Cavellin LLC
PRIVACY POLICY

Cavellin does NOT sell your personal information. Cavellin does NOT share your contract data, analysis results, or personal information with employers, prospective employers, staffing agencies, or recruiters. Only you can access your analyses.

1. Who We Are

Cavellin LLC is a Montana limited liability company that provides AI-powered physician employment contract analysis. Privacy inquiries can be directed to hello@cavellin.com.

2. Information We Collect

Information You Provide

• Account information: name, email address, password (stored as a hash, never plaintext).
• Professional information: specialty, subspecialty, career stage, practice setting, used to personalize your analysis.
• Contract documents: the employment contract or other documents you upload for analysis. These are private to your account.
• Payment information: billing email and a Stripe customer identifier. Cavellin does not store full payment card numbers. Payment processing is governed by Stripe's terms and privacy policy.
• Communications: support tickets and messages you send us.

Information Collected Automatically

• Usage data: pages viewed, features used, device and browser type, approximate location derived from IP address.
• Log data: timestamps, request identifiers, error traces.
• Cookies: essential cookies for authentication and session management. We do not use third-party advertising cookies. Some browsers transmit Do Not Track signals. There is no industry-standard response to those signals, and we do not change our data practices in response to them. We do not allow third-party advertising networks to collect personally identifiable information about your activity on the Service.

3. How We Use Your Information

• To operate, secure, and provide the Service, including processing your contract and generating your analysis.
• To personalize your analysis based on your specialty and practice setting.
• To communicate with you about your account, security notices, and material policy changes.
• To respond to support requests and improve reliability.
• To comply with legal obligations and enforce our Terms of Service.
• To generate aggregated, de-identified market insights that do not identify you individually.

We do not use your contract content to train third-party general-purpose AI models. We may use de-identified, aggregated data to improve Cavellin's own analysis accuracy.

4. How We Share Information

We do not share your contract data or analysis results with:

• Your employer or prospective employer
• Staffing agencies or physician recruiters
• Any third party for marketing or advertising purposes

Service Providers

We work with limited service providers for:

• Payment processing
• Infrastructure hosting
• Security services
• AI analysis

To generate your analysis, your contract text is processed by third-party AI model providers through our platform's AI integration, under terms requiring confidentiality. Your contract content is used only to produce your analysis and is not used to train general-purpose AI models. Payment, hosting, and security providers do not have access to employer names, contract details, or individualized analysis results.

Legal and Safety

We may disclose information if required by law, legal process, or lawful government request, or to protect the rights, safety, or property of Cavellin or our users. Where permitted, we will notify you of government requests targeting your data.

Business Transfers

If Cavellin is involved in a merger, acquisition, or sale of assets, your information may be transferred, subject to this Privacy Policy.

5. Data Retention

• Account information: retained while your account is active, plus up to 30 days after deletion for backups.
• Contract documents (uploaded PDFs): retained for up to 12 months from upload, then deleted from active systems. You may request earlier deletion at any time by contacting hello@cavellin.com or by deleting the associated analysis from your account.
• Analysis results: retained while your account is active. You may delete individual analyses from My Analyses at any time.
• Payment records: 7 years after transaction, as required for financial record-keeping.
• Support communications: up to 3 years.
• Security logs: up to 13 months.

6. Your Privacy Rights

Depending on where you live, including under the Montana Consumer Data Privacy Act, you have some or all of the following rights:

• Access: request a copy of the information we hold about you.
• Correct: ask us to correct inaccurate information.
• Delete: request deletion of your account and associated data, subject to legal retention requirements.
• Portability: receive an export of your data.
• No sale or targeted advertising: Cavellin does not sell personal information and does not use personal information for targeted advertising.
• Non-discrimination: we will not deny service or degrade quality because you exercised a privacy right.
• Appeal: if we deny a request, you may appeal by emailing hello@cavellin.com with "Privacy Appeal" in the subject line.

To exercise any right, email hello@cavellin.com. We will verify your identity and respond within 45 days, extendable once by an additional 45 days with notice.

7. For California Residents

This section applies to California residents and supplements the rest of this Privacy Policy. If anything in this section conflicts with another section, this section controls for California residents.

• Categories of personal information collected. The categories we collect are listed in Section 2. They include account information (name, email address, hashed password), professional information (specialty, subspecialty, career stage, practice setting), contract documents you upload, payment information (billing email and a Stripe customer identifier), communications, usage data, log data, and essential cookies.
• Categories of third parties receiving personal information. The categories of recipients are listed in Section 4. They include service providers (application platform and hosting, cloud infrastructure, payment processor, AI analysis provider, productivity tools), legal and regulatory authorities where required, and any successor entity in a business transfer.
• How to review or change your information. You can review and update your account information by signing in and editing your profile. To request changes we can make on your behalf, email hello@cavellin.com.
• Notice of policy changes. We will notify you of material changes as described in the Changes to This Policy section.
• Do Not Track. We do not change our data practices in response to browser Do Not Track signals, as described in Section 2.
• Third-party collection on the Service. We do not authorize third parties to collect personally identifiable information about your activity on the Service across other websites or services.
• Direct marketing disclosure. We do not share personal information with third parties for those third parties' own direct marketing purposes. If our practices change, California residents can request a notice describing the categories of personal information shared and the names and addresses of the recipients by emailing hello@cavellin.com with "California Direct Marketing Request" in the subject line.
• Minors under 18. California residents under 18 who are registered users can request removal of content or information they have posted by emailing hello@cavellin.com with "Minor Removal Request" in the subject line. Removal of publicly visible content does not ensure complete removal from our systems or from copies others may have made.

8. Security

We use encryption in transit (TLS) and at rest, access controls, and authentication requirements to protect your data. See our Security Policy for details. In the event of a data breach affecting your personal information, we will notify you without undue delay and within the timeframes required by applicable law. No method of transmission or storage is completely secure.

9. Children's Privacy

The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn we have collected personal information from a child under 13, that information will be deleted from active systems without delay and the related account will be terminated. Parents or guardians who believe we may have collected information from a child under 13 can email hello@cavellin.com with "Children's Privacy" in the subject line, and we will investigate and delete the information.

10. International Users

Cavellin is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States.

11. Changes to This Policy

We will post material changes at least 30 days before they take effect and notify you by email where required. Your continued use after the effective date constitutes acceptance.

12. Contact

Cavellin LLC · hello@cavellin.com · cavellin.com