Privacy Policy

1. Who this covers

This policy covers people who visit our site, create an account, or act for a seller or buyer on OpenValence. It also explains how we handle personal information that appears inside the company data sellers license through us, such as the names of a company's former employees in its code history.

2. What we collect from you

• Account details: your name, work email, organization, and job title. If you sign in with Google, we receive your name, email address, and profile picture from Google, and nothing else.
• Sign-in records: one-time sign-in codes (stored only in hashed form, for 10 minutes), sessions, and the device and IP address a session was started from.
• Buyer verification: the details you give us to confirm your identity and organization, and a record of your acceptance of the Buyer Platform Agreement and NDA (your name, title, organization, email address, IP address, browser, and the time).
• Signatures: when you sign a Listing Schedule or an Order Form in the app, we keep the signed document, your name, title, email address, IP address, browser, and the time.
• Activity: listings, offers, sample requests, deals, messages to us, and notification settings.
• Payment details: for sellers, the payee name and tax form. Bank details go only through our payment provider, never into the app.
• Forms on the public site: whatever you send in a valuation, buyer access, or sample request form.

3. Company data from sellers

When a seller connects its tools (for example GitHub, Jira, Linear, or Slack) with read-only access, or uploads an export, we read the company's engineering records to count, sample, and deliver them. Those records often name the company's former employees, contractors, and customers. Before any sample or delivery reaches a buyer, we:

• replace every person's name, email address, and username with a pseudonym such as person_4;
• remove credentials such as passwords, API keys, and tokens, and contact details such as phone numbers and email addresses;
• run an automated check for names left in free text;
• leave out anything the seller excluded, and never read private Slack channels or direct messages;
• have a person on our team check the result, and let the seller review it.

Redaction greatly reduces, but cannot completely rule out, personal information remaining. Buyers are contractually barred from trying to identify anyone in the data. If you believe you appear in data we handle and want to ask about it, write to info@openvalence.com.

4. How we use information

We use it to run the marketplace: create and secure accounts, verify buyers, prepare and deliver listings, samples, and datasets, process signatures and payments, send the emails you need (sign-in codes, receipts, deal updates, and the notifications you have turned on), prevent fraud and misuse, and meet legal and tax obligations. We do not use your information for advertising, and we do not use seller data to train our own models.

5. Cookies

We use two cookies, both needed for the app to work: a session cookie that keeps you signed in, and a cookie that remembers whether you last used the buyer or seller side. We do not use advertising or tracking cookies, and we do not run third-party analytics.

6. Who we share information with

We do not sell your personal information, and we do not share it for advertising. We share it only as follows:

• Service providers that run parts of OpenValence for us, under contracts that limit their use of it: Vercel (hosting, background jobs, and the AI service used for name redaction and for preparing training tasks, which is set to keep no data), Neon (database), Amazon Web Services (file storage), Resend (email), and Google (sign-in, if you use it).
• The other side of a deal, as the deal requires: a seller sees what kind of organization a buyer is (for example, an AI lab) and that it is verified, and the organization's name once the seller accepts its offer, or earlier if the buyer chooses to share it on a buy request and the seller has signed the matched listing, never the requester's name or contact details; a buyer sees the company's name in its signed Order Form.
• The tools a seller connects, which receive our read-only requests.
• Sellers and prospective sellers, only in combined form: what buyers are asking for (sectors, kinds of data, and budget ranges), never a buyer's name, organization, or contact details.
• Authorities or others when the law requires it, or to protect our users and OpenValence from fraud or harm.
• A successor, if OpenValence is merged or sold, under this policy.

7. How long we keep it

• Account details: while your account is open, then deleted within 90 days of closing it, except as below.
• Signed agreements, acceptance records, invoices, and payment records: as long as the law and our agreements require, generally 7 years.
• Samples: deleted automatically 90 days after they are prepared.
• Seller data: deleted within 90 days after a listing's Seller Agreement ends, except what open deals and disputes still need. Uploaded Slack exports are deleted automatically 365 days after upload.
• Delivered datasets: kept while the buyer's download window and any dispute are open, then deleted.
• Backups: deleted on their normal schedule and kept secure until then.

8. Security

Data is encrypted in transit and at rest. Tokens for connected tools are encrypted and read-only. Files are private and only reached through short-lived links after we check who is asking. Access inside OpenValence is limited to people who need it.

9. Your choices and rights

You can update your profile and notification settings in the app. You can ask us to access, correct, delete, or export your personal information, or object to how we use it, by writing to info@openvalence.com. We will reply within 30 days. Depending on where you live (for example California or the European Union), you may have further rights under local law, including the right to complain to your data protection authority. We will not treat you differently for using these rights.

10. Where data is processed

OpenValence and its service providers process data in the United States. If you are outside the United States, your information is transferred there.

11. Children

OpenValence is for businesses and people 18 or older. We do not knowingly collect information from children.

12. Changes

If we change this policy in a way that matters, we will update the date above and, for significant changes, email account holders before they take effect.

13. Contact

OpenValence, Inc., info@openvalence.com.