Privacy Policy

1. Introduction

Welcome to Overmainlab AI ("Overmainlab," "we," "our," or "us"). We are committed to protecting your privacy and handling your personal information with transparency, care, and respect. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website at overmainlab.com, sign up for our waitlist, or otherwise interact with our services (collectively, the "Services").

This Privacy Policy applies to all users of our Services, regardless of location. It is designed to comply with applicable privacy laws and regulations, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the General Data Protection Regulation (GDPR) and UK GDPR, and other applicable US state privacy laws.

Please read this Privacy Policy carefully before using our Services. By accessing or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this policy. If you do not agree with any part of this policy, please do not use our Services.

If you have any questions about this Privacy Policy or how we handle your information, please contact us at privacy@overmainlab.com before using our Services.

2. Information We Collect

We collect several types of information in connection with the Services. The types and amount of information we collect depend on how you interact with us.

2.1 Information You Provide Directly

We collect information that you voluntarily provide to us when you:

• Join our waitlist: When you sign up for early access to our products, we collect your email address. We may also collect your name if you choose to provide it, and optionally your professional background or use case if prompted in the waitlist form.
• Contact us: If you reach out to us via email or contact forms, we collect your name, email address, and the content of your message.
• Apply for a job: If you apply for a position at Overmainlab, we collect your name, email address, resume, cover letter, LinkedIn profile URL, and any other information you choose to provide in your application.
• Subscribe to updates: If you opt in to receive news and product updates, we collect your email address and any preferences you specify.

2.2 Information Collected Automatically

When you visit our website, we and our service providers automatically collect certain technical information about your device and how you interact with our Services. This includes:

• Device information: Your device type, operating system and version, browser type and version, screen resolution, device language and locale settings, and device identifiers.
• Log data: Your IP address (which may be used to approximate your general geographic location at the city or country level), the date and time of your visit, pages or screens you viewed, time spent on each page, links you clicked, referring URLs (the webpage that directed you to ours), and other standard server log information.
• Usage data: How you interact with our website, including which features you use, the sequence of pages you visit, scroll depth, mouse movements, and other behavioral signals that help us understand how people use and experience our site.
• Cookies and similar technologies: We use cookies, web beacons, pixel tags, local storage, and similar tracking technologies to collect information about your activity on our site. Please see Section 4 for more detail on our cookie practices.
• Performance data: Information about errors, crashes, load times, and other performance metrics that help us maintain and improve the reliability of our Services.

2.3 Information from Third Parties

We may receive information about you from third parties, including:

• Analytics providers: Services like Google Analytics may provide us with aggregated and anonymized reports about how visitors use our website.
• Advertising platforms: If we run advertising campaigns, platforms may share limited data about how users interacted with our ads before visiting our site.
• Business partners: If you interact with our Services through a partner's platform, that partner may share information with us consistent with their own privacy policy.
• Publicly available sources: We may collect publicly available information about organizations or individuals as part of our product development and research activities.

2.4 Sensitive Personal Information

We do not intentionally collect sensitive personal information such as government identification numbers, financial account information, health data, biometric data, precise geolocation, racial or ethnic origin, religious beliefs, sexual orientation, or immigration status. Please do not submit such information through our Services.

3. How We Use Your Information

We use the information we collect for the following purposes, each grounded in a lawful basis where required by applicable law:

3.1 Providing and Improving Our Services

• To manage your waitlist registration and notify you when our products become available to you
• To respond to your inquiries, questions, and support requests
• To process job applications and communicate with candidates
• To analyze how visitors use our website so we can improve navigation, content, and user experience
• To test and develop new features, products, and services
• To monitor and improve the performance, security, and reliability of our Services
• To diagnose and fix technical problems, bugs, and errors

3.2 Communications

• To send you important updates about our Services, including changes to our terms, policies, or features
• To send you product announcements, newsletters, and promotional content — but only if you have opted in to receive such communications
• To send you transactional messages related to your waitlist registration or account
• To respond to your communications and follow up on inquiries

3.3 Legal and Compliance

• To comply with applicable laws, regulations, and legal obligations
• To enforce our Terms of Service and other agreements
• To protect the rights, property, and safety of Overmainlab, our users, and the public
• To detect, investigate, and prevent fraudulent, harmful, or illegal activity
• To respond to lawful requests from courts, government agencies, and law enforcement

3.4 Research and Development

• To conduct internal research and analytics to better understand user needs and preferences
• To develop and train AI models, using only aggregated, anonymized, or appropriately consented data
• To identify trends in how people interact with AI products and services

3.5 Legal Bases for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and Switzerland, we process your personal data under the following legal bases:

Purpose	Legal Basis
Waitlist registration and notifications	Performance of a contract / Consent
Responding to inquiries	Legitimate interests / Performance of a contract
Website analytics and improvement	Legitimate interests
Marketing communications	Consent
Security and fraud prevention	Legitimate interests / Legal obligation
Compliance with legal obligations	Legal obligation
Job applications	Performance of a contract / Legitimate interests

Where we rely on legitimate interests, we have conducted a balancing test and determined that our interests are not overridden by your privacy rights. You have the right to object to processing based on legitimate interests — see Section 7 for how to exercise this right.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our website, understand how you use our Services, and personalize content. This section explains what these technologies are and how we use them.

4.1 What Are Cookies?

Cookies are small text files stored on your device (computer, smartphone, or tablet) when you visit a website. They allow websites to remember your preferences, understand how you navigate the site, and improve your experience over time. Cookies are widely used and do not typically contain personally identifiable information on their own.

4.2 Types of Cookies We Use

Category	Purpose	Examples
Essential / Strictly Necessary	Required for the website to function properly. These cannot be disabled without breaking core functionality.	Session management, security tokens, cookie consent preferences (oml_cookie_consent)
Analytics & Performance	Help us understand how visitors interact with our website, which pages are most visited, and where users encounter issues.	Google Analytics (_ga, _gid), page view tracking, scroll depth measurement
Functional	Enable enhanced functionality and personalization based on your preferences and interactions.	Language preference, regional settings, UI customization
Marketing & Targeting	Used to deliver relevant advertising and track the effectiveness of campaigns. Only active with your explicit consent.	Social media pixels, retargeting cookies

4.3 Local Storage

In addition to cookies, we use browser local storage to save your cookie consent preference (oml_cookie_consent). This allows us to respect your choice across visits without setting an additional cookie.

4.4 Managing Your Cookie Preferences

You can manage your cookie preferences in the following ways:

• Our cookie banner: When you first visit our site, you will see a cookie consent banner. You can accept or decline non-essential cookies from this banner. Your preference is saved in your browser's local storage.
• Browser settings: Most browsers allow you to refuse or delete cookies through their settings menus. Please be aware that disabling cookies may affect the functionality of our website and other sites you visit. Check your browser's help documentation for instructions.
• Opt-out tools: You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on. For other third-party advertising cookies, you can use the DAA opt-out tool or the NAI opt-out tool.
• Do Not Track: Some browsers offer a "Do Not Track" (DNT) signal. We honor DNT signals where technically feasible. Note that there is no uniform standard for how websites should respond to DNT signals.

For more detailed information about the specific cookies we use, please see our Cookie Policy.

5. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes. Ever. We are committed to this principle and will not change it without providing you advance notice and, where required by law, obtaining your explicit consent.

We may share your information in the following limited circumstances:

5.1 Service Providers

We share personal information with trusted third-party service providers who perform services on our behalf and under our instructions. These companies are contractually obligated to use your information only as directed by us and in accordance with this Privacy Policy. Our service providers include:

• Cloud infrastructure providers: For hosting our website and storing data securely
• Analytics services: Such as Google Analytics, for understanding website usage patterns
• Email service providers: For sending transactional and marketing emails to waitlist members
• Customer support tools: If applicable, platforms for managing support inquiries
• Payment processors: If and when we offer paid services, to securely process transactions
• Recruiting platforms: To manage job applications and candidate communications

5.2 Business Transfers

If Overmainlab undergoes a merger, acquisition, reorganization, sale of assets, or bankruptcy proceedings, your personal information may be transferred as part of that transaction. We will notify you by email and/or a prominent notice on our website before your personal information is transferred and becomes subject to a different privacy policy. We will use commercially reasonable efforts to ensure that any acquiring party honors commitments made in this Privacy Policy.

5.3 Legal Requirements

We may disclose your personal information when we believe in good faith that disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or enforceable governmental request
• Enforce our Terms of Service, including investigation of potential violations
• Detect, prevent, or address fraud, security issues, or technical problems
• Protect the rights, property, or safety of Overmainlab, our users, or the public as required or permitted by law

5.4 Aggregated and Anonymized Data

We may share aggregated, de-identified, or anonymized information that cannot reasonably be used to identify you. For example, we may publish aggregate statistics about how many people joined our waitlist in a given month, or share anonymized usage patterns with research partners. Such data is not personal information and is not subject to this Privacy Policy.

5.5 With Your Consent

We may share your information for purposes not described in this Privacy Policy with your explicit consent. We will clearly describe the purpose and recipients before requesting such consent, and you will always be able to withdraw your consent.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, comply with our legal obligations, resolve disputes, and enforce our agreements. The specific retention period depends on the type of information and why we collected it.

Data Type	Retention Period	Rationale
Waitlist email addresses	Until product launch + 24 months, or until you unsubscribe	To notify you when the product launches; to send relevant communications with your consent
Contact form submissions	3 years from last contact	To provide context for ongoing communications and resolve any disputes
Website analytics data	Up to 26 months (Google Analytics default)	To understand long-term usage trends and improve the site
Server log files	Up to 90 days	For security monitoring and debugging purposes
Job application data	Active candidates: until hired/declined; declined candidates: 2 years (with consent)	Legal compliance; future role matching with consent
Cookie consent records	Until you clear local storage or withdraw consent	To honor your stated preferences

When personal information is no longer needed, we will either delete it securely or anonymize it so that it can no longer be linked to you. If you request deletion of your data, we will comply within the timeframes required by applicable law (typically 30–45 days), subject to any legal obligation we may have to retain certain information.

Please note that even if we delete your data from our active systems, residual copies may remain in backups for a period of time consistent with our backup and disaster recovery practices. Such copies will be deleted in the ordinary course of backup rotation.

7. Your Rights and Choices

Depending on where you live, you may have specific legal rights regarding your personal information. We are committed to honoring these rights regardless of your location, to the extent technically feasible.

7.1 Rights for All Users

• Opt out of marketing communications: You can unsubscribe from marketing emails at any time by clicking the "unsubscribe" link in any email we send you, or by contacting us at privacy@overmainlab.com. We will process your request within 10 business days.
• Cookie preferences: You can adjust your cookie preferences using the tools described in Section 4.
• Access your information: You can request a copy of the personal information we hold about you.
• Correct your information: You can request that we correct inaccurate or incomplete personal information.
• Delete your information: You can request that we delete your personal information, subject to certain exceptions.

7.2 California Residents (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (such as information needed to complete a transaction, detect security incidents, comply with legal obligations, or exercise free speech).
• Right to Correct: You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal information for cross-context behavioral advertising. As stated above, we do not sell or share your personal information for these purposes.
• Right to Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of sensitive personal information to what is necessary to provide the services you requested. We do not collect or use sensitive personal information beyond what is necessary.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge different prices, provide a different quality of service, or suggest that you will receive different treatment for exercising your rights.

To exercise your California rights, please submit a request to privacy@overmainlab.com with "California Privacy Request" in the subject line. We will verify your identity before processing your request and respond within 45 days (with the possibility of a 45-day extension if necessary).

California residents may also submit a request through an authorized agent. If you use an authorized agent, we may require additional verification to confirm the authorization.

California "Shine the Light" Law: California Civil Code Section 1798.83 permits California residents to request information about how we share personal information with third parties for their direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes without your consent.

7.3 European Economic Area, UK, and Swiss Residents (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR:

• Right of Access (Article 15): You have the right to obtain confirmation of whether we process personal data about you, and to receive a copy of that personal data along with information about how it is used.
• Right to Rectification (Article 16): You have the right to request correction of inaccurate personal data and to have incomplete personal data completed.
• Right to Erasure / "Right to be Forgotten" (Article 17): You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purpose for which it was collected, you withdraw consent, or you object to processing and there are no overriding legitimate interests.
• Right to Restriction of Processing (Article 18): You have the right to request that we restrict processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or have objected to processing.
• Right to Data Portability (Article 20): You have the right to receive your personal data in a structured, commonly used, machine-readable format, and to transmit that data to another controller, where processing is based on consent or contract and carried out by automated means.
• Right to Object (Article 21): You have the right to object to processing of your personal data based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless processing is necessary for the establishment, exercise, or defense of legal claims.
• Rights Related to Automated Decision-Making (Article 22): You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently make such automated decisions.
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to the withdrawal.

To exercise any of these rights, contact us at privacy@overmainlab.com. We will respond within 30 days. If we are unable to comply with your request, we will explain why.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority. In the EEA, you can find your local supervisory authority at edpb.europa.eu. In the UK, the supervisory authority is the Information Commissioner's Office (ICO).

7.4 Other US State Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with comprehensive privacy laws have similar rights to access, correct, delete, and opt out of certain uses of their personal data. We honor these rights regardless of your state. Please contact us at privacy@overmainlab.com to submit a request.

8. Security

We take the security of your personal information seriously and implement a variety of technical, administrative, and physical safeguards designed to protect it from unauthorized access, use, disclosure, alteration, or destruction.

8.1 Security Measures

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using industry-standard TLS (Transport Layer Security) protocols.
• Encryption at rest: Personal information stored in our systems is encrypted at rest using AES-256 or equivalent encryption standards.
• Access controls: We limit access to personal information to employees, contractors, and service providers who need it to do their jobs. Access is granted on a need-to-know basis and is subject to strict confidentiality obligations.
• Authentication: We use strong authentication mechanisms, including multi-factor authentication (MFA), for access to systems containing personal data.
• Security monitoring: We monitor our systems for suspicious activity and maintain incident response procedures.
• Regular reviews: We conduct periodic reviews of our security practices and update them as needed to address new threats and vulnerabilities.
• Vendor security: We evaluate the security practices of our service providers and require them to maintain appropriate security measures for any personal information they process on our behalf.

8.2 Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities as required by applicable law. For GDPR purposes, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach, and we will notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms.

8.3 Limitations

While we strive to protect your personal information, no security system is impenetrable. We cannot guarantee the absolute security of our systems or the information you transmit to us. You should also take precautions to protect your own devices and accounts, such as using strong and unique passwords and keeping your software updated.

If you believe your personal information has been compromised or if you notice any unauthorized activity, please contact us immediately at privacy@overmainlab.com.

9. Children's Privacy

Our Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe that your child under the age of 13 has provided us with personal information without your consent, please contact us immediately at privacy@overmainlab.com.

Upon receiving such notice, we will take steps to delete the information from our systems as quickly as reasonably possible. We do not knowingly sell the personal information of minors under 16 years of age without affirmative authorization.

If you are between 13 and 17 years of age, we encourage you to review this Privacy Policy with a parent or guardian before using our Services. By using our Services, you represent that you are at least 13 years of age.

In jurisdictions where the age of digital consent is higher than 13 (for example, 16 in many EU member states), we will apply the higher age requirement when processing data of individuals in those jurisdictions. If you are aware that we have collected data from a child without appropriate consent, please notify us at privacy@overmainlab.com.

10. International Data Transfers

Overmainlab is based in San Francisco, California, United States. If you are accessing our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States or other countries where our service providers operate.

The United States and other countries may not provide the same level of data protection as your home country. However, we take steps to ensure that your information receives an adequate level of protection wherever it is processed.

10.1 Transfers from the EEA, UK, and Switzerland

For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to countries not recognized as providing an adequate level of data protection, we rely on appropriate safeguards, including:

• Standard Contractual Clauses (SCCs): We use the European Commission's Standard Contractual Clauses with our international service providers and data processors.
• UK International Data Transfer Agreements: For UK data subjects, we use the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs.
• Adequacy Decisions: Where the European Commission or UK has issued an adequacy decision for the destination country, we rely on that decision.

You may request a copy of the relevant transfer mechanisms by contacting us at privacy@overmainlab.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make changes, we will:

• Update the "Last updated" date at the top of this page
• Post the new Privacy Policy on this page
• If the changes are material, notify you by email (if you are on our waitlist or have otherwise provided your email address) and/or by placing a prominent notice on our website
• Where required by applicable law, obtain your consent before implementing material changes

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of our Services after the effective date of any changes constitutes your acceptance of the revised Privacy Policy.

If you disagree with any changes to this Privacy Policy, you should stop using our Services and may request deletion of your personal information by contacting us at privacy@overmainlab.com.

We will maintain an archive of prior versions of this Privacy Policy and make them available upon request.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please do not hesitate to reach out to us. We take privacy inquiries seriously and will respond as promptly as possible.

For general inquiries not related to privacy, you may also reach us through our main contact page.

If you are a resident of the EEA or UK and wish to escalate a complaint that we have not resolved to your satisfaction, you have the right to lodge a complaint with your local supervisory authority. We would, however, appreciate the chance to address your concerns before you approach a supervisory authority — please contact us first and give us the opportunity to resolve your issue.

For GDPR purposes, Overmainlab AI acts as a data controller for the personal information described in this Privacy Policy. We do not currently have a formal EU or UK representative designated under Article 27 of the GDPR, as our current volume of EU/UK data processing does not require one, but we are committed to responding to all inquiries from EU and UK data subjects promptly and fully.

This Privacy Policy was last updated on March 12, 2026 and is effective as of that date.