Privacy Policy

1. Scope and responsibilities

This notice describes the Labs platform at evals.heymilolabs.com and its associated API. Read it with the HeyMilo Privacy Policy for company-wide practices and regional rights. An organization supplying research material may separately determine the purposes and permissions for that material. This notice does not replace the notice, consent, or agreement under which an interview was originally collected.

2. Information handled by Labs

• Account and workspace information: your email address, name, profile image when supplied, authentication identifiers, organization memberships, roles, and invitation status. Google sign-in provides basic identity information, including your email and profile; Labs does not request access to Gmail, Drive, or Calendar.
• Research activity: bookmarks, saved searches, collections, annotations, access requests, and requests for more examples. A shared collection can reveal its title, description, and selected references to its workspace.
• Research material: the audio, video, transcripts, prompts, questions, scores, and related context included in a collection. Available fields depend on the source and format. Do not assume a recording is anonymous solely because names have been removed.
• Technical information: request and security logs and limited navigation analytics used to operate the service. Infrastructure providers may process IP addresses and browser or device information when serving requests.

3. How information is used

We use this information to authenticate users, enforce workspace access, deliver and stream permitted evidence, save research work, process requests, support users, diagnose failures, and protect the service. Operational analytics help us understand which parts of Labs are used. Access to Labs does not authorize new uses of interview material or override HeyMilo’s restrictions on using recruiting interview content to train general-purpose or generative AI models.

4. Who can access research information

Eval grants apply to the selected workspace. Members can view granted material, and admins can manage membership. Bookmarks and reviewer notes are scoped to the individual account and workspace; collections can be private or shared with that workspace. Copied links are still subject to access checks. Authorized HeyMilo personnel may process stored information to administer, support, and secure the service. Lawful disclosures and other company-wide sharing practices are described in the HeyMilo Privacy Policy.

5. Service providers

• Clerk manages authentication, invitations, organizations, and roles. Google participates when you choose Google sign-in.
• Vercel hosts the web application and API.
• Neon provides the database and private object storage used for artifact metadata, research records, and media.
• PostHog receives limited product analytics. The app sends account and workspace identifiers, page types, and generated entity IDs. Its analytics allowlist excludes transcript text, recordings, system prompts, search text, comments, and scores. Session replay and automatic interaction capture are disabled.

6. Cookies, browser storage, and analytics

Authentication uses cookies or similar browser storage to maintain your session. The analytics SDK also uses browser identifiers to associate permitted events. You can manage browser storage through your browser settings; blocking authentication storage may prevent sign-in. The current Labs integration does not send advertising events or record your screen. Hosting and authentication providers still receive the technical requests necessary to serve the app. Contact us with questions about analytics or your privacy choices.

7. Retention, security, and location

We retain information for the service purposes described here and in HeyMilo’s Privacy Policy, subject to applicable agreements and legal requirements. Release records and saved research can persist beyond a single session. Removing a bookmark or revoking access does not itself erase an underlying artifact or a copy previously exported by an authorized recipient. We use authenticated access, workspace grants, private media storage, and HTTPS. These controls reduce risk but cannot guarantee absolute security. Processing may occur in the United States or other countries where our providers operate.

8. Requests and privacy rights

For access, correction, deletion, or other privacy requests, contact privacy@heymilo.ai. Include enough information to locate the relevant account or artifact, but do not email recordings or sensitive documents unless requested through an appropriate channel. We may need to verify your identity and coordinate with the organization responsible for supplied material. Applicable rights, legal bases, regional disclosures, and complaint options are described in the HeyMilo Privacy Policy.

9. Contact and updates

Labs is intended for adult research and business users. Contact privacy@heymilo.ai about this notice, an unintended disclosure, or information relating to a child. We will update the date above when this notice changes and provide additional notice where required.