Privacy Policy

This Privacy Policy describes how OKO Labs, Inc., doing business as Product Leader Academy (collectively, “we,” “us,” or “our”), a Florida corporation with its principal place of business at 200 S. Andrews Avenue, Suite 504, Fort Lauderdale, Florida 33301 (Broward County), collects, uses, and protects your personal information when you use our website, programs, and services (collectively, the “Services”). For GDPR, we are the data controller.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, password, and profile information when you register
• Payment Information: Credit card details, billing address (processed securely via Stripe)
• Profile Information: Professional background, career goals, portfolio submissions
• Communications: Emails, support tickets, and messages sent to us
• Application Information: Scholarship applications, job preferences, and program selections
• Recruiter Desk: Work email, company, named-seat identity, messages to members, shortlists, listed roles, and your acknowledgment of the Recruiter Desk Terms
• Recruiter connector: Hashed desk tokens and OAuth grants, daily search/read/message counts, and identification stamps when a seat matches, opens, or messages a member through MCP, REST, or the overlay
• Talent Search: Role briefs, company contacts, and identification events when we run a search for a hiring company. Search Partner originators are contractors, not Desk seats.
• Pro representation: Proof card, credential, stated job interests and constraints, intro drafts, your approve/decline of each intro, and, only if you enable it, coach-session context used to draft those intros. Staff see this to run human-in-the-loop matching.

1.2 Information Collected Automatically

When you use our Services, we automatically collect:

• Usage Data: Pages visited, time spent, features used, click patterns
• Device Information: IP address, browser type, operating system, device identifiers
• Cookies and Similar Technologies: See our Cookie Policy below
• Location Data: General geographic location based on IP address

1.3 Third-Party Information

We may receive information from:

• Authentication providers (Google, LinkedIn) when you sign in via OAuth
• Payment processor (Stripe) regarding transaction status and subscription lifecycle
• Analytics and product-insight providers (Google Analytics 4, Microsoft Clarity, PostHog)
• Advertising measurement partners (Google Ads) for conversion reporting
• Scheduling provider (TidyCal) when you book a live session

2. How We Use Your Information

We use your information for the following purposes:

2.1 Providing Services

• Creating and managing your account
• Processing payments and maintaining purchase history
• Delivering educational content and program materials
• Facilitating community features (discussions, mentorship matching)
• Pro representation for paid Pro members: proposing fits among Recruiter Desk subscribers and Talent Search clients, drafting intros, and sending only what you approve
• Talent Search for hiring-company Clients, including placement-fee engagements set in the order form
• Providing customer support

2.2 Improving Our Services

• Analyzing usage patterns to improve content and features
• Conducting research and analytics
• Testing new features and functionality
• Debugging and troubleshooting technical issues

2.3 Communications

• Sending transactional emails (receipts, account notifications)
• Delivering program updates and announcements
• Sending marketing communications (with your consent)
• Responding to your inquiries and support requests

2.4 Legal and Security

• Complying with legal obligations
• Preventing fraud and abuse
• Enforcing our Terms of Service, including Recruiter Desk named-seat and identification rules
• Protecting our rights and property

3. Information Sharing

We do not sell your personal information. We may share information in the following circumstances:

3.1 Sub-processors

We engage the following sub-processors to operate our Services. For each, we disclose the purpose, the legal basis we rely on (under GDPR Article 6 and equivalent frameworks), the data retention period, and the transfer mechanism used for cross-border transfers from the EEA/UK to the United States or other jurisdictions. We do not sell personal information.

This list is current as of the Last Updated date above. We will update this Privacy Policy before engaging a new sub-processor for a materially different purpose. Data Processing Agreements (DPAs) with each sub-processor are available on request to privacy@productleaderacademy.com.

3.2 Legal Requirements

We may disclose information if required by:

• Court order, subpoena, or legal process
• Government request or law enforcement inquiry
• Investigation of fraud or security incidents
• Protection of our rights, property, or safety

3.3 Business Transfers

If OKO Labs, Inc. is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

3.4 With Your Consent

We may share information with third parties when you explicitly authorize us to do so.

3.5 Recruiter Desk, connector, and hiring

If you set open-to-work visibility to public or recruiters, we show your directory profile (and, when visibility is public, LinkedIn on your public card) to named Recruiter Desk subscribers and to PLA placement staff. Paid Pro members may also receive Pro representation: staff, with a human in the loop, may use that opted-in profile, proof card, credential, and stated interests to propose intros to those same subscribers and to Talent Search clients. We send an intro only after you approve it. Coach-session context is used for drafts only if you enable that. That same opted-in profile is what the Recruiter connector returns to a live named seat over MCP, REST, OAuth, or the PLA Chrome overlay. Recruiters-only visibility hides LinkedIn on unauthenticated pages. List and match responses do not include your email. Desk messages, applications, written introductions (including Pro representation intros you approved), and connector profile reads / matches / messages are logged as identification events so we can enforce the Recruiter Desk Terms. We do not sell member lists. Staffing firms do not receive self-serve directory access without a separate agreement.

A recruiter may pull those results into an agent or IDE they control (Claude, ChatGPT, Grok, Cursor, Codex, and similar). Those vendors are not PLA sub-processors. We do not push your profile to them; the recruiter's software requests it from us. What that agent stores, logs, or trains on is the recruiter's processing, not ours. Opting out of recruiter visibility in your profile stops new connector, Desk directory, and Pro representation disclosure. Identification logs already written are kept as in Section 5. This directory disclosure is not a “sale” or cross-context ad share under the CPRA.

4. Data Security

We implement industry-standard security measures to protect your information:

• Encryption in transit (TLS/SSL) and at rest (AES-256)
• Secure authentication with bcrypt password hashing
• Regular security audits and penetration testing
• Access controls and role-based permissions
• PCI-DSS compliant payment processing (via Stripe)
• Row-Level Security (RLS) on database tables

5. Data Retention

We retain your information for the following periods:

• Account Information: Retained while your account is active; deleted within 30 days of account deletion request
• Payment Records: Retained for 7 years per financial regulations
• Usage Data: Retained for 2 years for analytics, then anonymized
• Communications: Retained for 3 years for customer service purposes
• Recruiter identification logs: Retained for at least 12 months after the last identification date, and longer if needed to enforce the tail or as required by law
• Connector tokens and OAuth grants: Stored as hashes. Active until you revoke them or the seat dies; hashed rows may remain up to 30 days after revoke for abuse review
• Connector daily usage: Per-seat search/read/message counts retained 90 days
• Pro representation drafts and approvals: Kept while Pro is active and for 12 months after the last approved intro, or longer if needed for the identification tail

6. Your Rights and Choices

Depending on your location, you may have the following rights:

6.1 Access and Portability

You can request a copy of your personal information in a structured, machine-readable format.

6.2 Correction

You can update your account information at any time through your profile settings or by contacting us.

6.3 Deletion

You can request deletion of your account and personal information. Some data may be retained as required by law or for legitimate business purposes.

6.4 Opt-Out

You can opt out of:

• Marketing emails by clicking the unsubscribe link
• Recruiter directory / connector visibility and Pro representation in profile open-to-work settings
• Analytics tracking through browser settings or Do Not Track signals
• Certain data processing by contacting us directly

6.5 Cookie Preferences

You can manage cookie preferences through your browser settings. Essential cookies required for site functionality cannot be disabled.

7. Cookies and Tracking

We use cookies and similar technologies for:

• Essential: Authentication, session management, CSRF protection, and site functionality
• Analytics: Understanding how users interact with our Services (Google Analytics 4, Microsoft Clarity, PostHog)
• Advertising: Measuring ad effectiveness and conversion attribution (Google Ads)
• Preferences: Remembering your settings, cookie choices, and UI state

Non-essential cookies (Analytics and Advertising categories) are set only after you grant consent in regions that require it (EEA, UK, and comparable jurisdictions). You can change your choice at any time via the cookie preferences link in the site footer.

8. Children's Privacy (COPPA)

The Services are for adults. You must be 18 or older to create an account. We do not knowingly collect personal information from children under 13, as defined by the Children's Online Privacy Protection Act (COPPA). We do not direct the Services to children. If we learn we have collected personal information from a child under 13, we will delete it. Contact privacy@productleaderacademy.com. GDPR age of digital consent (13–16 depending on Member State) is also covered by our 18+ eligibility rule.

9. International Data Transfers

OKO Labs, Inc. is based in the United States. If you access our Services from outside the US, your information is transferred to and processed in the United States. For EEA/UK transfers we rely on Standard Contractual Clauses with sub-processors, not consent alone.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of material changes by email or through a notice on our website. Your continued use of Services after changes constitutes acceptance of the updated Policy.

11. Contact Us

For questions about this Privacy Policy or to exercise your rights:

OKO Labs, Inc.
d/b/a Product Leader Academy
200 S. Andrews Avenue, Suite 504
Fort Lauderdale, Florida 33301
Broward County, USA
Email: privacy@productleaderacademy.com
Website: https://productleaderacademy.com

12. California Privacy Rights (CCPA/CPRA)

California residents have additional rights under the California Consumer Privacy Act as amended by the CPRA. We do not sell personal information and we do not share it for cross-context behavioral advertising as those terms are defined in the CPRA. Rights include:

• Right to know what personal information is collected, used, disclosed, or retained
• Right to know if personal information is sold or shared (we do not sell or share for ads)
• Right to request deletion or correction of personal information
• Right to opt out of sale or sharing (not applicable; we do not sell or share)
• Right to limit use of sensitive personal information, where collected
• Right to non-discrimination for exercising privacy rights

To exercise these rights, email privacy@productleaderacademy.com. We will verify the request and respond within the statutory period. Authorized agents may submit requests with proof of authorization. Similar rights may apply under other US state privacy laws (including Virginia, Colorado, Connecticut, and others); use the same contact.

13. GDPR Compliance (EU/UK Residents)

If you are in the EEA, UK, or Switzerland, OKO Labs, Inc. is the controller. Lawful bases: contract (Art. 6(1)(b)) for account and paid services; consent (Art. 6(1)(a)) for non-essential cookies, optional marketing, recruiter-directory / connector visibility, and Pro representation intros; legitimate interests (Art. 6(1)(f)) for security, fraud prevention, and product improvement; legal obligation (Art. 6(1)(c)) for tax and accounting. A recruiter who pulls directory data into their own agent is an independent controller of that further processing. Transfers to the US use Standard Contractual Clauses with our sub-processors as listed above. You may request access, correction, deletion, restriction, objection, and portability. We respond within one month (extendable by two months for complex requests). You may lodge a complaint with your local supervisory authority (ICO in the UK). Contact privacy@productleaderacademy.com.

14. SMS Communications

Product Leader Academy operates an opt-in SMS program through which you may receive educational content, course progress updates, and program information. Participation is voluntary and free; standard message and data rates from your carrier may apply.

14.1 How You Opt In

You may opt in to receive SMS messages from us by either:

• Texting the keyword PMAI to our long code or short code from your mobile device.
• Submitting your phone number through a form on productleaderacademy.com that explicitly references SMS communications and includes the disclosure required to give informed consent.
• Selecting an explicit SMS opt-in checkbox during scholarship application or account onboarding.

14.2 How You Opt Out

You may opt out of receiving SMS messages from us at any time by replying STOP to any message we send. After replying STOP, you will receive a single confirmation message and no further messages until you re-subscribe by replying START. Reply HELP at any time to receive help text and contact information.

14.3 Frequency and Content

Frequency varies by program. Educational courses such as "PM AI-Ready in 7 Days" deliver one message per day for seven days. Operational and program-related messages are sent on an as-needed basis, typically not exceeding two per month.

14.4 Use of Your Phone Number

We do not sell or share your phone number with third parties for marketing purposes. We use your phone number solely to deliver the SMS content you opted in to receive and, where applicable, to authenticate your account or send transactional notifications. For more detail, see our SMS Terms.