Privacy Policy
This policy explains what personal data Labsite handles, why, and your rights. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and India’s Digital Personal Data Protection Act, 2023 (DPDP Act). LabCanvas is the controller (“data fiduciary” under the DPDP Act) for account data. For the content labs publish, the lab is in charge and we act on its behalf — see the data-protection terms.
What we collect
- Account details: your name, email address and a scrambled (hashed) version of your password — never the password itself.
- Content you add: everything on your lab’s site, including details about lab members that your team chooses to publish.
- Sign-in and security data: a session cookie to keep you signed in, and the IP address of sign-in attempts, used briefly to block password guessing.
- Billing: your plan and subscription status. Card and bank details go directly to Dodo Payments; we never receive them.
- Imports: the address of a website you ask us to import, and when.
- Visitors to lab sites: lab websites set no cookies and contain no trackers or advertising. Like any website host, our network (Cloudflare) processes visitors’ IP addresses to deliver pages and protect against attacks; we don’t build profiles of visitors.
- Job applications: if a lab takes applications on its site, what applicants send (name, email, answers and files such as a CV) is stored for that lab and shown only to its team. The lab decides what to do with it and is the controller of it; we are its processor (see the data protection terms). Applicants should contact the lab to see or delete their application; labs can delete applications at any time.
Why we use it, and our legal basis
- To provide the service you signed up for — your account, your site, sign-in, team invites, imports and publication updates (performance of a contract).
- To keep Labsite secure and prevent abuse (our legitimate interest in a safe service).
- To handle payments, taxes and accounting (legal obligation and contract).
- To answer you when you contact us (legitimate interest, or your consent).
We don’t sell personal data, don’t use it for advertising, and don’t use your content to train AI models.
Cookies
Labsite uses one essential cookie, ls_session, to keep you signed in (HTTP-only, secure, up to 30 days). No analytics or advertising cookies are used, so there is no cookie banner.
Who we share it with
Only the service providers that run Labsite for us, each bound by a data-processing agreement:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, file storage, content delivery and security for the app and every lab site | Global network; data stored in Cloudflare’s regions |
| Dodo Payments | Payments and subscriptions, as merchant of record (we never see card details) | India and the countries where Dodo operates |
| Anthropic, PBC | Reading an existing website when someone chooses to import it, and the AI assistant in the dashboard (the request and the site’s content are sent for that request only) | United States |
| Piqo | Privacy-friendly visitor statistics on Labsite’s own public pages (home, pricing, blog, legal, sign-in); never on lab sites or the dashboard | Global |
| Firecrawl (Mendable, Inc.) | Fetching websites built with JavaScript during an import, only when a Firecrawl key is used | United States |
| OpenAlex (OurResearch), ORCID, Crossref, NCBI PubMed | Public scholarly databases queried for publication updates; we send ORCID iDs and searches the lab chose, never personal data of visitors | United States and Europe |
Some providers are outside your country. Where data leaves the EU, UK or India, we rely on the safeguards the law requires, such as the European Commission’s Standard Contractual Clauses. We disclose data to authorities only when legally required.
How long we keep it
- Account and site data: while your account exists. When you delete a site or your account it is removed from live systems at once and from backups within 30 days.
- Sign-in sessions: up to 30 days; expired sessions are cleared.
- Billing records: as long as tax law requires (usually up to 8 years).
Your rights
Wherever you live, you can:
- See and download your data — your account page has “Download my data”, and site owners can download their whole site.
- Correct it — edit your name and password on your account page, and your site’s content in the dashboard.
- Delete it — delete your account (and any sites only you own) from your account page.
- Object, restrict processing or withdraw consent, and, in the EU and UK, complain to your data-protection authority.
- Under the DPDP Act, seek grievance redressal from us first and then from the Data Protection Board of India, and nominate someone to exercise your rights if you die or become unable to.
To exercise a right or raise a grievance, contact our grievance officer at the contact address on this page (being set up; until then, write to us from your dashboard account email). We reply within 30 days (often much sooner). If you are listed on a lab’s website and want your details changed or removed, please ask that lab first; if they don’t respond, contact us.
Security
Data is encrypted in transit (HTTPS) and at rest. Passwords are hashed with PBKDF2, sign-ins are rate-limited, and staff access is limited. If a breach affects your data, we will tell you and the authorities as the law requires (within 72 hours where GDPR applies).
Children
Labsite is not directed at children. Lab sites shouldn’t publish personal data of children without verifiable consent from a parent or guardian.
Changes
We’ll post any changes here and tell account holders about significant ones by email or in the dashboard.