LabOpenings Privacy Policy

Optional workspace assistant — AI privacy details

AI agreement version: 2026-10-30. Effective date: October 30, 2026. This section supplements the October 30, 2026 Privacy Policy for the optional workspace assistant. Before your first request, we present these details with the AI terms and record your explicit acceptance. Enabling the assistant alone does not send your draft.

The workspace assistant is an optional way to create openings, update them, and close recruiting. Choosing Send can send your request and selected conversation text to the OpenAI API for scope and safety checks. For workspace requests, we also send your lab profile, current opportunity records and private lab memory to prepare a response. These can include unpublished records and contact information you entered. We also send relevant excerpts from public university links you provide. This is separate from ChatGPT sign-in and AI connections. The manual lab-preferences field described in section 4 continues to store text without calling an AI model. Manual editing continues to work without using this assistant.

OpenAI prepares changes from your request. When the request is complete and passes validation, the website applies the whole batch immediately. Incomplete or ambiguous requests wait for clarification. You can inspect the changes and choose Undo afterward. Undo reverses the whole batch, including removing an opening created by that batch, only when its openings have not been changed again. Later manual edits are protected. Existing profile-verification and visibility rules continue to apply; changes to verified public openings can therefore become visible as soon as they are applied. Manual forms and AI connection drafts keep their separate Save or confirmation controls. Do not include applicant evaluations, participant or patient information, passwords, or other sensitive personal data in a request.

LabOpenings stores accepted workspace conversation text, proposals, cited sources, and save receipts with your account so you can resume a conversation and inspect what changed. For new requests, raw message text is kept in request memory while the scope and safety check runs. A message not accepted as a workspace request is replaced in saved history with a neutral placeholder and fixed reply; failed checks also keep only a placeholder. This does not erase previously saved chats or guarantee that every sensitive disclosure will be recognized. A misclassified workspace request can still be stored. Provider processing and retention are separate from our saved history. We also store the AI agreement version and acceptance time. Undo also retains the original change receipt and records when it was undone. Cancelling an older, unapplied proposal prevents its application but does not erase its history. These records are removed from active application storage when your account deletion is completed. Usage accounting retains costs and timestamps with the account association removed. The main Privacy Policy describes privacy requests, provider-managed logs and backups, and other retention limits.

We also store account-linked pause counts, pause timestamps and access-review status. The first two safety detections pause their conversations; the third across chats holds Oli access until manual review. Category-only issue reports include your account, selected category, report reference and, when available, the current request reference. Access-review requests include a selected reason. These reports do not attach chat text. Administrators see these limited records and account identity, and their access decisions and selected reasons are recorded. This metadata can be sensitive; it is private account data, not anonymous data. It remains after chat deletion and is removed from active application storage when account deletion is completed. Restoring access resets the current pause count, while the review record remains. Reports and reviews are not emergency services or health assessments and have no guaranteed response time.

We request that API responses not be stored as retrievable OpenAI response objects. That setting does not eliminate provider security or abuse-monitoring retention or all temporary processing, such as prompt caching. OpenAI's applicable API terms and data controls govern its processing. See OpenAI API data controls. This feature does not score applicants or make admissions or employment decisions.

You can stop using the assistant at any time and use Add manually or Edit instead. Starting a new request, closing a tab, or stopping use does not erase earlier conversations. For access, correction, or deletion requests, contact labopeningsdev@gmail.com.

Pilot eligibility declarations and decisions are recorded separately from conversations, as described above. Deleting a conversation does not delete an access decision. Listing reviews do not send listing text to a new AI service; the pre-publication checks are performed by LabOpenings. Your use of Oli still involves the OpenAI processing described in this section.

Access decisions, resolved reports, review records and agreement history do not currently have automatic expiry. They remain subject to purpose-based retention review and verified account-deletion requests, including any specific lawful retention exception. They are not public. Usage and cost records may remain after account deletion with the account identifier removed. Connected ChatGPT draft/history records have separate retention from Oli’s 15-day change-detail window; disconnecting a connection does not itself delete that history.

Oli conversations, change details and private memory

Oli is the workspace assistant described above. You can reopen earlier chats, archive or restore them, and delete individual conversations. Saved workspace text and replies remain until you delete the chat or complete account deletion. New requests rejected by the scope or safety check retain a placeholder and fixed reply instead of their raw message. Archiving only moves a chat out of the recent list.

Undo and exact before-and-after change details are available for 15 days from the change. Later edits may make Undo unavailable sooner. After that window, the server no longer returns these details or permits Undo. Expired snapshots are cleared from active storage on the next authenticated assistant request; an inactive account's stored snapshots may remain until that cleanup occurs. Brief activity entries, dates and whether a change was undone remain with your account. Conversation text is retained separately and can still mention earlier values. Use the manual editor when Undo is unavailable.

To keep each request manageable, we send selected recent messages, a compact overview of earlier exchanges, and current task details. Oli can retrieve relevant original messages from that same conversation when needed. This does not require sending all of your other conversations to OpenAI.

Private lab memory stores a short Markdown note for your lab, with owner-written notes and concise preferences, confirmed decisions or unfinished tasks Oli learns from your messages. When you send a new workspace request, this memory is included in the information sent to OpenAI, even when you start a new conversation. It is not public, does not replace current opportunity records, and cannot independently authorize changes. You can view, edit, remove, clear or download it from Lab memory. Memory is bounded: up to 4,000 characters of owner notes and 12 maintained notes of up to 400 characters each. Topic updates replace earlier notes rather than appending an entire transcript.

Deleting a conversation removes its messages, conversational replies, source excerpts and quoted message evidence from active application storage, along with memory notes derived from it. It does not reverse changes to openings; available change details and Undo keep their original 15-day window. Undo also removes memory notes linked to the undone change. If you explicitly edit and save a derived note, it becomes your independently saved note and remains when its source chat is deleted or the change is undone. Clear memory removes the current note and prevents an already-running reply from restoring it; later requests can add new notes. Account deletion removes all lab memory.

Provider logs and backups remain subject to the main policy and provider retention rules. These controls supplement AI agreement version 2026-10-30. Chat deletion does not reset access holds or remove account-linked pause and review metadata.

Oli’s scope and safety responses

Oli is an AI tool for research recruitment and managing your LabOpenings workspace. It is not a person, a companion, a health professional, or an emergency or crisis service. It does not provide personal medical or mental-health advice, monitor your safety, or contact emergency services for you.

Unrelated requests receive a brief fixed reply. When a message is recognized as a possible personal safety concern, Oli uses a fixed support message that points to human help, including the 988 Lifeline in the U.S. and Find A Helpline for other countries. Immediate danger requires local emergency services. This response does not make changes to your openings or add a lab-memory note. Automated recognition can make mistakes; do not rely on Oli for crisis support.

We use a limited selection of recent conversation text to check a request’s scope and safety before providing workspace tools. Messages routed outside the workspace are excluded from subsequent workspace-planning context and original-message lookups. Proposed automatic memory notes are separately checked to exclude personal health and crisis disclosures, even when a later message requests that they be remembered. Do not enter sensitive personal information in chats or owner-written lab notes.

For new requests, text that fails the scope or safety check is not retained in saved conversation text. Its fixed reply and a neutral placeholder remain. Earlier saved conversations are unchanged; automated classification can miss sensitive content. Provider processing, logs and backup limits still apply.

A recognized safety concern pauses that conversation. The third detection across chats pauses Oli across the account pending manual access review. Retrying the same completed request does not add a detection. Deleting or archiving a chat, accepting a new AI agreement, or opening another chat does not remove the count or hold. After access is restored, the current count is reset and a new recruitment chat can be started; previously paused chats stay paused.

Use Report an issue for a category-only report or Request access review for a paused account. These controls do not attach conversation text and are not monitored for emergencies. Administrators make an access decision, not a clinical assessment. There is no guaranteed response time. Manual editing, history, available Undo and human-support links remain available.

Base Privacy Policy version: 2026-10-30. Effective date: October 30, 2026.

1. The project and this policy

LabOpenings is a free, independently operated research project exploring new ways for faculty and students to connect. Questions and privacy requests: labopeningsdev@gmail.com.

LabOpenings explores whether easier access to current research opportunities can help people communicate more directly. We learn by running the project and listening to voluntary feedback. Creating an account, posting an opportunity, or using the service does not enroll you in a research study. Any future study involving study-specific collection or use of account information would be explained separately and undergo any required review before it begins. Terms acceptance and acknowledgment of this policy are not research consent.

In this policy, "LabOpenings," "we," "us," and "our" refer to the operator responsible for the project under the LabOpenings name. LabOpenings is a project name, not a representation that an incorporated company, registered nonprofit, or university program exists. The operator determines how information is used to run this service. A listed institution or provider does not thereby endorse LabOpenings.

This policy covers the website, its public APIs and account features, any LabOpenings app that links to this policy, and communications with the operator. It does not govern a university's application process, a publisher's handling of an email you send them, or another website reached through a link.

The project currently focuses on U.S. research opportunities and users. International visitors and publishers may use available features, but dedicated country-specific support is not currently offered. This description does not exclude privacy rights or obligations that apply to actual activities and processing.

Privacy contact: labopeningsdev@gmail.com. Do not send passwords, sign-in codes, government identification documents, or sensitive research information with an initial inquiry.

2. Information we collect and why

For email/password sign-in, credentials pass through our backend to the authentication provider. The application database does not store your plaintext password. The current sign-in integrations request identity information, not access to your ChatGPT conversations, Google Drive files, contacts, or mailbox contents. A message you choose to send to our support mailbox is handled as a support communication.

We may consult public institutional or laboratory pages and official contact information when reviewing a profile. We do not operate an application-document submission service. Do not put participant records, health information, transcripts, private applicant evaluations, immigration documents, or other sensitive personal information into profile, opportunity, or interest fields. Descriptions of funding or eligibility should describe the opportunity, not identifiable applicants.

Pilot access requests record your U.S./18+ and lab-authority declarations, declaration version, account and lab identifiers, profile review snapshot, request and decision times, decision reason and reviewer identifier. We do not request a birth date or ID document for this pilot. These records are private and support eligibility review and access control; declarations do not independently verify age or location.

Listing category, work location and pay range are public listing fields when the listing is published. Listings awaiting review are excluded from public responses; the owner, authorized reviewers and connections authorized to read private records can access them. We retain the flag categories and review decisions, including relevant institutional evidence and reviewer notes, to administer publication and investigate disputes. Reviewers must not put unnecessary applicant or health information in those notes.

3. Public information and information kept private

Approved public profiles can include the faculty member's name, lab, institution, department, official profile link, review status, and chosen lab contact email. Published opportunities can include all the opportunity and contact-preference fields described above, including lab-preference text, funding notes, program links, and the selected opportunity contact email. Treat these fields as intended for public display, not private notes to the operator.

Public pages and APIs may be accessed without an account, including by search engines and software tools. Other people may copy, index, or retain this information. Pausing a website browsing feature does not necessarily remove approved information from public APIs.

Profiles and opportunities saved before email confirmation remain private. Ordinary publication requires email confirmation and PI profile approval. We do not automatically publish your sign-in email; it can become public if you choose it as a lab or opportunity contact email or include it in public text. Session credentials, student preferences, and internal review notes are not included in public responses.

Closing an opportunity changes its availability; it does not delete the record or necessarily remove it from public results. Removing information from LabOpenings cannot by itself recall copies made independently by search engines, recipients, or other third parties. If a public field contains information about you that should not be there, contact us even if you do not have an account.

4. Service operation, research, AI, and communications

We use information for the purposes listed above: operating accounts and listings, reviewing publication authority, maintaining security, sending necessary account or service notices, responding to requests, and improving the project through voluntary feedback. Supplying information needed for an account or publication is your choice, but the relevant feature may be unavailable without it. Optional fields are identified in the interface.

The current lab-preferences feature stores the text you enter. It does not send that text to an AI model to generate requirements or score applicants. We do not currently train a LabOpenings AI model on private account information or make automated admissions or employment decisions. Describing AI assistance as being in development does not enroll you in it or give permission for a new use of existing data. Before introducing materially different processing, we will explain the purpose, information involved, recipients, and available choices and obtain any consent required by law.

Operational learning and voluntary feedback do not authorize an undisclosed human-subjects study or publication of identifiable private records. We will seek separate permission before using identifiable private feedback as a public testimonial. Necessary confirmation, recovery, security, deletion, and material service notices are distinct from optional promotional communications. Account registration does not subscribe you to an unrelated marketing list.

5. Recipients and service providers

We disclose information as needed for the purposes above to:

• The public, for the profile and opportunity fields described in section 3.
• Hosting and infrastructure providers, including OpenAI Sites and Cloudflare for application hosting and database storage.
• Authentication providers, including Supabase, Google when Google sign-in is used, and OpenAI when ChatGPT sign-in is used. Only options offered in the relevant interface are available. An additional sign-in provider would be described before use.
• Email and support providers, including Resend for account email delivery and Google for communications with our Gmail support address.
• Authorized operators and reviewers, for support, security, privacy requests, and profile review, with access limited to their responsibilities.
• Legal or safety recipients, where reasonably necessary to comply with applicable law or valid legal process, address abuse, or protect people's rights and security.

Providers may process information on our behalf and certain account, security, or service information for their own purposes. Their notices supplement this policy rather than replace our responsibilities: Supabase, Resend, OpenAI, Cloudflare, and Google. When a Cloudflare Turnstile security challenge is used, technical signals such as IP address and browser information are processed as described in the Turnstile Privacy Addendum.

We do not sell personal information, disclose it for cross-context behavioral advertising, or use it for targeted advertising. LabOpenings has no advertising integration. This describes our operation of LabOpenings; independent provider services have their own disclosed practices.

If responsibility for the project transfers to a different operator, any transfer of personal information remains subject to existing privacy commitments and applicable law. We will identify the new operator and give notice of material changes, and obtain any required consent before a new use. This policy does not authorize an unrestricted sale or new use of account data.

6. Cookies, device storage, and browser signals

The website uses necessary cookies for account and security functions:

• An access-session cookie lasts up to one hour and a refresh-session cookie up to seven days. They can be renewed when a session is refreshed. Signing out clears these application cookies.
• A short-lived OAuth security cookie lasts up to ten minutes when that sign-in flow is used.
• A registration agreement-linking cookie lasts up to 24 hours and is cleared when the proof is associated with the confirmed account or on sign-out cleanup.
• A pending PI access cookie permits private editing in the signup browser for up to 30 days. Signing out revokes that browser access. Expiry or removal does not delete the account or saved content.

The password-recovery interface also stores a retry-time value in browser local storage so its short cooldown survives a page reload. That value is not an account password or advertising identifier. Its usefulness expires with the cooldown, but the stored value may remain until replaced or you clear site storage.

The iOS app stores sign-in and pending-registration credentials in device Keychain storage to maintain access. It does not persist your plaintext sign-in password. Signing out clears its stored application credentials; deleting the app is not a request to delete the account or server records. Operating-system and provider storage may follow their own rules.

You can clear or block browser cookies and site storage, but account features may stop working. Signing out of LabOpenings does not necessarily sign you out of a separate Google or ChatGPT account. Hosting and sign-in providers may use additional cookies under their policies.

The LabOpenings application has no advertising trackers or its own cross-site behavioral analytics. It does not change its behavior in response to the legacy Do Not Track signal. Global Privacy Control and similar legally recognized opt-out signals are different from Do Not Track. We currently have no sale, cross-context advertising sharing, or targeted-advertising activity for such a signal to stop, and the application does not implement a separate signal-based change in behavior. Any opt-out obligations that apply under law remain binding. Provider services may process information across their own services as described in their notices.

7. Retention, deletion, and security

Active account, profile, opportunity, and review records are kept while needed to provide the service and for specific support, security, or legal purposes. There is no automatic deletion solely because you stop visiting, sign out, uninstall an app, or close an opportunity. Unconfirmed accounts and their private content are not automatically deleted when a 24-hour registration proof or 30-day editing credential expires.

Registration agreement proofs expire after 24 hours. They are removed when consumed, during sign-out cleanup, or during a subsequent registration's cleanup of expired proofs; expiry alone does not immediately erase a stored proof. Account agreement records document the versions accepted and are normally removed with account deletion. Any separately retained record must have a specific lawful purpose.

Requesting deletion. Use Delete account in an app version that offers it, or email labopeningsdev@gmail.com. The website currently directs deletion requests to that address. After an in-app request is successfully recorded, normal account access is blocked and linked profiles and opportunities are hidden from our public responses while an administrator completes deletion. Email requests require appropriate verification before account changes; sending an email does not instantly hide records. Administrative accounts require coordinated offboarding so another authorized person can complete their removal.

Completing deletion. We complete removal of the account and associated profile and opportunity data from active service storage within 30 days of receiving an account-deletion request and email you when it is complete. If a verification issue or a lawful exception affects your request, we will explain it and follow any applicable notice and deadline requirements. A recorded request or hidden profile is not a completion confirmation. The process covers related application, review, agreement, and pending-registration records and the LabOpenings authentication identity where applicable. It does not delete your independent Google, Apple, or ChatGPT account.

Limited records that remain. Completion clears the email from the application deletion-request record but retains the provider-scoped account identifier, request/completion times, and status. This record documents closure and prevents the same deleted identity from silently recreating an account; it is not anonymous and does not automatically expire. Reviews about other people's profiles can remain with the departing reviewer's identifier replaced. Support correspondence or a limited legal/security record may also need to remain for a specific purpose. We assess the need for retained information when handling closure or a privacy request and delete or de-identify it when no longer needed, subject to applicable law. Contact us about a retained record or rejoining after deletion.

Provider-managed backups and logs. Providers may retain backup copies, service logs, and email-delivery records after we remove active account data. These records follow the providers' own retention and deletion cycles and do not necessarily disappear within the same 30-day period. Those cycles do not extend our deadline for removing active account data. We take any steps required by applicable law to have relevant providers act on a deletion request and explain known limitations when responding to you.

Copies under our control. We review operator-held exports and recovery copies when handling a deletion request. We limit recovery-copy use to recovery, security, or a specific lawful retention purpose, remove copies when no longer needed for that purpose, and reapply completed deletion decisions before restored account data becomes accessible.

Independent outside copies. Copies held independently by recipients or search engines are outside our direct control. Where required by law, we notify relevant recipients of corrections, deletions, or restrictions and take reasonable steps to inform others processing public copies.

We use measures including authenticated account access, ownership checks, and restricted reviewer access. No online service can guarantee absolute security. Report suspected unauthorized access to the contact address above. We will provide security-incident notices where required by applicable law.

8. Your choices and privacy requests

You can review and edit information available in your account, choose whether to fill optional public fields, remove an opportunity through an available delete control, and request account deletion as described above. You do not need to accept a new Terms version to email a privacy request.

To request access, a copy, correction, deletion, or information about how your personal information is handled, email labopeningsdev@gmail.com. Describe the request and account or public page involved without sending unnecessary sensitive material. If you cannot access your account, say so. An authorized agent may contact us, subject to reasonable verification of their authority.

A person responsible for project support and privacy requests reviews these requests. We may ask for information reasonably needed to verify identity or authority and protect others' information. We do not ask for your password or sign-in code. We evaluate the request under applicable law, explain any lawful limitation, and respond within the required period. Where applicable, we provide a usable copy or another legally required format.

Depending on the law that applies, you may also have rights to object to or restrict processing, withdraw consent for processing based on consent, opt out of certain processing, or complain to a regulator. Withdrawal does not make earlier lawful processing unlawful. We do not penalize you for exercising rights protected by applicable privacy law; deleting information necessary for a feature can prevent that feature from working.

If you disagree with our response, reply to the privacy address asking for reconsideration or an appeal. We will explain our decision and any appeal or complaint route required by the law that applies. You may contact an appropriate regulator without first contacting us. These statements preserve applicable rights; they do not assert that every jurisdiction's privacy law or every listed right applies to this project.

9. International processing

Providers may process information in the United States and other countries with different data-protection laws. Our U.S. focus does not by itself determine which law applies to a particular use or transfer. Contact us for information about the processing relevant to your account or to exercise an applicable right wherever you are located.

Accepting the Terms or using the service is not consent to an otherwise unlawful international transfer. We remain responsible for any lawful basis, transfer safeguard, additional regional notice, or other condition required by the law that applies to our processing. You can ask us about the safeguards relevant to your information at the privacy contact address above.

10. Children and age eligibility

Accounts are for people aged 18 or older. Users must affirm this before using protected account features; this is not verified proof of age. The service is not directed to children under 13. If you believe someone under 18 has created an account or a child has provided personal information, contact us so we can investigate, restrict inappropriate account access, and remove information as required by applicable law. Do not send additional information about a child beyond what is reasonably needed to identify the concern.

11. Changes to this policy

We will publish an updated version and effective date when this policy changes and preserve published versions. For material changes, we will provide a prominent website notice and, where appropriate or required, account email before the change takes effect. We will obtain consent where required rather than treating a policy update as permission for a new use of previously collected information.

12. Contact

Public project name: LabOpenings

Privacy, support, and account requests: labopeningsdev@gmail.com