Privacy Policy

Example Labs LLC (“we”) provides SaaS Foundation (“the service”) and is responsible for the personal data described here. Contact: privacy@aaronlabr.dev.

• Account: your name, email address, whether you verified it, and your password, stored only as a hash. You give us these when you sign up.
• Sign-in sessions: a cookie that keeps you signed in, and for each session your IP address and browser user agent.
• Organizations: each organization's name and address in the service, its members and their roles, and pending invitations (the invitee's email address, role and who invited them).
• Content you create: projects (name, description and who created them).
• Billing: your organization's plan and subscription status. You enter payment details in Polar's checkout; we don't receive card data.
• Security: your IP address, used to limit repeated sign-in and sign-up attempts, and sent with a bot-check token to Cloudflare Turnstile when you sign up, sign in, reset your password or request a verification email.
• Technical logs: for each request, its path (without query string), status and outcome, and error messages.

We don't use advertising or analytics trackers.

• To provide the service (accounts, sign-in, organizations, invitations, projects) and send its emails (address verification, password reset, invitations), as needed to perform our contract with you.
• To bill paid plans through Polar, as needed to perform that contract.
• To keep the service secure and working (rate limiting, bot protection, logs, error alerts, backups), in our legitimate interest in its security and reliability.

We don't sell personal data or use it for marketing.

Service providers that process data for us are listed on the Subprocessors page. Polar sells paid plans as merchant of record and handles the payment data you give it under its own privacy policy.

Our database runs in the United States (AWS us-east-1), and our providers may process data in other countries. Where the law requires safeguards for such transfers, we rely on our providers' data processing terms.

• Account, organization and project data: while the account or organization exists. To delete your account or an organization, write to privacy@aaronlabr.dev.
• Sessions expire after 7 days without use; verification, password-reset and invitation links expire too.
• Request logs: 7 days.
• Backups: daily copies of the database kept for up to 30 days, and a few recent database snapshots that are replaced as new ones are taken. Deleted data leaves these copies as they expire or are replaced. If we ever restore the database, we keep a copy of it from before the restore until we delete it; deleted data stays in that copy until then.

You can ask us to access, correct, delete or export your personal data, or object to its processing, by writing to privacy@aaronlabr.dev. We may ask you to confirm your identity first. You can also complain to the data protection authority where you live.

Questions about this policy: privacy@aaronlabr.dev.