Privacy Policy

Clouvy Labs, Inc. (“Clouvy Labs,” “we,” “us,” or “our”) is a Delaware corporation with its principal place of business at 136 Madison Avenue, New York, NY 10016, United States.

For the purposes of the EU and UK General Data Protection Regulation (“GDPR”) and equivalent laws, Clouvy Labs is the “controller” of personal information collected through clouvylabs.com and related surfaces (the “Site”).

This Privacy Policy describes how Clouvy Labs collects, uses, discloses, and protects personal information when you visit the Site, subscribe to our communications, contact us, or otherwise interact with us.

It does not apply to products or platforms we build under separate product brands (for example, Governax). Those brands publish and administer their own privacy notices and contracts with their customers and users.

a) Information you provide directly

• Email address when you subscribe to our newsletter or submit a contact form.
• Professional information you voluntarily include in correspondence (e.g., name, role, company, phone number).
• Job-application materials: résumé or CV, cover letter, references, and right-to-work information — collected only if you apply for a role with us.

b) Information collected automatically

When you visit the Site, our hosting provider and edge infrastructure process technical data required to serve the Site, including:

• IP address (truncated in server logs where feasible)
• Browser type, version, language, and user-agent string
• Device type and operating system
• Referring URL
• Pages requested and timestamps
• HTTP status codes and response times

This information is retained for a short period (no more than 90 days) to secure the Site, diagnose errors, and maintain performance.

c) Information from third parties

We do not currently purchase or receive personal information about you from data brokers, enrichment providers, or public-data aggregators. If this changes, we will update this notice and obtain consent where required.

We process personal information to:

• Deliver the content, newsletters, or materials you request;
• Respond to your inquiries, requests, and correspondence;
• Administer, secure, and maintain the Site;
• Evaluate job applications and communicate about hiring;
• Detect, investigate, and prevent fraud, abuse, or security incidents;
• Comply with legal obligations (including tax, recordkeeping, and lawful requests);
• Protect the rights, property, and safety of Clouvy Labs, our users, and others;
• Conduct internal analysis in aggregated or de-identified form.

We do not use personal information for automated decision-making that produces legal or similarly significant effects on you.

If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases under Article 6 of the GDPR:

• Consent (Art. 6(1)(a)) — for newsletter subscriptions and any optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Legitimate interests (Art. 6(1)(f)) — for operating, securing, and improving the Site, and for responding to inquiries — where those interests are not overridden by your rights and freedoms.
• Contract (Art. 6(1)(b)) — where processing is necessary to take steps at your request before entering into a contract with us.
• Legal obligation (Art. 6(1)(c)) — where we are required to process personal information to comply with applicable law.

We share personal information only in the limited circumstances below, and only with recipients bound by appropriate confidentiality and data-protection obligations:

• Service providers and processors that help us operate the Site and our business, including hosting, content delivery, email infrastructure, and security tooling.
• Professional advisers — auditors, lawyers, bankers, and insurers — subject to professional confidentiality.
• Corporate transactions — in the event of a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred or disclosed as part of that transaction, subject to customary confidentiality protections.
• Legal and regulatory — where we are required to disclose personal information by law, by valid legal process, or to protect the rights, property, or safety of Clouvy Labs, our users, or others.

We do not sell personal information, we do not share personal information for cross-context behavioral advertising, and we do not disclose personal information to data brokers.

Clouvy Labs is based in the United States. The Site is served globally through edge infrastructure, and personal information may be transferred to, stored in, or processed in the United States and other countries where we or our service providers maintain operations.

When we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on lawful transfer mechanisms, which may include:

• European Commission adequacy decisions, where applicable;
• Standard Contractual Clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914);
• The UK International Data Transfer Addendum;
• Other mechanisms permitted by applicable law, such as derogations for specific situations under Article 49 GDPR.

For transfers involving India, we rely on the cross-border transfer framework established under the Digital Personal Data Protection Act, 2023 (the “DPDPA”) and its implementing rules, including processing within jurisdictions not restricted by the Central Government under Section 16 of the DPDPA, and, where relevant, standard contractual protections and explicit consent. You may request a copy of the safeguards we apply by emailing privacy@clouvylabs.com.

We retain personal information only for as long as necessary for the purposes described in this policy, or as required by law:

• Newsletter subscribers: until you unsubscribe, plus a short suppression-list period to honor your opt-out.
• Correspondence: up to three (3) years after the last interaction.
• Job applications: up to one (1) year from the close of the position, unless you consent to longer retention for future opportunities.
• Server logs: up to ninety (90) days.
• Records required by law: retained for the period specified by the applicable regulation.

We maintain administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include TLS encryption in transit, access controls, infrastructure hardening, vendor due diligence, and periodic security reviews.

No system is perfectly secure, and we cannot guarantee absolute security of information submitted over the internet. If we become aware of a security incident that affects your personal information, we will notify you and the relevant authorities in accordance with applicable law.

Subject to applicable law, you have the right to:

• Access the personal information we hold about you;
• Correct inaccurate or incomplete information;
• Deleteyour personal information (the “right to be forgotten,” in certain jurisdictions);
• Port your personal information in a structured, commonly used, machine-readable format;
• Restrict or object to our processing, on specified grounds;
• Withdraw consent for any processing based on consent, without affecting the lawfulness of prior processing;
• Lodge a complaint with your supervisory authority (in the EEA/UK, your national data-protection authority).

To exercise any of these rights, contact us at privacy@clouvylabs.com. We may need to verify your identity before fulfilling your request. We will respond within the timeframes required by applicable law — typically thirty (30) days in the EEA/UK, and forty-five (45) days in California, subject to one additional 45-day extension with notice.

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CCPA”):

• Right to know — what personal information we collect, use, disclose, and (if applicable) sell or share.
• Right to delete — subject to the statutory exceptions.
• Right to correct — inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell personal information and do not share personal information for cross-context behavioral advertising; there is therefore no sale or share to opt out of.
• Right to limit use of sensitive personal information — we do not use sensitive personal information for purposes that would trigger this right.
• Right to non-discrimination — we will not discriminate against you for exercising any CCPA right.

Categories of personal information collected. In the preceding twelve (12) months, we collected the categories of personal information described in Section 04 (identifiers, internet/network-activity information, professional information, and — in the case of job applicants — information covered by Cal. Civ. Code § 1798.140).

Sources, purposes, recipients, and retention. As described in Sections 04, 05, 07, and 09 of this policy.

How to exercise your rights. Email privacy@clouvylabs.com with the subject line “California Privacy Request.” You may designate an authorized agent to submit a request on your behalf; we will require written authorization and may verify the agent’s identity.

If you are a Data Principal in India, you have rights under the Digital Personal Data Protection Act, 2023 (the “DPDPA”) and its implementing rules issued by the Ministry of Electronics and Information Technology (“MeitY”). For the purposes of the DPDPA, Clouvy Labs acts as the “Data Fiduciary” in respect of personal data processed through the Site.

Your rights under the DPDPA include:

• Right to access a summary of the personal data we process, the processing activities undertaken, and the identities of any Data Fiduciaries and Data Processors with whom your personal data has been shared;
• Right to correction, completion, updating, and erasure of your personal data, subject to the exceptions set out in the DPDPA;
• Right of grievance redressal through the readily-available means described in this policy;
• Right to nominate another individual to exercise your rights in the event of your death or incapacity;
• Right to withdraw consent at any time, with effect on future processing only.

How to exercise your rights. You may exercise any of these rights, or raise a grievance, by contacting our Grievance Officer at privacy@clouvylabs.com. We will respond within the timeframes prescribed by the DPDPA and its rules.

Escalation. If we are unable to resolve your concern, you may approach the Data Protection Board of India established under the DPDPA.

The Site is intended for a professional audience and is not directed to children under 16. We do not knowingly collect personal information from children under 16 (or under 13, where a lower threshold applies under local law). If you believe we have inadvertently collected such information, please contact privacy@clouvylabs.com and we will delete it promptly.

The Site does not currently set marketing, analytics, or advertising cookies. A limited number of strictly necessary technical cookies may be set by our hosting and content-delivery infrastructure to serve the Site securely. For full details, see our Cookie Policy.

We honor Global Privacy Control (“GPC”) signals where required by applicable law.

The Site may contain links to third-party websites, services, or resources that are not controlled by Clouvy Labs. We are not responsible for the privacy practices of those third parties. We recommend reviewing the privacy policies of any third-party site you visit.

We do not use personal information for automated decision-making that produces legal effects concerning you or similarly significantly affects you.

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date at the top of this page. If the changes are material, we will provide additional notice (for example, by posting a banner on the Site or sending an email to subscribers).

Your continued use of the Site after an update constitutes acknowledgement of the updated policy.

For privacy-related questions or to exercise your rights:

• Email: privacy@clouvylabs.com
• Post: Clouvy Labs, Inc., Attn: Privacy, 136 Madison Avenue, New York, NY 10016, United States