Privacy Policy

1. Who we are

Prelabz operates this service. When this policy says “we”, “us” or “Prelabz”, it means the company responsible for deciding what happens to your information — the data controller.

Prelabz is a separate product from Corporate AI Solutions. Earlier versions of this page named Corporate AI Solutions as the collector of your information. That was wrong, and this version corrects it.

2. What we collect

2.1 What you give us

• Your email address. You can upload a deck with an email address alone — you do not need an account first.
• Account details, if you create one: your name, and anything you choose to add to your profile.
• Your pitch deck and any documents you upload, including everything inside them.
• What you tell Maya, our coach — by voice or by typing. See section 5.
• Notes and answers you write in the product.

2.2 What we generate about you

• The analysis of your deck and the scores derived from it.
• Your report, and any later versions as your score changes.
• A record of your consent — which document you agreed to, its version, a fingerprint of the exact wording, the time, your IP address and your browser's user-agent string. We keep this so that we can show what you agreed to, rather than asking you to take our word for it.

2.3 What we collect automatically

Server logs generated by our hosting and database providers in the ordinary course of running the service, which include IP addresses. We do not run any analytics or advertising trackers — see section 11.

3. How we use it

We do not sell your information, and we do not use it for advertising.

4. Your pitch deck, specifically

A pitch deck is the most sensitive thing most founders will ever hand us, so this section says plainly what happens to it. It mirrors the Data Use Policy you agree to at upload — if the two ever appear to disagree, tell us, because that is a defect.

You can delete a deck at any time. When you do, we delete the file and its analysis. The anonymised patterns already derived from it cannot be traced back and pulled apart, so those remain — this is the one thing deletion does not undo, and we would rather say so here than have you discover it later. Your consent record also remains, with your identity removed from it.

5. Maya, and what she remembers

Maya is the Prelabz coach. You can talk to her or type to her.

• Voice calls are recorded and transcribed. Voice is handled by ElevenLabs, who show their own consent notice before a call begins. The recording and transcript are processed by them as well as by us.
• She remembers between sessions. After a conversation, we store a short distilled summary of what was discussed and concluded — not the raw recording — so that the next session does not start from nothing. Some of that summary is held by Mnemo, a memory service we use (see section 8).
• Her memory of you is scoped to you. Another founder’s sessions cannot surface in yours.
• You can have it erased. Ask us and we will delete what Maya remembers about you, in our systems and in Mnemo.

6. Who can see your information

Three groups, and no others.

We may also disclose information where the law requires it, or to protect someone from serious harm. If that ever happens we will tell you, unless we are legally prohibited from doing so.

An earlier version of this page described a three-tier visibility system that founders could control. That system does not exist. We removed the description rather than leave you relying on a switch that was never built.

7. Where it is stored

Your account data, your uploaded decks and your analysis are stored in Supabase, hosted on Amazon Web Services in Sydney, Australia.

Some processing happens outside Australia. When your deck is analysed, its contents are sent to Anthropic; when you speak to Maya, the audio goes to ElevenLabs; Maya’s distilled memory is held by Mnemo. Those providers process in other countries, including the United States. Section 8 lists them.

We are not going to tell you your data never leaves the country, because it does.

8. Companies that process data for us

Email currently leaves from a sending domain verified to Corporate AI Solutions, which is why our messages may show that name in their technical detail. We are moving this to a Prelabz domain.

9. How long we keep it

• Your account and decks: until you delete them or ask us to close your account.
• After deletion: removed from our live systems immediately, and from provider backups within 30 days.
• Maya’s memory: for as long as your account is open, or until you ask us to erase it.
• Consent records: kept after you leave, with your identity removed, so we retain proof that a valid consent existed without retaining a record of you personally.
• Anonymised patterns: kept indefinitely. They no longer identify you.

How long consent records should outlive a deletion request is a genuine tension between proving what was agreed and honouring a request to be forgotten. The position above is our current answer and is under legal review.

10. Your rights

You can ask us to:

• Show you what we hold about you.
• Correct anything that is wrong.
• Delete your decks, Maya’s memory of you, or your whole account.
• Export your information in a portable format.
• Object to, or restrict, a particular use.
• Withdraw consent to the Data Use Policy for future uploads.

We will respond within 30 days, and usually much faster. There is no charge. If you are in the UK or EU, these are your GDPR rights; we apply them to everyone rather than only to the people who can enforce them.

11. Cookies

We set cookies for one purpose: keeping you signed in. They are strictly necessary, so there is no cookie banner to click through.

We run no analytics, no advertising cookies, no social media pixels and no third-party trackers. If that changes, we will ask you first.

12. Security

• Everything is encrypted in transit and at rest by our providers.
• Database access is restricted row by row, so one account’s queries cannot return another account’s data.
• Uploaded decks are stored in a private bucket, reachable only through short-lived links issued to you.
• Consent records cannot be written or altered from a browser — only by the server.

If a breach affects you, we will tell you and the relevant regulator promptly — within 72 hours of becoming aware, where that obligation applies to us.

13. Children

Prelabz is a service for founders and investors. It is not intended for anyone under 16, and we do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

14. Changes to this policy

We will tell you by email at least 30 days before any material change, and we will not apply a new data use to information you gave us under the old one without asking you again. Small clarifications are published immediately, with the version number and date at the top of this page updated so you can see something moved.

This version is a draft. The next update is expected to carry the confirmed company details and the outcome of legal review.

15. Contact and complaints

If you are not satisfied with how we handle your complaint, you can escalate it to the privacy regulator where you live — in the United States, your state Attorney General or the Federal Trade Commission; in the UK, the Information Commissioner’s Office; in the EU, your national supervisory authority; in Australia, the OAIC. You do not have to come to us first, though we would like the chance to put it right.