Information We Collect

We collect information you provide directly and information about how you use our services.

• •Account information (name, email, organization)
• •Usage data and analytics
• •Content you upload for processing
• •IP addresses, browser type, device information, and approximate location
• •Cookies and similar tracking technologies (see our Cookie Policy)
• •Audio recordings submitted through our careers application form

Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation (GDPR), we process your personal data based on the following legal grounds:

• •Contract: Processing necessary to perform our services as agreed with you or your organization.
• •Consent: Where you have given explicit consent, such as for analytics cookies or audio recordings in job applications.
• •Legitimate Interest: For product improvement, security monitoring, and fraud prevention, where our interests do not override your rights.
• •Legal Obligation: Where processing is required to comply with applicable laws or regulations.

How We Use Your Information

We use collected information to provide, maintain, and improve our services.

• •Provide and deliver requested services
• •Send you technical notices and support messages
• •Improve and develop new features
• •Process job applications, including reviewing audio responses
• •Comply with legal obligations and respond to lawful requests

Third-Party Data Sharing

We may share your data with the following categories of third parties, solely for the purposes described in this policy:

• •Cloud Infrastructure Providers: For hosting and data storage (encrypted at rest and in transit).
• •AI Model Providers (OpenAI Enterprise): For processing data as part of our services. Your data is not used for model training under our enterprise agreement.
• •Analytics Providers: Only with your consent, for understanding site usage patterns.

We do not sell your personal data to any third party. A complete list of our sub-processors is available upon request.

International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence, including the United States. When we transfer data outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on adequacy decisions where applicable.

Data Retention

We retain your data only as long as necessary to provide our services and fulfill the purposes described in this policy. You may request deletion at any time.

• •Account data: Retained for the duration of your account plus 30 days after deletion.
• •Customer data processed by our services: Retained per your data processing agreement; deleted upon contract termination unless legally required.
• •Job application data (including audio): Retained for up to 2 years. You may request deletion at any time.
• •Analytics data: Aggregated and anonymized within 26 months.

Your Rights

You have rights regarding your personal data:

• •Access your personal data
• •Correct inaccurate data
• •Request deletion of your data
• •Export your data in a portable format
• •Object to processing based on legitimate interest
• •Withdraw consent at any time (without affecting lawfulness of prior processing)
• •Lodge a complaint with a supervisory authority

To exercise any of these rights, email privacy@embeddinglabs.com. We will respond within 30 days.

Audio Recording & Biometric Data

Our careers application form may collect audio recordings. This data is treated with heightened protection:

• •Audio is collected only with your explicit, informed consent before recording begins.
• •Recordings are stored in encrypted cloud infrastructure accessible only to authorized recruiting team members.
• •Audio data is retained for up to 2 years and may be deleted upon request at any time.
• •Audio recordings are not used for biometric identification or profiling purposes.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• •Right to know what personal information is collected, used, shared, or sold.
• •Right to delete personal information held by us and by extension our service providers.
• •Right to opt out of the sale or sharing of personal information. We do not sell personal information.
• •Right to non-discrimination for exercising your privacy rights.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes via email or through a prominent notice on our website. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

Contact

For questions about this privacy policy or our data practices:

privacy@embeddinglabs.com

Embedding Labs, Inc.
885 2nd Ave
New York, NY 10017