Privacy Policy

1. Data Controller

The data controller responsible for data processing on this website is:

2. What Data We Collect

2.1 Information You Provide

• Contact information (name, email) when you subscribe to our newsletter via HubSpot
• Information you provide when contacting us

2.2 Information Collected Automatically

• Technical information: IP address (anonymized), browser type, operating system, referring URL
• Usage data: pages viewed, time spent, navigation paths
• Analytics data (Google Analytics, Umami) is collected only after you give consent via the cookie banner
• Server logs are recorded briefly for the secure operation of the website

3. Purpose and Legal Basis

3.1 Handling Contact and Demo Enquiries (Art. 6(1)(b) and Art. 6(1)(f) GDPR)

• Responding to contact and demo enquiries you send us: legal basis is the taking of pre-contractual steps at your request (Art. 6(1)(b)) and our legitimate interest in replying to your message (Art. 6(1)(f))

3.2 Based on Consent (Art. 6(1)(a) GDPR)

• Google Analytics: website usage analysis, loaded only after your explicit cookie consent
• Umami Analytics: website usage analysis, loaded only after your explicit cookie consent
• Newsletter: marketing communications via HubSpot, sent only after your opt-in

3.3 Based on Legitimate Interests (Art. 6(1)(f) GDPR)

• Hosting and server logs: ensuring the secure and stable operation of our website (Art. 6(1)(f))

4. Cookies and Tracking Technologies

We use the following categories of cookies and tracking technologies:

You can withdraw or change your consent at any time via the "Cookie Settings" link in the footer, which reopens the preferences dialog.

5. Third-Party Services and Data Processors

We use the following third-party services to operate this website:

• Google LLC (USA, Google Analytics): website analytics. Loaded only after your consent. Transfers to the USA rely on the EU-US Data Privacy Framework adequacy decision where Google is DPF-certified, with EU Standard Contractual Clauses as a fallback.
• Umami Software, Inc. (analytics, cloud.umami.is): privacy-friendly website analytics. Loaded only after your consent.
• HubSpot, Inc. (USA, forms and CRM): newsletter signup and contact form. Loaded only after your consent. Transfers to the USA rely on the EU-US Data Privacy Framework adequacy decision where HubSpot is DPF-certified, with EU Standard Contractual Clauses as a fallback.
• Vercel Inc. (USA, hosting): website hosting and delivery. Server access logs (including IP address) may be processed for secure and reliable operation. Transfers to the USA rely on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

We have data processing agreements pursuant to Art. 28 GDPR in place with these processors. A copy of the transfer safeguards is available on request.

6. International Data Transfers

Some of our service providers (HubSpot, Google, our host) are based in the USA. Where the recipient is certified under the EU-US Data Privacy Framework, transfers rely on the European Commission adequacy decision for that framework (Art. 45 GDPR). As a fallback, we use EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). A copy of these safeguards is available on request.

7. Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected. Contact and demo enquiry data is kept only as long as needed to handle your request and for a reasonable follow-up period, then deleted. Newsletter subscriber data is retained until you unsubscribe. Analytics data is retained according to the respective provider's retention policy (Google Analytics: approximately 14 months). Server logs are kept only briefly for security purposes.

8. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access (Art. 15): Request a copy of your personal data
• Right to rectification (Art. 16): Request correction of inaccurate data
• Right to erasure (Art. 17): Request deletion of your personal data
• Right to restrict processing (Art. 18): Request restriction of processing
• Right to data portability (Art. 20): Receive your data in a machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time (e.g., via cookie settings)

To exercise any of these rights, please contact us at contact@labs.ai. We will respond to your request within one month.

9. Is Provision of Data Required?

Providing your contact details is entirely voluntary. It is, however, necessary if you want us to answer your enquiry or send you the newsletter. There is no statutory or contractual obligation to provide the data. If you do not provide it, the only consequence is that we cannot respond to you or deliver the newsletter.

10. Automated Decision-Making and Profiling

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Your data is not subject to any automated decision that produces legal effects concerning you or similarly significantly affects you.

11. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including HTTPS encryption for all data in transit, and access controls for administrative systems.

12. Children's Privacy

Our website is not intended for children under the age of 16. We do not knowingly collect personal data from children.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the updated policy on this page and updating the "Last updated" date.

14. Supervisory Authority

You have the right to lodge a complaint with the competent supervisory authority. In Austria, this is:

15. Contact

If you have questions about this Privacy Policy or our data practices, please contact us: