Isles App Privacy Policy

This Privacy Policy explains what personal information Techstars US LLC ("Isles," "we," "us") collects through the Isles app and related services (the "Service"), how we use and share it, and the choices you have. It is part of our Terms of Service.

In short:

• We collect what you give us (your profile, course answers, and messages) and a small amount of technical information needed to run the app.
• We do not sell your personal information, show you ads, or track you across other apps or websites.
• Your data is stored with our database provider in Singapore.
• Elsy and practice calls are optional. If you give permission, your messages and course context are sent to OpenAI, in the United States, which does not use them to train its models.
• If a message to Elsy or in a practice call suggests you may be in crisis, the app shows you where to get help, and Isles staff read that message so they can reach out to you.
• Our coaching team can see your course answers. They tell your parents nothing about you without your OK.
• You can delete your account and its data in the app at any time.

• Account: your email address, or, if you sign in with Apple, the name and email address Apple shares with us. Apple may share a private relay address instead of your real email. Professionals also give us the invite code they joined with.
• Date of birth: asked when you sign up, only to check that you are 14 or older and to apply the rules for members under 18. It is not shown on your profile.
• Profile: first, family, and display name; gender; schools, degree, major, and graduation year; internships and work history; career and personal interests; what you are looking for; bio; profile photo; and your visa path. Professionals also give their current work and what they are open to.
• Course activity: your answers to lessons and exercises, including free-text reflections and the choices you make in case simulations. Some exercises ask about your work values, hours you are willing to work, whether you prefer to work in the US or China, whether you will need visa sponsorship, how comfortable you are in English-language workplaces, what draws you to a career, family expectations about your career, and your self-reported personality type (MBTI). We also record your progress, such as which screens you completed and when. If you or our staff reset your course, we keep a copy of the earlier answers.
• Study plan: the days you plan to study, the time you want reminders, your time zone, and which planned days you completed or missed.
• Share with Grace: the course pages you choose to send to Grace, as they were when you sent them.
• Capstone call: the time you book, any note you write to Grace (up to 500 characters), the days and times you say suit you, and the call's status.
• Messages: one-to-one messages you send other members, messages in the program group chat, messages with Grace and our support team, reports you file about messages or profiles (including the reason you give), and members you block.
• Elsy: the questions you ask Elsy and Elsy's answers.
• Practice calls: the messages you send in an AI practice call, the AI mentor's replies, notices the app shows during the call, the call's length, how many questions you used, how it ended, and Elsy's notes on the call.
• Safety flags: if a message you send Elsy or send in a practice call suggests you may be in crisis, a record linking to that message, when it was flagged, and when a staff member marked it as seen.
• Connections: connection requests you send or receive and members you save.
• Your permissions: when you accepted these documents, and whether you gave or withdrew permission for AI features, with the version of the text you saw, your IP address, and your device and app version at the time.

Several of these questions are personal. Every course question is part of the learning exercise, and you choose what to write. Leave out anything you would not want stored.

• Usage within the app: when you start and finish modules and sessions, which member recommendations appeared on your screen and what you opened, with timestamps. We use this to run and improve Isles. It is not shared with advertisers.
• Error reports: if the app cannot use your phone's secure storage, it tells us the error and the app's build number, linked to your account, so we can fix it.
• Push notification token: if you allow notifications, we store a token that lets us send them to your device.
• Server logs: our hosting providers record technical information such as IP address, device and app version, and request times, to operate and secure the Service.

We do not collect your precise location, your contacts, or advertising identifiers, and the app contains no third-party analytics or advertising code.

• Photos: only when you choose a profile photo. We receive only the photo you pick.
• Notifications: only if you allow them. We use them for messages, study reminders, and capstone-call reminders.
• Calendar: only when you tap Add to my calendar for your capstone call. The app adds that one event, with the call's time and link, to your phone's calendar. We do not read your calendar or send anything from it to us.

The app does not use your camera, microphone, location, or contacts.

• To provide the Service: run your account, show your course and progress, deliver messages and notifications, book and remind you of your capstone call, and unlock Full Program content when you are enrolled.
• To check your age: your date of birth decides whether you can join, and whether the rules for members under 18 apply to you (see section 9).
• To coach you: Grace and our coaching team use your profile, course answers, study plan, the pages you share with Grace, and your capstone-call details to support you in the program.
• To recommend peers: we use profile information (interests, school, cohort, major, bio, and visa path) to suggest members you may want to connect with. Members under 18 are not shown to adults who are not Isles staff.
• To answer your Elsy questions and run practice calls, if you give permission (see section 5).
• To look out for you: we check each message you send Elsy or send in a practice call for signs that you may be in crisis, such as thoughts of self-harm. If a message shows those signs, the app replies with crisis resources (such as the 988 Suicide & Crisis Lifeline) instead of a normal answer and alerts Isles staff, who read that message and may contact you in the app.
• To keep the community safe: refuse messages and profile text that break our filters, check profile photos before they are saved, review reports, enforce blocks and the rules for members under 18, investigate violations of the Terms, and protect members.
• To improve Isles: understand which lessons and features work, and fix problems.
• To communicate with you: sign-in codes, in-app notices, and replies to your requests.
• To comply with law and enforce our Terms.

We do not use your information for targeted advertising, and we do not use it to make decisions that have legal or similarly significant effects on you without human involvement.

• Other members: your profile (your date of birth is never shown). Recommendation cards show your current school or work.
• People you message: the messages you send them.
• The program group chat: everything you post there, seen by every enrolled student and Isles staff in it.
• Anyone you send a shareable card to: a progress card shows your name and course progress, plus your profile photo by default. You can switch the photo off on the share screen, and it is replaced by your initial. A progress card never includes your answers. Cards are created on your phone, and you decide where to send them.
• Grace and our coaching team: your profile, your account email, your sign-up and consent dates, every course answer you give (including copies kept from before a reset), your study plan and progress, the pages you share with Grace (until you unsend them), your capstone-call booking and note, your conversations with Grace and support, and the program group chat (including messages that were hidden or deleted).
• Staff who handle safety: a message to Elsy or in a practice call that was flagged as a possible crisis; a one-to-one message that someone reported, with up to 10 earlier messages from that conversation for context; a profile that someone reported, as it was at the time; and whether a member in a report is under 18.

Staff have no screen for reading your Elsy conversations, your practice calls, or one-to-one messages that nobody reported. The few people who run our database can access all stored data to keep the Service working.

We share personal information only in these cases:

• Service providers that process data for us under contract (section 5).
• Your parent or guardian, only with your OK. If your parent or guardian signed your Full Program Enrollment Agreement, our staff will not tell them anything about you, including your progress, without your permission. The app has no parent account.
• Legal reasons: to comply with law, legal process, or a government request; to protect the safety of any person; or to enforce our Terms.
• Business transfers: if Isles is involved in a merger, acquisition, or sale of assets, personal information may transfer as part of that deal, subject to this Policy.
• With your direction, such as when you send a shareable card or a message.

We do not sell personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under California law.

• Supabase: database, file storage, and sign-in. Processed in Singapore.
• Vercel: runs our servers. Processed in Singapore.
• Apple: Sign in with Apple and push notification delivery. Processed in the United States.
• Expo: relays push notifications to Apple. A message notification includes the sender's name, the first 100 characters of the message, and a link to the sender's profile photo. Processed in the United States.
• Resend: sends sign-in codes by email. Processed in the United States.
• Google Cloud Vision: checks each profile photo you upload for sexual, violent, or otherwise unsafe content before we save it. A photo that fails the check is never saved. Processed on Google's global network.
• OpenAI: if you give permission, writes Elsy's answers and the practice call (the AI mentor's replies and Elsy's notes), checks whether a practice-call message fits the call, and checks messages for signs of crisis. Processed in the United States.

What the AI provider receives from Elsy. When you ask Elsy a question, we send your question, up to the last 12 messages in that Elsy conversation, the course screen you are on and your answers on it, a summary of your progress, and basic profile details (display name, school, major, graduation year, and career interests). To check for signs of crisis, we also send your question on its own. Do not include sensitive personal information in Elsy questions.

What the AI provider receives in a practice call. Each message you send, the earlier messages in that call, and the AI mentor's character description. To check that a message fits the call, and for signs of crisis, we also send that message on its own. We do not send your profile. Elsy's notes after the call are written from the call's transcript.

How the AI provider handles it. OpenAI processes this information to return a reply to us. Under its API terms it does not use the information to train its models, and it keeps it for up to 30 days to monitor for abuse. We store the conversations ourselves, with Supabase, until you delete your account.

How Google handles photos. Google checks the photo in memory and does not store it or use it to train its models. We keep only the result of the check.

Zoom. Your capstone call with Grace takes place on Zoom. We do not send Zoom your information; when you join the call, Zoom collects information under its own privacy policy.

Isles is operated from the United States. Your information is stored and our servers run in Singapore. Elsy and practice-call messages are processed by OpenAI in the United States. These countries' data-protection laws may differ from the laws where you live, and authorities there may be able to request access to data under their own laws. We send only the information each provider needs, as described in section 5.

We keep your information while your account is open. We do not delete it on a schedule. When you delete your account (section 8), we delete it, except:

• Consent records: the record of what you agreed to, and when, is kept with your account link removed, so we can show we asked.
• Safety records: a reported one-to-one message and the up to 10 earlier messages kept with the report stay in our safety records after either person deletes their account. The result of each profile-photo check (not the photo) is also kept.
• Records others hold: copies others made outside Isles, such as screenshots or forwarded messages, are out of our control. Messages stored in Isles are deleted with your account.
• Legal obligations: anything we must keep to comply with law or resolve a dispute.

• Delete your account: in the app under Me → Delete account. This permanently removes your profile, photos, date of birth, course activity, study plan, pages shared with Grace, capstone-call bookings, Elsy conversations, practice calls, safety flags, messages you sent, connections, blocks, and notification tokens, except as described in section 7.
• AI features: Elsy and practice calls are optional, and nothing is sent to an AI provider until you give permission. You can withdraw permission at any time under Me → AI features. New messages then stop going to the AI provider; this does not undo earlier processing.
• Unsend a page you shared with Grace, in the app. Staff then no longer see it.
• Edit your profile at any time in the app.
• Shareable-card photo: switch it off on the share screen.
• Blocks: see and undo them under Me → Blocked.
• Notifications: turn them off in iOS Settings.
• Access, correction, or a copy of your data: email grace@isleshq.com. We will respond within 45 days. We may need to verify your identity first.

State privacy rights. Depending on where you live, state law may give you additional rights, such as rights to know, access, correct, delete, or obtain a portable copy of your personal information, and to appeal our decision on your request. To use any of these rights, email us. We will not treat you differently for exercising them. If we deny your request, you can appeal by replying to our decision. An authorized agent may submit a request for you with your written permission.

Do Not Track. We do not track you across other websites or apps, so the app does not respond to Do Not Track signals differently.

The Service is not intended for children under 14, and we do not knowingly collect personal information from them. When you sign up we ask your date of birth. If you are under 14, a new account is deleted straight away. If we learn later that an established account belongs to someone under 14, we lock it while we review it. A parent who believes their child under 14 has given us information can contact grace@isleshq.com.

Many of our members are high school students aged 14 to 17. For them:

• They need a parent's or guardian's permission to use Isles (see the Terms).
• They can send one-to-one messages only to Isles staff and other members under 18. Adults who are not Isles staff cannot message them privately, connect with them, or see them in recommendations.
• In conversations that include a member under 18, links and contact details cannot be sent.
• We do not sell their information or use it for targeted advertising.
• A parent or guardian may ask us to review or delete their teen's information by contacting us.

We use encryption in transit, access controls on our database, and limited staff access to protect your information. Your date of birth is kept in a separate table that only our servers can read. No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.

If we make a material change, we will notify you in the app or by email before it takes effect, and update the date at the top of this policy.

Email grace@isleshq.com, or in the app: Me → Help & support, or Messages → Contact support.