Privacy Policy

1. Introduction and Our Role

Valere Labs LLC (“Valere Labs,” “Company,” “we,” “us,” or “our”) develops and operates Dactic, an AI-powered platform that connects to an organization’s day-to-day tools, conducts structured interviews with personnel, and uses the resulting information to generate organizational knowledge (“Evidence,” “Org Lexicon,” “Playbooks”) and to configure, deploy, and operate AI agents on the organization’s behalf (collectively, the “Service”).

This Privacy Policy explains what personal data we collect, how we use and share it, how long we keep it, and the choices and rights available to you. It applies to the Dactic web application, APIs, and related services, and does not apply to third-party websites, tools, or services that Dactic may link to or connect with, which are governed by their own privacy policies.

Two roles, two responsibilities. Because Dactic is a business-to-business platform, personal data flows through it in two distinct ways, and our legal role differs for each:

• Where we act as a data controller (or “business,” under U.S. state law): for account and administrative information you or your organization provide directly to us to create and manage a Dactic account (e.g., admin contact details, billing information, support communications), we determine the purposes and means of processing and are the controller of that data.
• Where we act as a data processor (or “service provider”): for personal data contained in the systems your organization connects to Dactic (e.g., Gmail, Google Chat, Google Drive, Google Calendar, Monday.com, etc.) and for interview responses and derived Evidence generated from that data, your organization (“Customer”) is the data controller, and Valere Labs processes that data solely on Customer’s behalf and instructions, as described in this Policy and our customer agreement.

If you are an individual using Dactic through your employer or another organization, your organization — not Valere Labs — is primarily responsible for the lawfulness of collecting your personal data through the Service, including providing any notice or obtaining any consent required under workplace-monitoring, labor, or data protection law in your jurisdiction. Section 16 describes this allocation of responsibility in more detail.

2. Definitions

• “Organization” or “Customer” — the company or entity that has contracted with Valere Labs to use Dactic and that administers accounts, resource connections, and agent deployments through Admin roles.
• “Authorized User” — an individual (typically an employee of the Organization) who uses the Service under the Organization’s account, generally in the “Employee” role.
• “Connected Source” — a third-party tool (Gmail, Google Chat, Google Drive, Google Calendar, Monday.com, and other integrations we may add) that an Authorized User links to Dactic.
• “Evidence” — content collected from an approved Connected Source resource after it has passed through noise filtering and PII redaction, and been converted into a transformed, indexed representation for use by the platform.
• “Org Lexicon” — the organization’s normalized vocabulary map (terms, canonical concepts, ownership, confidence, and status).
• “Agent” — an AI-configured assistant, generated from admin-approved context, deployed into the Organization’s connected workspace (e.g., Monday.com) to perform a defined, permissioned task.
• “Personal Data” has the meaning given under applicable data protection law (e.g., GDPR, CCPA/CPRA), generally referring to information relating to an identified or identifiable individual.

3. Information We Collect

3.1 Information You Provide Directly

• Account information: name, email address, password (stored encrypted), job title, team, organization details, profile photo.
• Billing information: processed by our payment processor (Stripe); we do not store full payment card numbers.
• Support and communications: messages you send us, and records of your interactions with our support team.
• Website forms: name, business email address, phone number, company, job title, and any message you submit when you request a demo, start a trial, or contact us through our marketing website.

3.2 Information from Connected Sources

When an Authorized User signs in via Google OAuth or connects Monday.com, and then explicitly approves specific resources (e.g., particular Gmail labels, Chat spaces, Drive folders, Calendars, or Monday boards), Dactic reads only the approved resources, using read-only, least-privilege scopes. Depending on what is approved, this may include:

• Email metadata and content within approved Gmail labels
• Messages within approved Google Chat spaces
• File content and metadata within approved Google Drive folders
• Calendar entries within approved calendars
• Board, item, subitem, and comment content within approved Monday.com boards/workspaces

Nothing outside an explicitly approved resource is ever accessed. Authorized Users can review and revoke any connected source at any time from Account Settings, and revocation takes effect for all future syncs immediately.

3.3 Interview Data

Structured responses provided during Dactic’s guided interview, including role, team, reporting relationships, responsibilities, tools used, terminology, and named work artifacts, along with the transcript of that conversation.

3.4 Derived Data (Evidence, Lexicon, and Playbooks)

Information generated by our platform from the sources above, including: filtered and PII-redacted Evidence items; candidate and confirmed terminology mappings (the Org Lexicon); role and reporting-relationship graph data; versioned team Playbooks and their citations; and the configuration bundles (instructions, skills, permissions) used to deploy Agents. Only these transformed, derived representations are retained — the original raw emails, chat messages, files, or logs from a Connected Source are not stored on an ongoing basis once they have been processed into Evidence.

3.5 Usage and Technical Information

Device and browser type, IP address, pages accessed and actions taken within the Service, and performance/error logs, collected automatically to operate, secure, and improve the Service. On our marketing website, we and our analytics and advertising partners also collect information through cookies, pixels, tags, and similar technologies, as described in Section 12.

3.6 Information We Do Not Collect

We do not perform biometric profiling, and we do not access any Connected Source resource that has not been explicitly approved by the Authorized User who owns that connection.

4. How We Use Information

We use the information described above to:

• Provide, operate, secure, and improve the Service;
• Run the Evidence pipeline: syncing approved resources, filtering low-signal noise, redacting personal data prior to any indexing, mining candidate terminology, and detecting contradictions for human review;
• Conduct structured interviews and build role, team, and terminology profiles;
• Generate, validate, and — upon Organization Admin approval — deploy AI Agents into the Organization’s connected workspace, and power “Ask AI” features grounded solely in that Organization’s own data;
• Provide Organization administrators with aggregated, operational visibility (e.g., onboarding status, agent inventory, evidence-pipeline counts, audit logs) — never an individual’s raw messages or files (see Section 7.2);
• Meter Agent and token usage for billing and account management;
• Provide customer support, and communicate service, security, and account-related updates;
• Detect, investigate, and prevent fraud, abuse, and security incidents, and maintain audit logs of privileged actions; and
• Measure and improve our marketing website, and serve, personalize, and measure advertising for Dactic on other websites and platforms, as described in Section 12;
• Comply with applicable law and enforce our agreements.

We do not use your organization’s Interview Data, Connected Source content, or Evidence to train any public, shared, or externally released AI or foundation model.

5. Artificial Intelligence and Automated Processing

Because AI is central to how Dactic works, we want to be specific about it:

• Redaction before indexing. Personal data is detected and redacted before any content is converted into vector embeddings or written to our graph data store. Raw personal data is never persisted in the Evidence index or knowledge graph; redaction is logged only as counts and categories of what was removed, not the underlying values.
• Third-party model infrastructure. We use large-language-model infrastructure (including models made available through Amazon Bedrock, and lightweight models such as Claude Haiku) to filter noise, disambiguate terminology, and generate Agent instructions and conversational responses. These providers process data solely to generate output for your Organization, under contractual terms that prohibit using your data to train their own general-purpose models.
• Human-in-the-loop before anything goes live. Every AI-suggested terminology mapping, role fact, and Playbook policy point is stored with a status of inferred or needs review and requires confirmation by an Organization Admin before it becomes authoritative. No unconfirmed, AI-generated content is ever used to ground a live, deployed Agent.
• Bounded Agent permissions. Deployed Agents operate only within the read-only (or otherwise explicitly authorized) permission scope granted by the Organization and by the Authorized User who owns the underlying connection. Agents cannot delete data and cannot exceed their documented, audited permission set.
• Periodic re-grounding. Because organizational context changes, Agents are automatically re-synced and re-grounded on a recurring cycle (by default, every 30 days). Newly observed terms re-enter human review before they can update a live Agent. Organizations and Authorized Users may request an earlier refresh.

6. Legal Bases for Processing (GDPR / UK GDPR)

Where the GDPR, UK GDPR, or similar law applies, we (or, where we act as a processor, your Organization as controller) rely on the following legal bases:

• Performance of a contract — to provide the Service you or your Organization signed up for.
• Legitimate interests — to secure the platform, prevent fraud and misuse, maintain and improve reliability, and generate organizational Evidence and Agents grounded in the Organization’s own data, in each case balanced against your interests and rights.
• Consent: for non-essential cookies and similar technologies on our marketing website (including analytics and advertising technologies and the sharing of hashed user-provided data with advertising partners, as described in Section 12), and for optional features such as audio/video recording (where enabled), optional profile information, and the specific resources an Authorized User chooses to approve for a Connected Source. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal.
• Legal obligation — where processing is necessary to comply with applicable law.

Where Valere Labs acts as a processor, your Organization is responsible for establishing and, where required, documenting its own lawful basis (including any necessary workforce notice or consent) for permitting Connected Source content and interview data to be processed within Dactic.

7. How We Share Information

We do not sell personal information, and we share it only as described below.

7.1 Sub-processors and Service Providers

We engage the following categories of service providers to operate the Service. Each is bound by a written agreement imposing confidentiality, security, and data-protection obligations consistent with this Policy, including, for cross-border transfers, Standard Contractual Clauses or an equivalent lawful transfer mechanism.

7.2 Within Your Organization

Organization Administrators may access aggregated and operational information: onboarding status, KPI dashboards, agent inventory and status, evidence-pipeline stage counts, Org Lexicon entries, Playbooks, and audit logs.

Administrators do not have visibility into an Authorized User’s raw emails, chat messages, files, or logs. No admin-facing screen displays raw Connected Source content, and original messages/files are not retained on an ongoing basis once transformed into Evidence — this is a structural guarantee of the platform, not merely a permissions setting.

7.3 Legal and Safety

We may disclose information where we believe in good faith it is necessary to comply with applicable law, legal process, or governmental request; to enforce our agreements; or to protect the rights, property, or safety of Valere Labs, our customers, or the public.

7.4 Business Transfers

In connection with a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred as part of that transaction, subject to this Policy (or a policy that provides materially equivalent protection) continuing to apply, or notice being provided to affected users.

7.5 Aggregated and De-identified Data

We may share aggregated, anonymized, or de-identified information that cannot reasonably be used to identify an individual or an Organization (e.g., benchmarking statistics).

7.6 Analytics and Advertising Partners

On our marketing website, we share information collected through cookies, pixels, and tags (and, where you have consented, hashed contact details you submit in our website forms) with the analytics and advertising partners listed in Section 12. These partners may use this information for their own purposes as independent controllers, as described in their own privacy policies. We never share Customer Data, Connected Source content, Interview Data, or Evidence with advertising partners.

8. Data Security

We maintain a security program that includes:

• Encryption at rest, including OAuth tokens (Fernet symmetric encryption) and stored organizational data (AES-256);
• Encryption in transit via TLS across all endpoints;
• Signed and verified webhooks (HMAC-SHA256) to prevent tampering;
• Centralized secrets management, with no plaintext credentials in source code;
• Server-side, least-privilege role and route enforcement for every request — access control is never enforced by the client alone;
• Multi-tenant data isolation enforced at the query layer, across both our relational and graph data stores, so that one Organization’s data is never returned in another Organization’s queries;
• Immutable audit logging of privileged actions (evidence reads, approvals, scope grants, refresh runs); and
• Regular access reviews and internal security testing.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We continuously work to maintain safeguards appropriate to the sensitivity of the data we process. If you believe you have discovered a security vulnerability, please contact us at security@dactic.io.

9. Data Retention

• Account and platform data is retained while your account or Organization remains active.
• Interview transcripts, Evidence, Org Lexicon, and Playbook data are retained to support ongoing Agent grounding and the periodic refresh cycle described in Section 5. Raw Connected Source content is not retained beyond the filtering/redaction step — only the resulting transformed Evidence persists.
• Upon deletion of your account or your Organization’s account, Customer content, transcripts, and recordings are permanently deleted within a reasonable period (not to exceed 90 days), except: (a) as required to comply with law, resolve disputes, or enforce our agreements, or (b) residual copies in encrypted backups, which are purged on our standard backup-rotation schedule.
• Website analytics data: Google Analytics user-level and event-level data is retained for 14 months, after which only aggregated reports are kept. Cookies set on our website expire according to the lifetimes set by each provider (for example, the Google Analytics _ga cookie expires after 2 years), unless you delete them sooner.
• Audit logs may be retained for a longer period where necessary for security, compliance, or legal purposes.

You may request earlier deletion using in-product controls (Connected Accounts, Governance → Revoke all access) or by contacting us at contact@dactic.io.

10. International Data Transfers

Our infrastructure providers may process or store data outside your country or region, including outside the European Economic Area, the United Kingdom, or Switzerland. Where this occurs, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or other lawful transfer mechanisms recognized under applicable law.

11. Your Privacy Rights and Choices

Depending on your location, you may have the right to:

• Access the personal data we hold about you;
• Correct or update inaccurate information;
• Delete your personal data;
• Restrict or object to certain processing;
• Port your data in a structured, commonly used format;
• Withdraw consent where processing is based on consent, without affecting prior lawful processing; and
• Non-discrimination for exercising any of these rights.

Self-Service Controls

Many of these rights can be exercised directly in the product: revoke a Connected Source in Account Settings → Connected Accounts; an Organization Admin may revoke all access via Governance; and export tools are available in Governance and Billing.

Requests to Us

To exercise a right not available through self-service tools, contact us at contact@dactic.io. We may need to verify your identity (and, where relevant, confirm your Organization’s authorization) before fulfilling a request.

European Economic Area / UK

If you are located in the EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.

California (CCPA/CPRA)

California residents have the right to know the categories and specific pieces of personal information we collect, to delete, to correct, and to opt out of the “sale” or “sharing” of personal information (as those terms are defined by California law) and the use of sensitive personal information for purposes beyond what is necessary to provide the Service.

We do not sell personal information for money. However, our use of advertising cookies, pixels, and tags on our marketing website (described in Section 12) may be considered a “sale” or “sharing” of personal information for cross-context behavioral advertising under California law. In the preceding 12 months, we have disclosed identifiers (such as cookie IDs, IP addresses, and hashed email addresses or phone numbers) and internet or other electronic network activity information (such as pages visited and interactions with our website) to advertising and analytics partners for these purposes. You can opt out by selecting “Your Privacy Choices” in our website footer, by declining advertising cookies in Cookie settings, or by enabling the Global Privacy Control (GPC) signal in your browser, which we honor as a valid opt-out request for that browser. We do not knowingly sell or share the personal information of consumers under 16 years of age. We do not sell or share Customer Data, Connected Source content, Interview Data, or Evidence processed within the Service. You may designate an authorized agent to submit a request on your behalf, subject to identity verification.

Other U.S. States

Residents of states with comprehensive privacy laws (e.g., Virginia, Colorado, Connecticut, Utah, and others as they take effect) have similar rights to access, correct, delete, and port personal data, and to opt out of targeted advertising, sale, or certain profiling. We do not use Service data for targeted advertising, sale, or profiling. Our marketing website uses advertising technologies that may constitute targeted advertising under these laws; you can opt out using “Your Privacy Choices” in our website footer, Cookie settings, or the Global Privacy Control signal. You may exercise these rights using the contact information in Section 18.

Other Jurisdictions

Where applicable law provides equivalent rights (e.g., Brazil’s LGPD, Canada’s PIPEDA), we honor requests consistent with this Section.

12. Cookies, Analytics, and Advertising Technologies

12.1 Scope

This Section describes the cookies, pixels, tags, software development kits, and similar technologies used on our marketing website (dactic.io) and, where noted, in the Service. For information collected through these technologies on our marketing website, Valere Labs is the controller.

12.2 Your Consent Choices

We use a consent management platform (AdOpt) to record your cookie choices. Where required by law (including in the European Economic Area, the United Kingdom, and Switzerland), non-essential analytics and advertising technologies run only after you consent, and we pass your choices to Google through Google Consent Mode. In other regions, these technologies may run by default and you can opt out at any time. You can change or withdraw your consent at any time through “Cookie settings” or “Your Privacy Choices” in our website footer. Withdrawing consent does not affect processing carried out before withdrawal.

12.3 Google Analytics and Google Analytics Advertising Features

We use Google Analytics 4, a web analytics service provided by Google LLC (“Google”), to understand how visitors find and use our website. Google Analytics uses first-party cookies (such as _ga and _ga_<ID>) and similar identifiers to collect information such as pages viewed, referring URLs, clicks, scrolls, form interactions, time on page, browser and operating system, device type, model, and brand, screen resolution, language, and approximate location (derived from your IP address down to the city level). Google Analytics does not log or store IP addresses.

We have enabled the following Google Analytics features:

• Google signals: Google associates data collected on our website with information from the Google accounts of signed-in users who have turned on ads personalization, to provide cross-device reporting, demographics and interests reporting, and remarketing audiences. Google signals data is used only in aggregated form in our reports.
• Granular location and device data collection: collection of city-level location and detailed device information (such as device brand, model, and screen resolution).
• Remarketing, Demographics and Interests reporting, and ads personalization: we use Google Analytics Advertising Features, including Remarketing with Google Analytics and Google Analytics Demographics and Interests Reporting, and we may share Google Analytics audiences and key events with our linked Google Ads account to show you relevant ads for Dactic on Google services and partner websites.
• User-ID and user-provided data collection: when you submit a form on our website or sign in to the Service, we may send Google (a) a pseudonymous identifier we assign to you (“User-ID”), which never contains your name, email address, or other directly identifying information, and (b) user-provided data such as your email address, phone number, name, and address. Google’s tags automatically detect this information in our website forms and hash it in your browser (using SHA-256) before it is sent. Google uses this data to improve measurement accuracy, associate your activity across sessions and devices (including your activity before and after you sign in or submit a form), measure conversions, and support audience features. Where consent is required by law, we collect and send this data only with your consent.

How we and our vendors use cookies together: We and third-party vendors, including Google, use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as Google advertising cookies) or other identifiers together (a) to report on how ad impressions, other uses of ad services, and interactions with those ad impressions and ad services are related to visits to our website; (b) to inform, optimize, and serve ads based on your past visits to our website; and (c) to compile demographics and interests reports about our visitors.

To learn how Google uses information from websites that use its services, see https://policies.google.com/technologies/partner-sites. Google’s Privacy Policy is available at https://policies.google.com/privacy. If you are signed in to a Google account, you can review and delete activity associated with your account at https://myactivity.google.com.

12.4 Google Ads

We use Google Ads conversion tracking, remarketing, and enhanced conversions. These tools use cookies and similar identifiers, and, where you have consented, hashed contact details you submit in our website forms, to measure how our ads lead to website visits, sign-ups, and demo requests, and to show Dactic ads to people who have visited our website.

12.5 Other Analytics and Advertising Partners

Each partner above loads only when your cookie choices allow it.

12.6 How to Opt Out

• Use “Cookie settings” or “Your Privacy Choices” in our website footer to decline or withdraw consent for analytics and advertising technologies.
• Manage Google ad personalization at https://adssettings.google.com (My Ad Center).
• Opt out of Google Analytics on all websites with the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout.
• Opt out of interest-based advertising from participating companies through the Network Advertising Initiative at https://optout.networkadvertising.org, the Digital Advertising Alliance at https://optout.aboutads.info, or, in Europe, https://www.youronlinechoices.eu.
• Enable the Global Privacy Control (GPC) in a supported browser. We treat GPC as an opt-out of the sale and sharing of personal information and of targeted advertising for that browser.
• Block or delete cookies through your browser settings. Opt-outs are specific to the browser and device you use, and deleting cookies may remove your opt-out choices.

12.7 Cookies in the Service

Within the Dactic web application, we use strictly necessary cookies and similar technologies to keep you signed in, secure your session, and remember your preferences. We do not use advertising cookies in the Dactic web application. Disabling these cookies may affect Service functionality.

13. Children’s Privacy

Dactic is a business tool not directed to, and not intended for use by, individuals under 16 years of age (or the applicable age of consent in your jurisdiction), and we do not knowingly collect personal data from children. If we learn that we have inadvertently collected such data, we will delete it. If you believe a child has provided us personal data, contact us at legal@dactic.io.

14. No Warranty on AI-Generated Content

Agents, Playbooks, and Lexicon mappings are generated using automated and AI-assisted processes and are subject to human review and approval gates as described in Section 5, but they may nonetheless contain errors or inaccuracies. The Service, and any AI-generated output, is provided on an “as available” basis, and Valere Labs makes no warranty as to the accuracy or completeness of AI-generated content; use of such output for consequential business decisions remains the responsibility of the Organization and its personnel.

15. Data Breach Notification

If we become aware of a security incident involving unauthorized access to personal data that we control, we will notify affected individuals and/or applicable regulators as and to the extent required by applicable law. Where we act as a processor on behalf of an Organization, we will notify the Organization without undue delay so that it may satisfy its own notification obligations.

16. Your Organization’s Role and Responsibilities

If you access Dactic through an employer or other Organization, your Organization administers your account and, through its Admins, may access certain aggregated and administrative information about your use of the Service as described in Section 7.2.

Your Organization — not Valere Labs — is responsible for:

• Ensuring it has a lawful basis, and where required by applicable law, providing notice to or obtaining consent from its personnel before connecting Gmail, Chat, Drive, Calendar, Monday.com, or other sources that contain personal data about those personnel;
• Determining which resources to approve for collection, and ensuring that determination is appropriate given its own legal and workplace obligations;
• Promptly notifying Valere Labs of any need to restrict, correct, export, or delete personal data; and
• Its own compliance with labor, works-council, or employee-monitoring notification laws applicable to its use of the Service.

Valere Labs’ role with respect to such data is limited to processing it on the Organization’s behalf and instructions, as described in this Policy and our customer agreement.

17. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date above. If changes are material, we will provide additional notice through the Service or by other reasonable means.

18. Contact Us

Valere Labs LLC
399 Boylston St. Suite 650 Boston, MA, 02116.
General privacy inquiries and rights requests: legal@dactic.io
Security disclosures: security@dactic.io