Privacy Policy

This Privacy Policy for Tablise Technologies Inc. (doing business as "Virvell") ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at https://virvell.ai or any website of ours that links to this Privacy Policy.
• Use Virvell. Virvell is an artificial intelligence (AI)-powered conversational intelligence platform for talent teams that automates critical hiring conversations across the employee lifecycle. Our platform uses voice AI technology to conduct structured conversations at scale, providing behavioral insights and analytics to help companies make better hiring decisions and manage talent effectively.
• Engage with us in other related ways, including any sales, marketing, or events.

By accessing or using the Services, you acknowledge and accept this Privacy Policy. If you do not agree, you must refrain from using the Services.

Categories of Personal Information We Collect

1. Information You Disclose to Us

We collect personal information that you choose to provide to us when you register for the Services, request information about our company or our products and Services, participate in activities on the Services, or otherwise communicate with us.

Personal Information Provided by You. The personal information that we collect depends on the context of your interactions with us and the Services, the choices you make, and the products and features you use. The personal information we collect may include the following: names; phone numbers; email addresses; job titles; usernames; passwords; billing addresses; debit/credit card numbers.

Sensitive Information. When necessary, with your consent or as otherwise permitted by applicable law, we process the following categories of sensitive information: financial data; voice recordings and transcripts; employment history and performance data; professional reference assessments.

When our customers use the Services to conduct screening or reference-check conversations, we may collect and generate: (a) the audio of the conversation, (b) a transcript, (c) conversation metadata (such as call date/time, duration, and interaction logs), and (d) derived outputs such as summaries, scores, or screening reports. We provide a notice at the beginning of calls that the call may be recorded, transcribed, and analyzed (including automated analysis). Where required by law, consent is obtained before recording/transcription begins. Where a participant does not consent to recording or automated processing, a customer may offer an alternative method to complete the reference check (for example, a live human call or a written questionnaire), subject to the customer's processes.

Payment Data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number, and the security code associated with your payment instrument. All payment data is handled and stored by Stripe. You may find their privacy policy link(s) here: https://stripe.com/privacy.

You are responsible for ensuring that the personal information you provide to us is accurate, complete, and up to date, and for informing us of any changes.

2. Information Automatically Collected

We automatically collect certain information when you access, use, or navigate the Services. This information generally does not identify you directly (for example, by name or contact details), but it may include device and usage data such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country or approximate location, information about how and when you interact with the Services, and other technical information. We use this information primarily to operate and secure the Services and for internal analytics and reporting purposes.

The information we collect may include:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called "crash dumps"), and hardware settings).
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
• Location Data. We may infer your approximate location (for example, city/province/state) from your IP address for security, fraud prevention, and analytics. We do not intentionally collect precise GPS location unless you explicitly enable device location permissions for a specific feature, in which case you can disable that permission in your device settings.

3. Information Collected from Other Sources

To help us keep our records current and provide marketing, offers, and services that may be relevant to you, we may receive information about you from other sources, including public databases, joint marketing partners, affiliate programs, data providers, and other third parties. This information may include mailing addresses, job titles, email addresses, phone numbers, intent or behavioral data, IP addresses, and social media profile information (such as profile identifiers and URLs). We may use this information to support activities such as targeted advertising and event promotion.

How We Use and Process Personal Information

We use and process your personal information for various purposes, depending on how you interact with the Services, including the following:

• Account management. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• Service delivery. We may process your information to provide you with the requested service.
• User support. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• Administrative communications. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• Order fulfillment. We may process your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services.
• Feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• Service protection. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• Service improvement. We may process your information when we believe it is necessary to identify usage trends, determine the effectiveness of our promotional campaigns, and to evaluate and improve our Services, products, marketing, and your experience.
• Usage analysis. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• Legal compliance. We may process your information to comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.
• Voice AI reference checks. We use voice recordings and personal information to conduct automated reference check conversations via AI, transcribe the conversations, analyze responses, and generate comprehensive screening reports for our customers.
• AI model improvement. Where permitted by applicable law and our contracts, we may use de-identified and/or aggregated conversation data (including transcripts, conversation metadata, and derived outputs) to improve model quality, safety, and features. "De-identified" means we apply measures designed to remove direct identifiers and reduce the likelihood that the data can reasonably be linked back to an identifiable individual. We do not attempt to re-identify de-identified data except as permitted by law to test the effectiveness of our de-identification measures. Where required by law, we will obtain consent before using personal information for model training, and where available we provide a way to opt out.

Our Authority to Collect and Use Personal Information

We collect and use personal information with your consent, which may be express or implied depending on the sensitivity of the information and the circumstances. You may withdraw your consent at any time, subject to legal or contractual restrictions.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including, for example:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
• For identifying injured, ill, or deceased persons and communicating with next of kin
• If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
• If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
• If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
• If the collection is solely for journalistic, artistic, or literary purposes
• If the information is publicly available and is specified by the regulations
• We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments

Disclosure of Personal Information

We may disclose personal information in the circumstances described below and to the following categories of third parties.

Vendors, Consultants, and Other Third-Party Service Providers. We may share your data with third-party vendors, service providers, contractors, or agents ("third parties") who perform services for us or on our behalf and require access to such information to do that work. We have contracts in place with our third parties, which are designed to help safeguard your personal information. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will also not share your personal information with any organization apart from us. They also commit to protect the data they hold on our behalf and to retain it for the period we instruct.

We may disclose personal information to the following categories of third parties, as applicable: AI platforms; cloud computing service providers; communication and collaboration tools; data analytics providers; payment processors; performance monitoring tools; website hosting providers; and voice transcription and conversation intelligence service providers.

We may also disclose your personal information in certain situations, including the following. First, in connection with a business transaction, we may share or transfer information as part of, or in preparation for, a merger, sale of company assets, financing, reorganization, or acquisition of all or part of our business. Second, we may share information with business partners where necessary to offer or deliver certain products, services, or promotions.

Cookies and Similar Technologies

We use cookies and similar tracking technologies, such as web beacons and pixels, to collect information when you interact with the Services. Certain technologies are used to support core functionality and security, including maintaining the security of the Services and your account, preventing crashes, troubleshooting and fixing bugs, remembering your preferences, and enabling basic site features.

We may also allow third-party service providers to place or use tracking technologies on the Services for analytics and, where applicable, advertising purposes. These technologies may help us measure and improve performance, manage and display advertisements, tailor ads to your interests, or send reminders such as abandoned cart messages (depending on your communication preferences). These third parties may use their technologies to provide interest-based advertising that may appear on our Services or on other websites.

To the extent that any such activity constitutes a "sale" or "sharing" of personal information, or targeted advertising, as defined under applicable U.S. state privacy laws, you may opt out by submitting a request as described in the section titled "Do United States Residents Have Specific Privacy Rights?".

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Policy: https://virvell.ai/cookies.

Google Analytics

We may share your information with Google Analytics to track and analyze the use of the Services. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.

Use of Artificial Intelligence and Automated Processing

As part of the Services, we may offer products, features, or tools that use artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These AI Products are intended to support and enhance the functionality of the Services and provide additional capabilities. This Privacy Policy applies to and governs our collection, use, and disclosure of personal information in connection with your use of the AI Products.

Use of AI Technologies

We make certain AI Products available through third-party service providers (each, an "AI Service Provider"), which may include OpenAI, Anthropic, and VAPI. In order to provide the AI Products, information you submit through the Services, information generated through your use of the AI Products (such as outputs), and related personal information may be disclosed to and processed by these AI Service Providers, as described in this Privacy Policy and in the section titled "Disclosure of Personal Information." You are responsible for ensuring that your use of the AI Products complies with the applicable terms and policies of the relevant AI Service Provider.

Our AI Products

Our AI Products may be used to support functions such as natural language processing, machine learning-based analysis, workflow automation, insights generation, and predictive analytics.

How We Process Your Data Using AI

Any personal information processed in connection with our AI Products is handled in accordance with this Privacy Policy and, where applicable, our agreements with third-party service providers. We implement safeguards designed to protect personal information throughout processing, including when information is processed by service providers on our behalf.

How to Opt Out

Where an opt-out is available, you may manage your preferences by logging into your account and updating your settings.

Retention of Personal Information

We retain personal information only for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law, including for tax, accounting, regulatory, or other legal obligations. In general, we aim to delete or de-identify personal information within twenty-four (24) months after a user's account is terminated, unless we must retain it longer to comply with legal requirements, resolve disputes, enforce our agreements, or maintain appropriate security and audit records.

When we no longer have a business or legal need to retain your personal information, we will delete it or de-identify/anonymize it, as appropriate. If deletion or de-identification is not immediately feasible — for example, because the information is stored in backup or archive systems — we will retain it securely, restrict access, and refrain from further use of the information until it can be deleted or de-identified in accordance with our retention practices.

Security and Safeguards

We maintain reasonable administrative, technical, and organizational safeguards designed to protect the personal information we process. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee that unauthorized third parties will never be able to access, obtain, or alter information. While we take steps intended to protect personal information, you provide and transmit information to and from the Services at your own risk, and you should take appropriate precautions when accessing the Services, including using a secure network and protecting your account credentials.

Children's / Minors' Privacy

The Services are intended for use by adults and are not directed to children. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take reasonable steps to delete it. If you believe a child under 13 has provided us personal information, please contact us at privacy@virvell.ai.

If a customer uses the Services in a context involving minors (for example, internships or student programs), the customer is responsible for providing any required notices and obtaining any legally required consents.

Your Privacy Rights

In Canada and other jurisdictions, you may have certain rights regarding your personal information under applicable privacy laws. Depending on your location and the nature of our relationship with you, these rights may include the right to request access to and receive a copy of the personal information we hold about you, to request correction of inaccurate or incomplete information, and, in some circumstances, to request deletion, restriction, or portability of your information where such rights are recognized by law.

Where required by applicable law, if a decision that produces legal or similarly significant effects is made solely through automated processing, we will inform you of that fact, provide meaningful information about the principal factors involved, and offer a straightforward way to request human review. In certain circumstances, you may also have the right to object to, or withdraw consent for, certain processing.

To exercise your rights, please contact us using the details provided in the "Contact Us" section below. We will review and respond to requests in accordance with applicable privacy laws and any lawful exceptions.

Withdrawing Your Consent

Where we rely on your consent to collect, use, or disclose personal information — whether express or implied, depending on the circumstances and applicable law — you may withdraw your consent at any time by contacting us using the information in the "Contact Us" section below.

Please note that withdrawing consent does not affect the collection, use, or disclosure that occurred before the withdrawal takes effect. It also may not affect processing that is permitted or required by law on a basis other than consent (for example, to comply with legal obligations or to protect the security and integrity of the Services).

Questions or Complaints

If you have concerns about our handling of personal information, we encourage you to contact our Privacy Officer first so we can try to resolve your concern. You may also have the right to file a complaint with the Office of the Privacy Commissioner of Canada or with your applicable provincial privacy regulator.

Opting Out of Marketing and Promotional Communications

You may opt out of receiving marketing and promotional communications from us at any time by using the unsubscribe link in our emails, replying "STOP" or "UNSUBSCRIBE" to our SMS messages (where available), or contacting us using the information in the "Contact Us" section below. Once you opt out, we will stop sending you marketing messages. Please note that we may still send you non-marketing communications, such as service-related notices needed to administer your account, respond to your requests, or otherwise provide the Services.

We do not share mobile phone numbers, SMS opt-in information, or text-message consent data with third parties or affiliates for their marketing or promotional purposes. We may share information with service providers who assist us in delivering support services (for example, customer service or messaging vendors), but only to provide services on our behalf and subject to appropriate contractual restrictions. Except as described above, text messaging opt-in data and consent will not be disclosed to third parties.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account.
• Contact us using the contact information provided.

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our legal terms and/or comply with applicable legal requirements.

Cookies and Similar Technologies

Most Web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features or services of our Services.

Where required by applicable law, we ask for consent before placing non-essential cookies or using similar tracking for analytics and advertising. You can manage your cookie preferences through our cookie banner or by visiting our Cookie Notice at https://virvell.ai/cookies.

If you have questions or comments about your privacy rights, you may email us at privacy@virvell.ai.

Browser Privacy Signals and Global Privacy Control

Some browsers and extensions support privacy preference signals, including "Do Not Track" ("DNT") and the Global Privacy Control ("GPC"). DNT is not subject to a uniform legal or industry standard and we do not respond to DNT signals at this time. Where required by applicable law, we treat GPC as a valid request to opt out of certain disclosures that may constitute "sale" or "sharing" of personal information or targeted advertising. You may also submit an opt-out request using the methods described in "How to Exercise Your Rights."

Do United States Residents Have Specific Privacy Rights?

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have certain privacy rights under applicable law. These rights may include the right to request access to and receive information about the personal information we maintain about you and how it has been used or disclosed, to request correction of inaccurate information, to obtain a copy of your personal information, and to request deletion of your personal information. Depending on your jurisdiction and the circumstances, you may also have the right to withdraw consent to certain processing. These rights are subject to limitations and exceptions under applicable law.

Categories of Personal Information We Collect

The categories below reflect the types of personal information we may collect depending on how you use the Services (for example, website visitors versus platform users). Not all categories apply to every individual. Some categories are listed to satisfy legal definitions and may apply only in limited circumstances.

We collect and use sensitive personal information only where permitted by applicable law and, where required, with your consent. Where we use or disclose sensitive personal information, we do so for specific purposes, including by sharing it with service providers or contractors who perform services on our behalf, subject to appropriate contractual restrictions. Depending on your jurisdiction, you may have the right to limit certain uses or disclosures of sensitive personal information. We do not collect or use sensitive personal information for the purpose of inferring characteristics about you.

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of: receiving help through our customer support channels; participation in customer surveys or contests; and facilitation in the delivery of our Services and to respond to your inquiries.

Your Rights (U.S. Residents)

You have rights under certain U.S. state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:

• Right to know whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request the deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to non-discrimination for exercising your rights
• Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

Depending on the state where you live, you may also have the following rights:

• Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
• Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
• Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
• Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
• Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)
• Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
• Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)

How to Exercise Your Rights

To exercise these rights, you can contact us by visiting https://virvell.ai, by emailing us at privacy@virvell.ai, or by referring to the contact details at the bottom of this document.

Under certain U.S. state privacy laws, you may designate an authorized agent to submit a request on your behalf. We may require the authorized agent to provide proof of valid authorization, and we may deny a request if the agent does not provide sufficient documentation demonstrating authority to act on your behalf in accordance with applicable law.

Request Verification

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.

If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.

Appeals

Under certain U.S. state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at privacy@virvell.ai. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine the Light" Law

California Civil Code Section 1798.83, also known as the "Shine The Light" law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section "Contact Us".

When We Act as a Service Provider/Processor

Our Services are provided primarily to business customers (for example, employers and talent teams). In many cases — such as when a customer uses the Services to conduct screening, interviewing, or reference-check conversations — we process personal information on the customer's behalf and under the customer's instructions. In those circumstances, the customer is responsible for determining the purposes and legal basis for processing (including obtaining any required notices/consents), and for deciding how long to retain customer data and with whom it is shared.

If you are an applicant, candidate, employee, or professional reference interacting with the Services at a customer's request ("Participant"), and you wish to exercise privacy rights or have questions about a customer's use of the Services, please contact the customer directly. We will assist customers in responding to requests as required by applicable law and our contracts. Enterprise customers requiring a Data Processing Agreement (DPA) may review and execute one at https://virvell.ai/dpa.

Cross-Border Transfers

We and our service providers may process, store, and access personal information in Canada, the United States, and other jurisdictions where we or our service providers maintain facilities. As a result, personal information may be subject to the laws of those jurisdictions and may be accessed by courts, law enforcement, or other authorities in accordance with those laws. We use contractual and other safeguards designed to protect personal information when it is processed by service providers on our behalf.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will indicate the effective date of any changes by updating the "Last Updated" date at the top of this Privacy Policy. If we make material changes, we may provide additional notice, such as by posting a prominent notice on the Services or by sending you a direct notification where appropriate. We encourage you to review this Privacy Policy periodically to stay informed about our privacy practices.

How Can You Review, Update, or Delete the Data We Collect from You?

You may have the right to request access to the personal information we hold about you, receive information about how it has been used or disclosed, request correction of inaccurate or incomplete information, or request deletion of your personal information. Where we rely on consent, you may also withdraw your consent to certain processing. These rights are subject to limitations and exceptions under applicable law. To request access, correction, update, or deletion, please email: privacy@virvell.ai.