Privacy Policy

1. Scope

This Privacy Policy applies to Davisville Labs LLC, davisvillelabs.com, company contact and signup experiences, account and billing features, Compass, AI Agent Analytics, and Davisville Labs specialist services that link to this policy. A product may publish a more specific privacy notice. If a product-specific notice provides a narrower or more specific rule for that product, that product-specific notice controls for the covered processing.

2. Information we collect

Depending on the service, we may collect the following categories of information:

• Identifiers and contact information: name, email address, account identifier, login method, and contact details you provide.
• Account and authentication data: account status, authentication events, session information, authorization state, organization or workspace membership, and security-related records.
• Compass student and family data: grade level, interests, selected projects, project progress, notes, reflections, saved links, portfolio information, major exploration, counselor or family relationship information, and other content entered into Compass.
• Commercial and billing information: plan, transaction status, payment confirmation, billing metadata, invoices, cancellation status, and related records. Full card numbers are handled by payment processors rather than stored directly by Davisville Labs.
• Agent and research-service data: operation identifiers, bounded request parameters, evidence or task identifiers, response status, payment challenge or receipt metadata, delivery status, errors, and operational telemetry needed to authorize, deliver, secure, troubleshoot, and measure a service. Some products intentionally do not retain raw prompts, request bodies, result payloads, IP addresses, credentials, wallet addresses, or private buyer identity as analytics data.
• Communications: emails, support requests, feedback, form submissions, and other messages you send us.
• Device, usage, and technical data: IP address or other network information when technically necessary to serve or secure a request, browser or device information, referral information, pages viewed, timestamps, analytics events, performance data, error logs, and security logs.

3. Sources of information

We collect information from you or an authorized agent acting for you; automatically from browsers, devices, and service interactions; from authentication, hosting, security, analytics, email, and payment providers; from organizations that provision or administer access; and, for specialist research products, from public or licensed sources used to perform the requested research. We do not treat public-source research records as customer account data merely because a product analyzes them.

4. Information we generally ask you not to provide

Unless a service specifically requests it, do not submit Social Security numbers, government identification numbers, full payment-card details, account passwords, private keys, seed phrases, medical records, highly sensitive legal information, or other information that is unnecessary for the service. Davisville Labs products are not designed as general repositories for those categories of information.

5. How we use information

We may use information to provide and personalize services; authenticate and authorize users or organizations; save permitted user work and preferences; process purchases and subscriptions; deliver paid research operations; send service, billing, security, and account communications; answer support requests; detect fraud or abuse; enforce terms; maintain security; troubleshoot and improve products; measure aggregate or privacy-minimized usage; develop features; comply with law; preserve business records; and establish, exercise, or defend legal claims.

6. AI-supported features, agents, and telemetry

Some products use AI-supported features, and several services are intended for autonomous software agents. Information submitted to an AI-supported feature may be processed by Davisville Labs or a service provider to generate the requested output, operate the feature, secure the service, or troubleshoot performance. Davisville Labs does not use this company-level policy to authorize broader collection than a product actually performs.

For agent-facing services, we design telemetry to be bounded and privacy-minimized where practical. Product-specific contracts may exclude raw prompts, request or result bodies, credentials, payment secrets, wallet information, user-agent strings, long-term raw IP addresses, or private buyer identity from analytics. Synthetic tests, owner probes, registry crawlers, and monitoring traffic may also be classified separately from real customer activity.

7. Students and minors

Compass is only for students in grades 9 through 12 who are age 13 or older. For students under 18, a parent or legal guardian should purchase, approve, and supervise use as appropriate. Davisville Labs does not offer an under-13 Compass enrollment or parental-consent pathway and does not knowingly accept personal information from children under 13 through Compass. If we learn that information from a child under 13 was submitted to Compass, we will take reasonable steps to close or restrict the related access and delete or otherwise handle the information as required by law.

Compass uses a parent or guardian eligibility confirmation rather than asking students to submit a birth date solely for age screening.

8. Cookies, analytics, tracking, and preference signals

We may use cookies, local storage, session technology, analytics, and similar tools for authentication, preferences, security, fraud prevention, product functionality, performance, and measurement. The Davisville Labs parent site currently loads Google Analytics and Google-hosted web-font resources. Google Analytics may receive technical identifiers and usage events such as pages viewed, referral source, browser or device information, approximate location derived from network information, and general usage patterns.

Third-party providers embedded in or used by a service may independently receive technical information about a browser, device, or request. Those providers may have their own ability to recognize a browser or device over time or across services. Their independent practices are governed by their own policies and configurations.

There is no single uniform browser “Do Not Track” standard, and our sites do not currently respond to every ordinary DNT signal. Where applicable law requires recognition of a legally valid opt-out preference signal, including Global Privacy Control for covered sale or sharing activity, we will honor that signal as required by law. We do not intentionally configure the Davisville Labs parent site to sell personal information or serve cross-context behavioral advertising. If a current or future practice constitutes a legally defined sale or sharing, we will provide the required notice and choice.

9. Service providers and disclosures

We may disclose information to vendors and service providers that help us operate our services, such as hosting and security providers, database and authentication providers, payment processors, email providers, analytics providers, and AI infrastructure providers. Depending on the product, providers may include Cloudflare, Supabase, Stripe, Google, Resend, and AI-service providers. We may also disclose information when reasonably necessary to comply with law, respond to lawful process, protect users or systems, investigate abuse, enforce agreements, complete a financing or business transaction, or protect legal rights.

10. Sale or sharing of personal information

Davisville Labs does not operate a business model based on selling personal information for money and does not knowingly sell personal information of minors. California and other privacy laws can define “sale” or “sharing” more broadly than an exchange for money. If a current or future activity falls within one of those definitions, we will provide the notices, choices, and opt-out mechanisms required by applicable law.

11. Payments

Payments may be processed by Stripe or another disclosed payment provider. Davisville Labs may receive transaction identifiers, customer or payment-session identifiers, payment status, settlement or delivery status, subscription status, plan details, invoices, and related checkout metadata. Payment processors handle payment credentials under their own terms and security practices. Davisville Labs specialist services do not need a purchaser’s complete payment-card number or private wallet keys to deliver their research products.

12. Data retention

We retain information only as long as reasonably necessary for the purposes described in this policy, including providing services, maintaining accounts, honoring user choices, processing transactions, meeting tax and accounting obligations, resolving disputes, enforcing agreements, maintaining security, preventing fraud, supporting bounded research-state or retry contracts, and preserving necessary business records. Retention periods vary by data type, product, legal requirement, and operational need. Product-specific retention rules may be shorter or more restrictive. We may retain deidentified or aggregated information that no longer reasonably identifies a person.

13. Security

We use reasonable administrative, technical, and organizational safeguards appropriate to the nature of the service and information involved. Those safeguards may include encrypted transport, access controls, least-privilege authorization, payment-provider tokenization, hashing or pseudonymization, security monitoring, and fail-closed checks where appropriate. No online service, database, payment system, network, or security measure can guarantee absolute security. You are responsible for safeguarding your own credentials and promptly notifying us of suspected account compromise.

14. Access, correction, deletion, and account choices

You may contact us to ask what personal information we maintain about you, request correction or deletion, or ask a question about retention or account data. The rights available and the information we can delete or change depend on the service, applicable law, verification, legal obligations, security needs, and whether the information is part of a transaction, public-source research record, fraud-prevention record, or other record we are permitted or required to retain.

15. California privacy disclosures and rights

Davisville Labs is based in California. California’s Online Privacy Protection Act requires covered commercial websites and online services collecting personally identifiable information from California consumers to post and follow a privacy policy. This page is intended to provide that company-level notice, including categories of information, sources, purposes, disclosures, tracking practices, change notices, and a method to request review or correction.

California’s Consumer Privacy Act, as amended, applies only when its statutory coverage requirements are met. Where it applies to Davisville Labs and a particular request, California residents may have rights concerning access or knowledge, correction, deletion, portability, opting out of covered sale or sharing, limiting certain uses of sensitive personal information, and non-discrimination for exercising privacy rights. Some rights, exceptions, and verification requirements depend on the law and circumstances.

To submit a privacy request, email [email protected] with the subject “Privacy Request.” We may request information reasonably necessary to verify identity, authority, account ownership, or the scope of the request. An authorized agent may submit a request where applicable law permits, subject to legally permitted verification of the agent’s authority.

16. Other state and international rights

Residents of other jurisdictions may have additional privacy rights. Where an applicable law gives you rights that are not described here, Davisville Labs will respond as required by that law. We may decline or limit a request when a legal exception applies, when we cannot reasonably verify the request, or when retention is required or permitted for legal, security, fraud-prevention, transactional, research-integrity, or other legitimate purposes.

17. Third-party links and services

Our services may link to websites, public data sources, authentication providers, payment services, or other third parties. Their privacy practices are governed by their own policies, not this policy, except to the extent Davisville Labs is legally responsible for its own use of a provider.

18. Business transfers

If Davisville Labs or a product is involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, information may be transferred as part of that transaction subject to applicable law and appropriate confidentiality or privacy protections.

19. Changes to this policy

We may update this Privacy Policy as products, providers, and laws change. We will post the revised policy and update the effective date. If law requires additional notice or consent for a material change, we will provide it.

20. Contact

Davisville Labs LLC
Davis, California, United States
[email protected]