Privacy Policy

1. Introduction

This Privacy Policy describes how Vailent Inc. (“we,” “us,” or “our”) collects, uses, and protects information when you visit our website at vailent.com (the “Site”). This policy covers our public marketing pages. Those pages are informational in nature, provide an overview of our technology platform, and do not offer user accounts or e-commerce functionality.

We separately operate a secure investor data room at vailent.com/investors. It requires an account and is available only to invited investors. This policy does not cover the data room. If you have been given access to it and want to know what information we hold about you and how we use it, email us at privacy@vailent.com and we will tell you.

We are committed to transparency and to protecting your privacy in accordance with applicable data protection laws worldwide, including the European Union General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the UK Data Protection Act 2018, Brazil’s Lei Geral de Proteção de Dados (LGPD), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and other relevant global privacy frameworks.

2. Information We Collect

2.1 Information Collected Automatically

When you visit our Site, certain information is collected automatically through third-party services embedded on our Site. These services and the data they collect are described below.

2.1.1 Google Analytics

We use Google Analytics, a web analytics service provided by Google LLC, which may collect the following information:

• ●IP address (which may be anonymized depending on your region)
• ●Browser type and version
• ●Operating system
• ●Device type (desktop, mobile, tablet)
• ●Referring URL and exit pages
• ●Pages viewed and time spent on each page
• ●Approximate geographic location (city/region level, derived from IP address)
• ●Language preferences

Google Analytics may use cookies or similar technologies to distinguish unique visitors. For more information about how Google processes this data, please refer to Google’s Privacy Policy and the Google Analytics Terms of Service.

2.1.2 RB2B

We use RB2B, a business-to-business visitor identification service provided by RB2B Inc. RB2B uses cookies, JavaScript, and similar tracking technologies to identify business visitors to our Site. This service may collect and match the following information:

• ●IP address
• ●Browser type, version, and settings
• ●Device and operating system information
• ●Pages visited and browsing behavior on our Site
• ●Professional contact information such as name, business email address, job title, and company name (matched from third-party data sources)
• ●LinkedIn profile URL and other publicly available professional information

RB2B identifies visitors by matching browsing data against its database of business professionals. This information is used solely for business-to-business lead identification and outreach purposes. For more information, please refer to RB2B’s Privacy Policy.

2.1.3 HubSpot

We use HubSpot, Inc. as our customer relationship management provider, and we run HubSpot’s website tracking code on our Site. Where you have consented to analytics storage, it may collect the following information:

• ●IP address
• ●Browser type and version, operating system, and device type
• ●Referring URL and the pages you view on our Site, including the order and timing of those views
• ●Approximate geographic location, derived from IP address
• ●A first-party cookie identifier that allows return visits from the same browser to be recognized as the same visitor

HubSpot sets cookies in your browser for this purpose. Where you later submit a form on our Site, HubSpot associates the browsing activity recorded under that cookie identifier with the details you submit, so that we can see how you found us and what you looked at before getting in touch. This tracking code is loaded only where you have consented to analytics storage, and it is not loaded in our investor data room. HubSpot’s own privacy notice is available at legal.hubspot.com/privacy-policy.

2.1.4 Microsoft Clarity

We use Microsoft Clarity, a website analytics service provided by Microsoft Corporation. Clarity records how pages are used so that we can see where a layout is confusing or a page is not working. Where you have consented to analytics storage, it may collect:

• ●IP address, browser type and version, operating system, and device and screen information
• ●Pages viewed, and the referring URL
• ●Mouse movement, clicks, taps, and scrolling
• ●Text you type into form fields on our Site, other than fields Clarity is configured to mask
• ●A recording of your session on our Site, and aggregated heatmaps built from many sessions

This is more intrusive than conventional analytics, so we want to be direct about it: Clarity reconstructs a playback of your visit. It is loaded only where you have consented to analytics storage, and it is never loaded in our investor data room. Microsoft may use the data it collects through Clarity for its own purposes as described in its privacy statement, available at privacy.microsoft.com/privacystatement.

2.1.5 LinkedIn Insight Tag

We use the LinkedIn Insight Tag, provided by LinkedIn Corporation or, for visitors in some regions, its affiliate LinkedIn Ireland Unlimited Company. It helps us measure our advertising on LinkedIn and show our ads on LinkedIn to people who have visited our Site. Where you have consented to advertising cookies, it may collect:

• ●IP address, browser type and version, operating system, and device information
• ●The URL and title of the pages you view on our Site, and the time of each visit
• ●Clicks and time spent on our pages
• ●Cookie identifiers that LinkedIn uses to recognize your browser and, if you use LinkedIn, to match the visit to your LinkedIn account

LinkedIn uses this to place LinkedIn members who visited particular pages of our Site into groups, such as people who read our blog, so that we can show those groups our ads on LinkedIn. When you submit our Book a Demo form and have consented to advertising cookies, we also report the submission to LinkedIn from our server, with a random code that lets LinkedIn count it once, the LinkedIn click identifier where we have one, your IP address, and a hashed version of the work email address you entered. The address is converted into a code with the SHA-256 hashing algorithm before we send it, so LinkedIn can match it to a LinkedIn account but never receives the address itself. We send LinkedIn no name. We do not receive your name or your LinkedIn profile from this tag. We see only group sizes and aggregated reports. LinkedIn also processes this data for its own purposes as described in its privacy policy, available at linkedin.com/legal/privacy-policy. The tag is loaded only where you have consented to advertising cookies, and it is never loaded in our investor data room.

2.1.6 Google Ads

We use Google Ads, an advertising service provided by Google LLC, to measure our advertising on Google’s services, such as Google Search and YouTube, and to show our ads there to people who have visited our Site. Our Google Analytics account is linked to our Google Ads account, so Google Ads works through the same Google tag described in section 2.1.1. Where you have consented to advertising cookies, it may collect:

• ●Whether you arrived on our Site from one of our Google ads, through a click identifier that Google adds to the link you followed and that the Google tag stores in a cookie
• ●The pages you view on our Site, and whether you submit our Book a Demo form
• ●Cookie identifiers that Google uses to recognize your browser across visits

When you submit our Book a Demo form and have consented to advertising cookies, the Google tag also detects the contact details you entered, such as your work email address and phone number, and sends Google a hashed version of them. Each detail is converted into a code with the SHA-256 hashing algorithm before it leaves your browser, and Google matches those codes against Google accounts to connect your submission to an ad you clicked, so that we can count the lead. We also send Google, from our own server, a hashed version of your work email address and phone number and the Google click identifier where we have one, for the same purpose.

Google may use visits to our Site to place you in groups, such as people who viewed a particular page, so that we can show those groups our ads on Google’s services. In Google Ads we see only group sizes and aggregated reports. Google also processes this data for its own purposes as described in its privacy policy, available at policies.google.com/privacy, and you can control how Google personalizes the ads you see at myadcenter.google.com. If you decline advertising cookies, the Google tag sets no advertising cookies, removes ad click identifiers from what it sends, and sends no hashed contact details, although Google may still receive the cookieless signals described in section 7.1. The Google tag is never loaded in our investor data room.

2.1.7 Reddit Pixel

We use the Reddit Pixel, provided by Reddit, Inc., to measure our advertising on Reddit and to show our ads on Reddit to people who have visited our Site. Where you have consented to advertising cookies, it may collect:

• ●IP address, browser type and version, operating system, and device information
• ●The pages you view on our Site, and whether you submit our Book a Demo form
• ●Cookie identifiers that Reddit uses to recognize your browser and, if you use Reddit, to match the visit to your Reddit account
• ●A hashed version of the email address and phone number you enter in our Book a Demo form, which the pixel detects on the page and converts into a code with the SHA-256 hashing algorithm before it leaves your browser

When you submit our Book a Demo form and have consented to advertising cookies, we also report the submission to Reddit from our server, with a random code that lets Reddit count it once, the page you submitted it on, the Reddit click identifier and Reddit cookie identifier where we have them, your IP address, your browser type, and a hashed version of your work email address and phone number. We send Reddit no name, and we never send it your email address or phone number in readable form. Reddit uses this data to place Reddit users who visited our Site into groups so that we can show those groups our ads on Reddit. We see only group sizes and aggregated reports. Reddit also processes this data for its own purposes as described in its privacy policy, available at reddit.com/policies/privacy-policy. The pixel is loaded only where you have consented to advertising cookies, and it is never loaded in our investor data room.

2.1.8 Spotify Pixel

We use the Spotify Pixel, provided by Spotify, to measure our advertising on Spotify and to show our ads on Spotify to people who have visited our Site. Where you have consented to advertising cookies, it may collect:

• ●IP address, browser type and version, operating system, and device information
• ●The pages you view on our Site, and whether you submit our Book a Demo form
• ●Cookie identifiers that Spotify uses to recognize your browser and, if you use Spotify, to match the visit to your Spotify account

Where you have consented to advertising cookies, we may also report a Book a Demo submission to Spotify from our server, with a random code that lets Spotify count it once, the page you submitted it on, the Spotify cookie identifier where we have one, your IP address, and a hashed version of your work email address and phone number. We send Spotify no name, and we never send it your email address or phone number in readable form. Spotify uses this data to measure which of our ads led to visits and submissions, and to place visitors into groups so that we can show those groups our ads on Spotify. We see only group sizes and aggregated reports. Spotify also processes this data for its own purposes as described in its privacy policy, available at spotify.com/legal/privacy-policy. The pixel is loaded only where you have consented to advertising cookies, and it is never loaded in our investor data room.

2.2 Information You Provide Directly

If you choose to submit our Book a Demo form, we collect the information you enter: your name, business email address, phone number, company name, and industry.

We also record how you arrived at our Site alongside that submission, where this is available: the campaign parameters in the link you followed (for example a UTM-tagged link from a social post), the website that referred you, and the pages on which you entered the Site and submitted the form. This is stored in your browser’s session storage and is only recorded where you have consented to analytics storage. It is cleared when you close your browser.

If the link you followed came from one of our ads on Google, LinkedIn, Reddit, or Spotify, it carries a click identifier that the ad platform added. Where you have consented to advertising cookies and your browser sends no Global Privacy Control signal, we keep that identifier in your browser, in session storage and in a first-party cookie named vl_click_ids that expires after 90 days, so that a later Book a Demo submission can be credited to that ad. If you decline advertising cookies, or your browser sends a Global Privacy Control signal, we do not store it, and we delete any copy stored earlier.

You can also book a meeting with our sales team through HubSpot’s scheduling page, which we show inside our Site. HubSpot receives the details you enter there, as described in section 2.1.3. When a booking succeeds and you have consented to advertising cookies, we count it the same way as a Book a Demo submission: the LinkedIn Insight Tag and the Reddit and Spotify Pixels record it, and we report it from our server as described in sections 2.1.5 to 2.1.8, with a hashed version of the email address you gave the scheduler where the scheduler shares it with our page. We never send the address itself.

Form submissions are sent to HubSpot, our customer relationship management provider, and are also stored in our own database so that a submission is never lost if that transfer fails. We use them to respond to your inquiry and, as described in sections 2.1.6 to 2.1.8, to measure whether our advertising produced it.

2.3 Information We Do Not Collect

Beyond the form information described in 2.2, our public marketing pages do not collect, process, or store:

• ●Financial or payment information
• ●Login credentials or account information
• ●Social Security numbers or government-issued identifiers
• ●Sensitive personal data such as health, biometric, or genetic information
• ●User-generated content or file uploads

Cookies that may be present on the Site are those placed by Google Analytics and by HubSpot for analytics purposes, by Microsoft Clarity for measuring how pages are used, by RB2B for visitor identification purposes, by LinkedIn, Google, Reddit, and Spotify for measuring and targeting our advertising on their services, and by our consent management platform to record the cookie choices you have made.

3. How We Use Collected Information

The information collected through our third-party services is used for the following purposes:

• ●Understanding visitor traffic patterns and trends
• ●Analyzing which pages and content are most relevant to our audience
• ●Improving Site performance, structure, and user experience
• ●Monitoring the technical health and uptime of the Site
• ●Reviewing recordings and heatmaps of Site usage to find layout, navigation, and usability problems
• ●Identifying business visitors for business-to-business lead generation and outreach
• ●Measuring our LinkedIn advertising, and showing our ads on LinkedIn to people who have visited our Site
• ●Measuring our Google advertising, and showing our ads on Google's services, such as Google Search and YouTube, to people who have visited our Site
• ●Measuring our Reddit and Spotify advertising, and showing our ads on Reddit and Spotify to people who have visited our Site

Our only advertising uses of this information are the LinkedIn, Google, Reddit, and Spotify advertising described in sections 2.1.5 to 2.1.8. We do not use collected information for automated decision-making that produces legal effects, or for any purpose beyond those described above.

4. Legal Basis for Processing (GDPR & UK GDPR)

For visitors located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we process personal data under the following legal bases:

• ●Legitimate Interest (Article 6(1)(f) GDPR): We have a legitimate interest in understanding how visitors interact with our Site to improve its content and performance, and in identifying business visitors for B2B lead generation purposes. This interest is balanced against your rights and freedoms.
• ●Consent (Article 6(1)(a) GDPR): Where required by applicable law, we will obtain your consent before placing analytics or advertising cookies on your device, including those of the LinkedIn Insight Tag, Google Ads, the Reddit Pixel, and the Spotify Pixel. You may withdraw your consent at any time using the methods described in Section 7 of this policy.

5. Data Sharing and Third-Party Services

5.1 Google Analytics

Analytics data collected on our Site is processed by Google LLC and its affiliates. Google may process this data on servers located in the United States or other countries. Google’s processing of this data is governed by the Google Ads Data Processing Terms and Google’s Privacy Policy. We have configured Google Analytics to the extent commercially reasonable to minimize the collection of personal data, including enabling IP anonymization where supported by Google’s current analytics infrastructure.

5.2 RB2B

Visitor identification data collected on our Site is processed by RB2B Inc. RB2B may process this data on servers located in the United States. RB2B matches browsing activity against third-party databases of business professionals to provide us with identified visitor information. RB2B’s processing of this data is governed by RB2B’s Privacy Policy and Terms & Conditions.

5.3 HubSpot

We use HubSpot, Inc. as our customer relationship management provider. When you submit a form on our Site, the details you entered, together with the arrival information described in section 2.2, are transferred to HubSpot and stored in our HubSpot account so that a member of our team can respond to you. HubSpot acts as our processor and is contractually restricted to processing that information on our instructions.

We also run HubSpot’s website tracking code, which sets cookies in your browser and records your browsing on this Site where you have consented to analytics storage. Section 2.1.3 describes what that code collects and how it is linked to a form submission. HubSpot’s own privacy notice is available at legal.hubspot.com/privacy-policy.

5.4 Microsoft Clarity

Session recording and heatmap data collected on our Site is processed by Microsoft Corporation. Microsoft may process this data on servers located in the United States or other countries. Unlike our other providers, Microsoft does not act solely as our processor for this service: it may also use the data it collects through Clarity for its own purposes, including improving its products and services. Microsoft’s processing of this data is governed by the Microsoft Privacy Statement.

5.5 LinkedIn

Where you have consented to advertising cookies, the information described in section 2.1.5 is collected by LinkedIn through its Insight Tag and the server report described there. LinkedIn may process it on servers in the United States, Ireland, or other countries. LinkedIn does not act solely as our processor for this service: it also uses the data for its own purposes. Its processing is governed by the LinkedIn Privacy Policy.

5.6 Google Ads

Where you have consented to advertising cookies, the information described in section 2.1.6 is collected by Google through the Google tag. The hashed lead details we send from our own server, described in the same section, also go to Google. Google may process it on servers in the United States or other countries. Google does not act solely as our processor for this service: it also uses the data for its own purposes. Its processing is governed by the Google Privacy Policy.

5.7 Reddit

Where you have consented to advertising cookies, the information described in section 2.1.7 is collected by Reddit through its pixel and the server report described there. Reddit may process it on servers in the United States or other countries. Reddit does not act solely as our processor for this service: it also uses the data for its own purposes. Its processing is governed by the Reddit Privacy Policy.

5.8 Spotify

Where you have consented to advertising cookies, the information described in section 2.1.8 is collected by Spotify through its pixel and any server report described there. Spotify may process it in Sweden, the United States, or other countries. Spotify does not act solely as our processor for this service: it also uses the data for its own purposes. Its processing is governed by the Spotify Privacy Policy.

5.9 Sale and Sharing of Personal Information

We do not sell, rent, lease, or trade your personal information to third parties for money. Under the CCPA/CPRA, letting LinkedIn, Google, Reddit, and Spotify collect information on our Site to show you our ads on their services may count as “sharing” personal information for cross-context behavioral advertising. You can opt out of that sharing at any time, as described in sections 7.3 and 7.6. Information shared with our other providers (Google Analytics, RB2B, HubSpot, and Microsoft Clarity) is shared solely for the purposes described in this policy and is governed by our agreements with those providers.

5.10 Legal and Compliance Disclosures

We may disclose information if required to do so by law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of Vailent Inc., our users, or the public.

6. International Data Transfers

Vailent Inc. is headquartered in Houston, Texas, United States. If you are accessing our Site from outside the United States, please be aware that information collected through Google Analytics, RB2B, HubSpot, Microsoft Clarity, LinkedIn, Google Ads, Reddit, and Spotify may be transferred to and processed in the United States or other jurisdictions where these providers maintain data processing facilities.

Where you submit a form on our Site, the details you provide are transferred to HubSpot, Inc. (United States), which acts as our processor and hosts our customer relationship management system on our behalf. For transfers of personal data from the EEA, UK, or Switzerland, we rely on HubSpot’s Data Processing Agreement and its Standard Contractual Clauses.

For transfers of personal data from the EEA, UK, or Switzerland to the United States, we rely on Google’s compliance with applicable data transfer mechanisms, which may include the EU-U.S. Data Privacy Framework, Standard Contractual Clauses (SCCs), or other lawful transfer mechanisms as adopted by relevant authorities.

7. Your Rights and Choices

7.1 All Visitors

Regardless of your location, you have the following options to manage your privacy on our Site:

• ●Cookie Consent Banner: Our consent banner lets you accept or decline each category of non-essential cookie. Microsoft Clarity, HubSpot’s tracking code, RB2B, the LinkedIn Insight Tag, the Reddit and Spotify Pixels, and our campaign-attribution storage are not loaded or written at all unless the relevant category is granted. Google Ads uses the same Google tag as Google Analytics, so the advertising category controls whether it may set advertising cookies and send the hashed contact details described in section 2.1.6. Google Analytics works differently, and we would rather be accurate than flattering about it: the Google tag loads on every page, and your choice controls whether it may store cookies and identifiers, not whether it runs. In Europe, including the EEA, the UK, and Switzerland, it stores nothing until you opt in, though a cookieless measurement signal containing your IP address is still sent to Google. Elsewhere, including the United States, all categories are granted by default under an opt-out model, and cookies are set unless you decline or your browser sends a Global Privacy Control signal (section 7.6).
• ●Withdrawing Consent: You can withdraw consent at any time with the Consent Preferences button at the bottom left of every page, by clearing this Site’s cookies in your browser, which causes the banner to ask again on your next visit, or by emailing privacy@vailent.com, and we will act on it. Two honest caveats. Withdrawing stops these services loading on subsequent page views, but a service already running in your current tab continues until you reload or leave the page. The LinkedIn Insight Tag is the exception: if you decline advertising cookies while it is running, the page reloads so that it stops at once. And withdrawal does not affect the lawfulness of processing carried out before you withdrew.
• ●Browser Settings: You can configure your browser to block or delete cookies, including those placed by Google Analytics, Google Ads, HubSpot, Microsoft Clarity, LinkedIn, Reddit, and Spotify. Please refer to your browser’s help documentation for instructions.
• ●Google Analytics Opt-Out: You may install the Google Analytics Opt-Out Browser Add-On to prevent Google Analytics from collecting data during your visits.
• ●Do Not Track: Our Site does not currently respond to “Do Not Track” browser signals, because no common standard for them exists.

7.2 European Economic Area, UK & Swiss Residents (GDPR)

Under the GDPR and UK GDPR, you have the right to access, rectify, erase, restrict processing of, and port your personal data, as well as the right to object to processing and to withdraw consent. Some of the analytics data we collect is aggregated, and we may not be able to identify you from it alone. Form submissions and the visitor identification described in section 2.1.2 can identify you, and these rights apply to that data in full. To exercise any of these rights, please contact us using the information provided in Section 11.

7.3 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale or sharing of personal information. We do not sell personal information. The LinkedIn, Google, Reddit, and Spotify advertising described in sections 2.1.5 to 2.1.8 may count as sharing, and you can opt out of it with the Consent Preferences button at the bottom left of every page, by choosing “Do Not Sell or Share My Personal Information”, or by sending a Global Privacy Control signal (section 7.6). You also have the right to non-discrimination for exercising your privacy rights. To submit any other request, please contact us using the information provided in Section 11.

7.4 Brazil Residents (LGPD)

Under Brazil’s LGPD, you have rights including confirmation of processing, access to data, correction, anonymization, portability, deletion, and information about data sharing with third parties. To exercise these rights, please contact us using the information provided in Section 11.

7.5 Canadian Residents (PIPEDA)

Under PIPEDA, you have the right to access your personal information held by us and to challenge its accuracy. To make a request, please contact us using the information provided in Section 11.

7.6 Global Privacy Control (GPC)

Global Privacy Control is a browser signal that communicates an opt-out of the sale or sharing of personal information. Where you are offered our opt-out banner, including in the United States, our consent banner treats a GPC signal as that opt-out and declines every non-essential category, so the LinkedIn Insight Tag and the Reddit and Spotify Pixels are not loaded, the Google tag sets no advertising cookies, no hashed contact details are sent from your browser, and we report no form submission to LinkedIn, Google, Reddit or Spotify. You can also decline the relevant categories on our cookie banner or email us at privacy@vailent.com, and we will honor the request.

8. Data Retention

Analytics data collected through Google Analytics is retained in accordance with Google’s default data retention settings. Visitor identification data collected through RB2B is retained in accordance with RB2B’s data retention policies. Session recordings and heatmap data collected through Microsoft Clarity, and website tracking data collected through HubSpot, are retained in accordance with those providers’ respective data retention policies. Our LinkedIn website audiences keep a visitor for up to 180 days after their last qualifying visit, and LinkedIn retains the underlying data in accordance with its own policies. Data collected for our Google, Reddit, and Spotify advertising is retained in accordance with each provider’s own policies and the settings of our accounts with them. We periodically review and, where possible, configure retention periods to the minimum duration necessary to achieve the purposes described in this policy. Aggregated and anonymized data that cannot be used to identify any individual may be retained indefinitely for trend analysis and reporting purposes.

Information you submit through a form is retained in our HubSpot account, and in our own database, for as long as we have a legitimate business interest in the inquiry or an ongoing business relationship with you. You can ask us to delete it at any time using the contact details in section 11, and we will do so unless we are required to keep it by law.

9. Data Security

We take reasonable technical and organizational measures to protect the data processed through our Site. Data transmitted between your browser and our Site is encrypted using HTTPS/TLS. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security. Google applies its own security measures to protect analytics data processed through its infrastructure.

10. Children's Privacy

Our Site is not directed at children under the age of 16 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe that a child has provided personal information to us, please contact us immediately, and we will take steps to delete such information.

11. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

For data protection inquiries from the European Economic Area or the United Kingdom, you may also contact your local supervisory authority.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Effective Date” at the top of this policy. We encourage you to review this page periodically for the latest information on our privacy practices. Your continued use of the Site after any changes constitutes your acknowledgment of the updated policy.