Privacy Policy

1. Introduction and scope

This Privacy Policy describes how Violet Labs, Inc. ("Violet Labs," "we," "us," or "our") collects, uses, and discloses personal information. It applies to:

• Our websites, including violetlabs.com, docs.violetlabs.com, and jobs.violetlabs.com
• Our marketing, events, sales, and support interactions
• Account and usage information for our platforms, Violet (app.violetlabs.com) and VioletGov (app.violetgov.com), and related services such as the Violet MCP server (collectively, the "Services")

Customer Data. Our customers upload or connect engineering and business data to the Services, such as data from CAD, PLM, MES, ERP, QMS, RMS, and ALM systems ("Customer Data"). We process Customer Data on behalf of our customers as a service provider or processor, under our agreements with them. Those agreements, not this policy, govern Customer Data. If you are an end user of a customer's account, contact that customer about your information.

VioletGov. VioletGov is hosted in AWS GovCloud (US) with controls designed for U.S. government and export-controlled data. See our Trust Center for details.

2. Personal information we collect

Information you provide:

• Contact and professional information: name, email, phone, company, job title, mailing address
• Account information: login credentials, identity provider details (e.g., Google or Microsoft sign-in), role, and organization
• Communications: messages, support requests, demo requests, feedback, and meeting notes or recordings where you are notified
• Transaction information: billing contact and payment details, processed by our billing and payment providers. If you pay through a third-party payment platform, that platform's privacy policy applies. We do not store full card or bank account numbers.
• Marketing preferences: subscriptions and engagement with our emails
• Job applications: see Section 8

Information collected automatically:

• Device and network data: IP address, browser, operating system, device identifiers, and approximate location derived from IP
• Usage data: pages and features used, time spent, referring pages, clicks, and email opens
• Service logs: security, audit, and diagnostic logs from the Services

Information from other sources:

• Business contact data from data providers, event organizers, and partners
• Publicly available sources, such as company websites and LinkedIn
• Identity providers you use to sign in
• Social media pages we maintain (e.g., LinkedIn, Instagram), subject to those platforms' policies

3. How we use personal information

• Provide the Services: create and manage accounts, authenticate users, deliver features, and provide support
• Security and compliance: monitor, audit, and protect the Services; meet contractual and regulatory obligations, including U.S. government security requirements
• Communicate: send service notices, security alerts, and administrative messages
• Improve the Services: analyze usage, fix issues, and develop features, using aggregated or de-identified data where practical
• Marketing: send updates and event invitations, and measure campaign performance. You can opt out at any time.
• Legal: comply with law and legal process, enforce our terms, and protect rights, property, and safety

De-identified data. We may create aggregated or de-identified data. We will not attempt to re-identify it, and we may use it for lawful business purposes.

Automated decisions. We do not use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects about you.

We do not sell personal information for money. We also do not share personal information for cross-context behavioral advertising.

4. AI features

The Services include optional AI features, such as in-app chat and the Violet MCP server. These features use third-party model providers acting as our subprocessors, listed on our Trust Center.

How Customer Data is used with AI features, including which providers are enabled, is governed by our agreement with each customer.

If you connect the Violet MCP server to a third-party AI tool, that tool's provider handles your data under its own terms.

5. How we disclose personal information

• Service providers and subprocessors: hosting, security, analytics, email, CRM, support, payments, and AI providers, bound by confidentiality and data protection terms. Our current subprocessor list is on our Trust Center.
• Your organization: if you use an account provided by your employer, your organization's administrators can access your account information and activity.
• Integrations you enable: systems you connect to the Services, as directed by you or your organization
• Professional advisors: lawyers, auditors, insurers, and bankers
• Legal and safety: government authorities or others when required by law or to protect rights and safety
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this policy
• With your consent: where you direct us to share information

6. Cookies and similar technologies

We use cookies, local storage, and pixels on our websites and in emails.

Consent: where required by law, including for visitors in the EEA, UK, and Switzerland, we ask for your consent before setting non-essential cookies, such as analytics cookies. You can change your choice at any time through our cookie settings.

• Strictly necessary: Login, security, load balancing. Examples: Session and authentication cookies
• Analytics: Understand site and product usage. Examples: Google Analytics
• Email tracking: Measure opens and clicks. Examples: Loops

Your controls: you can block or delete cookies in your browser settings. Blocking necessary cookies may break parts of the Services.

Google Analytics opt-out: use Google's opt-out browser add-on.

Do Not Track and Global Privacy Control: we do not sell or share personal information, so there is no sale or sharing for these signals to opt out of.

7. Your choices and privacy rights

Marketing emails: unsubscribe using the link in any marketing email, or email privacy@violetlabs.com. You will still receive service messages.

Privacy rights. Depending on where you live, you may have the right to:

• Know or access the personal information we hold about you
• Correct inaccurate information
• Delete your information
• Receive a portable copy
• Opt out of sale, sharing, targeted advertising, or profiling
• Appeal our decision on your request

How to make a request: email privacy@violetlabs.com with the subject "Privacy Request." We will verify your identity before responding, and respond within the time required by law. You may use an authorized agent where the law allows. We will not discriminate against you for exercising your rights.

Customer Data requests: if your request concerns Customer Data, we will refer you to the customer who controls it.

State-specific disclosures: see California Residents below.

California residents. In the last 12 months we collected these categories of personal information, from the sources and for the purposes in Sections 2 and 3, and disclosed them to the recipients in Section 5:

• Identifiers: Name, email, phone, IP address, account ID
• Professional information: Company, job title
• Commercial information: Subscription and billing records
• Internet activity: Site and product usage, email engagement
• Approximate geolocation: City or region derived from IP
• Sensitive personal information: Account login credentials, used only to provide and secure the Services
• Applicant information: See Section 8

We have not sold or shared personal information in the last 12 months, and we do not knowingly sell or share information of consumers under 16. Retention periods are in Section 11.

8. Job applicants

When you apply through jobs.violetlabs.com or otherwise, we collect your application materials, contact details, work history, interview notes, and references. With your consent and as permitted by law, we may run background checks through a third-party provider.

We use this information to evaluate candidates, comply with employment and export control laws (including verifying eligibility to access controlled data), and communicate with you. We keep applicant records for 4 years after the hiring decision unless you are hired or the law requires otherwise.

9. Users in the EEA, UK, and Switzerland

We are based in the United States. For personal information covered by this policy, Violet Labs is the controller. For Customer Data, our customer is the controller.

Legal bases. We process personal information to perform our contract with you, for our legitimate interests in operating, securing, improving, and marketing the Services, to comply with legal obligations, and with your consent, such as for non-essential cookies. You can withdraw consent at any time.

International transfers. We transfer personal information to the United States using appropriate safeguards, such as the EU Standard Contractual Clauses.

Additional rights. In addition to the rights in Section 7, you may object to or restrict our processing, and you may lodge a complaint with your local data protection authority.

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information. These include encryption in transit and at rest, access controls, logging and monitoring, and security programs aligned with NIST SP 800-171. We maintain a SOC 2 Type II report, and our controls are designed to support ITAR requirements for export-controlled data. No system is perfectly secure. We will never ask for your password by email or phone. See our Security page and Trust Center.

11. Retention

We generally keep personal information for the periods below.

• Account information: Life of the account plus 90 days
• Customer Data: Per customer agreement
• Marketing contacts: Until you opt out, or 3 years without engagement
• Support communications: 3 years after the ticket closes
• Security and audit logs: 3 years, or longer if required by contract or law
• Billing records: 7 years
• Job applicant records: 4 years after the hiring decision

We may keep information longer where required by law or to resolve disputes.

12. Children

The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect their personal information. If you believe we have, contact us and we will delete it.

13. Other sites and services

The Services link to and integrate with third-party sites and systems. Their privacy practices are governed by their own policies.

14. Changes to this policy

We may update this policy. We will post the new version with a new "Last Updated" date. For material changes, we will notify account administrators by email or in the Services before the change takes effect.

15. Contact us

Violet Labs, Inc.
2261 Market St #5187
San Francisco, CA 94114
privacy@violetlabs.com

Related: Terms of Service