Privacy Policy

Effective Date: 7/28/2026

This Privacy Policy explains how Vaelis Labs ("we," "us," or "our") collects, uses, discloses, and protects your information. Vaelis Labs is currently in a pre-launch private alpha. Features described herein, such as automated email integration and resume processing, reflect our intended data practices when those features are activated.

1. Information We Collect

We collect the following categories of personal information:

• Waitlist & Account Data: Name, email address, grade year, location (city/state), and fields of interest.
• Resumes: Professional and academic history, achievements, and other data contained in uploaded resume documents.
• Email Metadata & Content: If OAuth is enabled, we collect metadata (e.g., sender/recipient addresses, timestamps) and draft content for outreach you approve.
• OAuth Tokens: Secure authorization tokens provided by your email provider (Google/Microsoft) to allow us to send emails on your behalf. We never collect or store your email passwords.
• IP & Device Data: IP addresses, browser types, and operating system data automatically collected when you access our site.
• Cookies & Analytics: Data regarding your interaction with our site (e.g., pages visited, time spent).

2. How and Why We Use Your Information

We use the collected information for the following purposes:

• Waitlist Data: To contact you regarding alpha access and personalize potential opportunity matches.
• Resumes: To extract academic and professional qualifications to help generate personalized outreach templates.
• OAuth & Email Metadata: To facilitate the drafting and sending of approved emails directly from your connected inbox.
• IP/Device Data & Analytics: To maintain website security, monitor performance, and improve user experience.

3. Third-Party Providers and Data Sharing

We share information strictly with essential service providers who act on our behalf. These include:

• Supabase: Database hosting, user authentication, and secure file storage (resumes).
• Vercel: Website hosting and serverless backend infrastructure.
• Google & Microsoft: OAuth integration for email capabilities (if connected by you).
• AI Providers: We use third-party LLM providers to generate email drafts based on your profile.

Data Sales, Advertising, and AI Training Policies:

We do not sell your personal data. We do not share your data for cross-context behavioral advertising. We explicitly opt out of allowing our third-party AI providers to use your personal data or resumes to train their foundational models.

4. Resume Storage and Security

When you upload a resume, it is transmitted securely and stored using encrypted cloud storage (via Supabase). Access to these files is strictly restricted through database-level access controls (Row Level Security). You may delete your resume from our servers at any time, which securely purges the file from the storage bucket.

5. Email OAuth Permissions and Revocation

If you connect an email account, we request precise, minimal OAuth scopes required solely to draft and send emails on your behalf. We do not request full inbox read access unless explicitly required for a feature you opt into, and we do not collect your password.

Revocation: You can revoke Vaelis Labs' OAuth access at any time directly through your Google Account Security settings or Microsoft Account settings, or by requesting deletion through our contact email.

6. Data Retention Periods

We retain your data only as long as necessary:

• Waitlist Data & Resumes: Retained as long as your account is active or you are on the waitlist.
• OAuth Tokens: Retained until you revoke access or delete your account.
• Drafts & Email History: Retained for 90 days for audit and compliance purposes, then securely deleted.

7. User Rights: Deletion, Access, and Export

You have the right to access, correct, export, or permanently delete your personal information. To exercise these rights, email us at listeneralgo@gmail.com. We will fulfill verifiable deletion and export requests within 30 days.

8. California Privacy Rights (CCPA / CPRA)

If you are a California resident, you have rights under the CCPA/CPRA, including the right to know what personal information is collected, the right to delete, the right to correct inaccurate data, and the right to non-discrimination. While Vaelis Labs currently falls below the statutory thresholds that mandate CCPA compliance, we honor these rights operationally. As stated above, we do not sell or share personal data for targeted advertising.

9. Children's Privacy & Parental Consent (COPPA)

Vaelis is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you are between 13 and 18 years old, you must have your parent or guardian's permission to use the service. If we require email integration or resume uploads from a minor, we will implement procedures to obtain verifiable parental consent. If we discover we have collected data from a child under 13 without such consent, we will delete it immediately.

10. International Users

Vaelis Labs operates primarily in the United States. If you access our service from outside the U.S., be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the service, you consent to this transfer.

11. Cookies and Analytics

We use essential cookies to maintain your session and secure the platform. We may also use analytics cookies to understand website traffic. You can instruct your browser to refuse non-essential cookies, though some features of the service may not function properly.

12. Security Practices and Breach Notification

We implement commercially reasonable technical and organizational measures to protect your data, including encryption in transit (HTTPS) and at rest. However, no method of transmission over the Internet or electronic storage is 100% secure; therefore, we cannot guarantee absolute security. In the event of a data breach that compromises your personal information, we will notify you and applicable regulatory authorities as required by law.

13. Changes to This Policy

We may update this Privacy Policy periodically. If we make material changes, we will notify you by updating the "Effective Date" at the top of this page and, where appropriate, sending a notification to the email address associated with your account.

14. Contact Us

If you have any questions or wish to exercise your privacy rights, please contact us at:

• Email: listeneralgo@gmail.com
• Mailing Address: [Physical Mailing Address to be added]