Privacy Policy

This Privacy Policy explains how [Legal entity name] (“EvalLense,” “we,” “us”) handles personal information in connection with the EvalLense website and the EvalLense pitch‑deck evaluation service (the “Service”). It applies to organizers who use the Service and to participants whose materials are submitted to it.

EvalLense is a United States–based service. By using the Service, you understand that your information will be processed in the United States.

We collect the following categories of information:

• Account information.Name, email address, company, and authentication data when an organizer creates an account. Passwords are stored only in hashed form by our authentication provider; we never store plain‑text passwords.
• Submitted content. Pitch decks (PDF, PPTX, or slide links), startup and project details, founder/team information, and any comments organizers or participants add. This content may contain personal information about founders and team members.
• Evaluation data. Scores, reports, reviewer notes, and decisions generated or recorded within the Service.
• OAuth profile data. Where you sign in with Google, we receive basic profile information (such as name and email) from that provider.
• Usage and device data. Log data, IP address, browser type, and similar technical information collected automatically when you use the Service.

We use personal information to:

• provide, operate, and maintain the Service;
• run AI‑assisted evaluation and generate evidence‑based reports (see “AI processing” below);
• authenticate users and secure accounts and workspaces;
• respond to support requests and communicate about the Service;
• monitor, troubleshoot, and improve the Service; and
• comply with legal obligations and enforce our Terms of Service.

Submitted content is processed by automated AI judges to produce structured, advisory evaluation reports. These outputs are decision‑support only: a human reviewer makes the final decision. AI inference is performed through third‑party AI infrastructure acting as our service provider (see “subprocessors”).

We do not use submitted pitch decks or participant materials to train third‑party foundation models, and we instruct our providers to process this content only to deliver the Service to you.

We share personal information only as described here:

• Service providers / subprocessors. We use trusted vendors to host data and run the Service, including cloud hosting and authentication (e.g., Supabase) and AI inference infrastructure (e.g., Vercel AI Gateway and the underlying model providers). They process information under contract and only on our instructions.
• Within a program.Materials an organizer collects are visible to that organizer’s authorized workspace. Participant submissions are shared with the organizer running the program they applied to.
• Legal and safety. Where required by law, legal process, or to protect rights, safety, and the integrity of the Service.
• Business transfers. In connection with a merger, acquisition, or sale of assets, subject to this policy.

We do not sell personal information, and we do not “share” it for cross‑context behavioral advertising as those terms are defined under California law.

We use strictly necessary cookies to keep you signed in and to operate the Service securely. We use only the cookies needed to provide the Service and any privacy‑respecting analytics required to maintain it; we do not use advertising cookies. You can control cookies through your browser settings, though disabling essential cookies may break sign‑in.

We retain personal information for as long as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention periods [to be confirmed]depend on the type of data and the program context. When information is no longer needed, we delete or de‑identify it. You may request deletion as described below.

We use technical and organizational measures to protect personal information, including encryption in transit, access controls, row‑level data isolation between organizer workspaces, and server‑side handling of secrets. More detail is on our Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the right to:

• Know / access the categories and specific pieces of personal information we have collected about you;
• Delete personal information we collected from you, subject to legal exceptions;
• Correct inaccurate personal information;
• Opt outof the sale or sharing of personal information — though, as noted above, we do not sell or share personal information; and
• Non‑discrimination for exercising your rights.

To exercise these rights, email privacy@evallense.com. We will verify your request before responding. You may use an authorized agent where permitted by law.

Where we process content on behalf of an organizer (for example, participant materials), the organizer is the party responsible for that data; we will direct relevant requests to them.

The Service is intended for businesses and professionals and is not directed to children. We do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact us so we can delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date above and, for material changes, provide additional notice where appropriate.

Questions about this policy or your information? Contact [Legal entity name] at privacy@evallense.com or at [mailing address].