backup cycles and technical limitations. Third-party providers keep information under their own retention policies.

We maintain administrative, technical, and organizational safeguards designed to protect personal information. The safeguards applied vary based on the system, information, and processing involved and may include access controls, encryption, credential protection, logging, monitoring, and environment isolation.

No security measure is perfect. You are responsible for securing your devices, credentials, code, images, webhooks, integrations, and workloads. Email security@go-chariot.com if you believe your account or the Service has been compromised.

• Account information. Access or update available settings through the Service.
• Workloads and content. Delete agents, images, shares, fleets, and Published Content using available controls.
• Model selection. Choose models and providers whose privacy practices fit your use case.
• Integrations. Remove endpoints, tools, or webhook destinations you no longer want a Chariot to contact.
• Account deletion. Delete your account through the account interface where available or request deletion at privacy@a-list.com.
• Communications. You may unsubscribe from marketing emails using the link in the message. We may still send transactional, security, billing, and policy notices.

If your account is managed by an organization, contact its administrator first. If Chariot processes your information only on behalf of a customer, we may direct your request to that customer.

Depending on where you live and subject to legal exceptions, you may have the right to request access to, correction of, deletion of, or a portable copy of personal information; to learn the categories of information we collect, disclose, sell, or share; to opt out of sale, targeted advertising, or certain profiling; to limit certain uses of sensitive personal information; and to receive equal service without discrimination for exercising your rights.

Chariot does not sell personal information, share it for cross-context behavioral advertising, or use it for automated decisions that produce legal or similarly significant effects. We do not intentionally use sensitive personal information for advertising or to infer characteristics about individuals. Customer Content may contain sensitive information you choose to submit and is processed as described in Sections 4–6, including by model providers you select; do not submit sensitive or regulated data unless the selected route and a written agreement with Chariot expressly support it.

Chariot is currently directed to users in the United States, and information is processed in the United States and other locations where our service providers operate. Those locations may have different data-protection laws than your home country.

The Service is not currently marketed as an offering designed for the European Economic Area, United Kingdom, or Switzerland. If a data-protection law outside the United States applies to our processing despite that scope, we will honor the non-waivable rights and transfer requirements that law imposes. Contact privacy@a-list.com with a request or question.

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided personal information to Chariot, contact us so we can investigate and delete it where appropriate.

We may update this Policy as the Service and law change. We will post the updated version with a new effective date. If a change materially affects how we use personal information or your rights, we will provide additional notice through the Service, email, or another appropriate channel where required.

Immortal Company Inc.
Attn: Privacy
11273 Colinward Ave
Las Vegas, NV 89135, USA

Privacy requests: privacy@a-list.com
Legal questions: support@a-list.com
Security reports: security@go-chariot.com