Cavileo is built on a foundation of data responsibility. This policy explains what we collect, why we collect it, and how we protect it — for both our customers and the employees they monitor.
Cavileo, Inc. ("Cavileo," "we," "us," or "our") operates a workforce intelligence platform that helps employers identify potential overemployment risk among their remote and hybrid workforces. This Privacy Policy describes how we collect, use, store, share, and protect information in connection with our services, website, and platform (collectively, the "Services").
This policy applies to:
By using our Services, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Services.
Cavileo, Inc. is a Delaware corporation with its principal place of business in the United States. We are the data controller for information collected directly through our website and platform. For employee roster data submitted by Customers, we act as a data processor operating on behalf of the Customer (the data controller).
Our Data Protection contact can be reached at: privacy@cavileo.com
We collect information in three ways: directly from Customers, from Monitored Individuals via public sources, and automatically through your use of our website.
| Category | Data Types | Source |
|---|---|---|
| Account & Billing | Company name, contact name, email, billing address, payment method (tokenized) | Provided by Customer |
| Employee Roster | Employee name, work email, job title, department, start date, employment type | Uploaded by Customer |
| Public OSINT Signals | Public social media profiles, public social media handles, publicly listed job titles, resume submissions, public work submissions, code respositories, public activity timestamps | Gathered by Cavileo from various public and private sources |
| Risk Scores & Events | Risk score (0–100), score history, analyst review notes, event log entries | Generated by Cavileo and our partners |
| Usage & Log Data | IP address, browser type, pages visited, feature usage, login timestamps | Collected automatically |
| Communications | Support tickets, email correspondence, demo request submissions, sales inquiries | Provided by Customer or User |
We use the data we collect for the following purposes:
We do not use personal data for automated decision-making that produces legal effects on Monitored Individuals. Risk scores are intelligence tools provided to Customers — employment decisions remain solely with the Customer.
A core component of the Cavileo platform involves gathering and analyzing publicly available information about individuals submitted to us by Customers. This practice — known as Open Source Intelligence (OSINT) — is distinct from invasive monitoring and operates within established legal frameworks.
How OSINT data is processed:
Legal basis for OSINT collection: The collection of publicly available information for legitimate business purposes is lawful under U.S. law. Employers have a recognized interest in ensuring workforce integrity, and the monitoring of public-facing information does not constitute a violation of reasonable privacy expectations in publicly accessible spaces. Customers remain responsible for ensuring their use of Cavileo complies with applicable employment law in their jurisdiction.
We do not sell personal data. We do not share personal data for advertising purposes. We share data only in the following limited circumstances:
We retain data only as long as necessary to provide the Services or as required by law:
Customers may request deletion of their data and all associated employee records at any time by contacting privacy@cavileo.com. Deletion requests are processed within 30 days. Certain data may be retained longer where required by legal obligation.
We implement industry-standard technical and organizational measures to protect data against unauthorized access, loss, alteration, or disclosure:
No method of electronic transmission or storage is 100% secure. In the event of a data breach that affects your data, we will notify you in accordance with applicable law.
Depending on your location and role, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us at privacy@cavileo.com. We will respond within 30 days. Note: for data about Monitored Individuals submitted by a Customer, requests should be directed to the relevant employer (the data controller), who will coordinate with Cavileo as needed.
If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including the right to know, delete, correct, and opt out of the sale or sharing of personal information.
Cavileo does not sell or share personal information for cross-context behavioral advertising.
To submit a California privacy rights request, contact us at privacy@cavileo.com with the subject line "California Privacy Request." We will respond within 45 days. You may designate an authorized agent to make a request on your behalf.
We do not discriminate against individuals who exercise their California privacy rights.
For Customers operating in the European Union or United Kingdom, or processing data about individuals located in those regions, the General Data Protection Regulation (GDPR) and UK GDPR apply.
Legal basis for processing: We process Customer account data on the basis of contractual necessity. We process employee roster data submitted by Customers on the basis of the Customer's legitimate interests or legal obligations (the Customer determines and is responsible for the lawful basis).
International transfers: Data is stored and processed in the United States. For EU/UK Customers, transfers are governed by Standard Contractual Clauses (SCCs). Please contact us to execute a Data Processing Agreement (DPA).
EU/UK individuals may lodge a complaint with their local supervisory authority if they believe their data has been processed unlawfully.
Our website uses a minimal set of cookies to operate and improve the service:
We do not use advertising cookies or allow third-party advertising trackers on our platform. You can control cookies through your browser settings.
The Cavileo platform is designed for use by business professionals and is not directed at children under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected information from a child under 16, we will delete it promptly. If you believe we have collected such information, please contact us at privacy@cavileo.com.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify Customers by email and/or by displaying a prominent notice in the platform at least 30 days before the change takes effect.
The "Last Updated" date at the top of this page reflects the most recent revision. Your continued use of the Services after the effective date constitutes acceptance of the updated policy.
For privacy-related inquiries, data requests, or to report a concern, please reach out through any of the following channels:
Email: privacy@cavileo.com
General: hello@cavileo.com
Mail: Cavileo, Inc., Attn: Privacy, [Address], United States
We aim to respond to all privacy inquiries within 5 business days and to fulfill verifiable data requests within 30 days.