Privacy Policy

Last updated: September 1, 2026

Experim ("we", "us", "our") is operated by Markus Rothmüller. We take your privacy seriously. This policy explains what data we collect, why, and how we protect it.

1. What we collect

When you use Experim, we may collect:

• Account information — name, email address, and profile picture when you sign up via email or Google OAuth.
• Usage data — hypotheses, experiments, learnings, strategy documents and other files you upload, and other content you create within the platform.
• Billing data — if you purchase a paid plan, our payment provider Stripe processes your payment details. We never see or store your full card number.
• Tool connection data — if you connect external tools (e.g. analytics or survey tools), we store the connection details and access tokens you provide (tokens are stored encrypted) and the data those tools return when you or the AI use them through Experim.
• Technical data — browser type, device type, and IP address for security and debugging purposes.

We do not collect data beyond what is necessary to provide the service.

2. Why we collect it

We use your data to:

• Provide and maintain the Experim platform
• Authenticate your account and manage access
• Process payments and manage your subscription
• Power AI features (experiment recommendations, hypothesis analysis, document search)
• Run actions and fetch data in tools you have connected, when you ask Experim to
• Improve the product based on aggregate usage patterns
• Communicate with you about your account or updates

3. Legal basis (GDPR)

We process your data based on:

• Contract performance — to provide the service you signed up for (Art. 6(1)(b) GDPR).
• Legitimate interest — to improve our product and ensure security (Art. 6(1)(f) GDPR).
• Consent — for optional communications like our newsletter (Art. 6(1)(a) GDPR).

4. Third-party services

We use the following third-party services to operate Experim:

• Supabase (EU region) — database, authentication, and file storage.
• Vercel — hosting and content delivery.
• Google OAuth — optional sign-in method.
• Stripe — payment processing for paid plans. Your payment details are handled directly by Stripe.
• Resend — sending transactional emails (e.g. account and beta invitations).
• AI providers: OpenAI, Anthropic, Mistral, and Groq — AI-powered features. Content you work on may be sent to these APIs for processing (some of which are located outside the EU, in particular in the US) but is not used to train their models. Uploaded documents are additionally indexed for search using OpenAI's embeddings API.
• Tools you connect — when you connect an external tool (e.g. PostHog or Tally), Experim calls that tool's API on your behalf using the credentials you provide. That tool's own privacy policy applies to the data it holds.

We do not sell, rent, or share your personal data with third parties for their marketing purposes.

5. Cookies

Experim does not set cookies. Your login session is kept in your browser's local storage, which serves the same strictly necessary purpose of keeping you signed in. We do not use tracking cookies, advertising cookies, or third-party analytics of any kind, so no cookie consent banner is required.

6. Data storage and security

Your data is stored on Supabase servers in the EU. We use industry-standard security measures including encryption in transit (TLS), row-level security policies, and secure authentication flows. Access tokens for connected tools are stored encrypted, and we keep regular backups of the database and uploaded files to protect against data loss.

7. Your rights

Under GDPR, you have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your data ("right to be forgotten").
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent — for any consent-based processing, at any time.

To exercise any of these rights, contact us at hello@experim.space.

8. Data retention

We retain your data for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are legally required to retain it (e.g. billing records). Copies in backups are removed as backups expire on their regular rotation.

9. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes via email or an in-app notice. The "last updated" date at the top reflects the most recent revision.

10. Contact

For any privacy-related questions or requests:

Markus Rothmüller
hello@experim.space