Privacy Policy
1. Introduction
This Privacy Policy describes how AB-Labz (the "Operator") processes the personal data of individuals who use the AB-Labz platform at workbench.ab-labz.com and the marketing website at ab-labz.com.
The Operator acts as a data controller for personal data collected from platform users and website visitors. Where the Customer submits Experiment Data containing personal data of third parties, the Operator acts as a data processor—that relationship is governed separately by the Data Processing Agreement.
This Policy complies with Regulation (EU) 2016/679 (GDPR). The operator entity details are set out in Company Information.
2. Personal Data We Collect
2.1 Account and Profile Data
- Email address
- Name or display name
- Organization name
- Account preferences and settings
2.2 Technical and Access Data
- IP address and approximate location
- Browser type and version
- Device information and operating system
- Date, time, and duration of access
- Feature usage and navigation logs within the platform
2.3 Support and Communication Data
- Content of support requests and correspondence
- Contact details provided in support communications
2.4 Billing and License Data
- Organization billing details (name, address, VAT number)
- Invoice records
- License key activation dates and status
2.5 Website Analytics
The marketing website (ab-labz.com) uses Google Analytics to collect anonymized, aggregated visitor statistics. See Cookie Policy for details. The Workbench application (workbench.ab-labz.com) does not use marketing analytics tools.
3. Purposes and Legal Bases for Processing
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing access to the platform and its features | Contract performance (Art. 6(1)(b)) |
| Creating and managing user accounts | Contract performance (Art. 6(1)(b)) |
| Processing payments and issuing invoices | Contract performance; legal obligation (Art. 6(1)(b)(c)) |
| Sending transactional emails (e.g. account setup, license activation) | Contract performance (Art. 6(1)(b)) |
| Providing customer support | Contract performance; legitimate interests (Art. 6(1)(b)(f)) |
| Security monitoring and access logging | Legitimate interests (Art. 6(1)(f)) |
| Improving the platform based on usage patterns | Legitimate interests (Art. 6(1)(f)) |
| Website analytics (anonymized, aggregated) | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal and tax obligations | Legal obligation (Art. 6(1)(c)) |
4. Data Processors and Third Parties
The Operator engages the following third-party service providers to operate the platform. Each provider processes personal data only to the extent necessary for the specified purpose.
| Provider | Purpose | Location |
|---|---|---|
| DigitalOcean | Cloud hosting, database, storage | Frankfurt, Germany (EU) |
| Postmark (Wildbit) | Transactional email delivery | USA (SCC) |
| OpenAI | AI-powered analysis insights | USA (SCC) |
| Google Analytics | Marketing website analytics (anonymized) | USA (SCC) |
The full list of subprocessors is maintained at Subprocessors. The Operator does not sell personal data and does not share it for advertising or marketing purposes.
5. International Data Transfers
All customer data is stored on DigitalOcean infrastructure in Frankfurt, Germany (EU). The Operator entity is located in Serbia, which is not recognized as providing an adequate level of data protection under EU law. Administrative access to systems from Serbia is covered by Standard Contractual Clauses.
Transfers to US-based providers (Postmark, OpenAI, Google Analytics) are covered by Standard Contractual Clauses. Full details are in International Data Transfers.
6. Retention Periods
Personal data is retained only as long as necessary for the purposes set out in this Policy. Key retention periods are:
- Account data: for the duration of the account, plus 30 days after deletion.
- Support communications: 3 years from the date of the communication.
- Access and security logs: 12 months.
- Billing records and invoices: 7 years (legal/tax obligation).
The full retention schedule, including experiment data, is in Data Retention.
7. Your Rights Under GDPR
If you are located in the European Economic Area, you have the following rights:
- Access — request a copy of the personal data we hold about you.
- Rectification — request correction of inaccurate or incomplete data.
- Erasure — request deletion of your personal data, subject to legal retention requirements.
- Restriction — request that we restrict processing of your data in certain circumstances.
- Data portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
- Withdraw consent — where processing is based on consent, withdraw it at any time.
To exercise these rights, contact [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
8. Cookies
We use essential cookies for authentication and session management, and analytics cookies (Google Analytics) on the marketing website. For details, see Cookie Policy.
9. Experiment Data (Processing as Processor)
When a Customer submits Experiment Data to the platform for analysis, that data may contain personal data belonging to the Customer's end users. In this context, the Customer is the data controller and AB-Labz is the data processor. This processing is governed by the Data Processing Agreement.
Experiment Data is ephemeral: CSV uploads are deleted at the end of the analysis session; API-submitted datasets are retained for a maximum of 14 days. The platform is designed so that raw experiment data submitted by customers is not used for any purpose other than generating the requested analysis.
10. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated by email or by notice within the platform at least 30 days before taking effect. The current version is always available at this URL.
11. Contact
For privacy-related enquiries, to exercise your rights, or to make a complaint, contact [email protected].