Privacy Policy
This policy explains how Recuritylab LLC handles personal information when you visit recuritylab.com or send us a request through our contact form. Use of the recuritylab platform itself is covered by the customer agreement [and data processing agreement] you sign with us.
Definitions (shared with Terms and Acceptable Use Policy): “recuritylab”, “we”, “us” and “our” mean Recuritylab LLC. The “site” is the website at recuritylab.com. The “platform” is the recuritylab virtual-device service, including its API, MCP server and AI agents.
At a glance
- We collect what you type into our request form, plus the minimum technical data needed to run and protect the site.
- Our analytics are cookieless (Cloudflare Web Analytics). We run no advertising trackers.
- We do not sell your personal information or share it for cross-context behavioural advertising.
- Cloudflare hosts the site, protects the form from spam and receives form submissions on our behalf. [SUBMISSION DESTINATION, if different]
- We keep request data for [RETENTION SUMMARY], then delete it.
- Questions or requests about your data: [PRIVACY EMAIL].
Who we are
The controller of your personal information is Recuritylab LLC, registered in [JURISDICTION] under number [REGISTRATION NUMBER], with its registered address at [REGISTERED ADDRESS].
Privacy contact: [PRIVACY EMAIL]
[EU/UK REPRESENTATIVE — name and address]
[DATA PROTECTION OFFICER — contact]
Scope
This policy applies to you if you visit recuritylab.com, submit our request form, or email us.
It does not cover data that customers process inside virtual devices on the platform. For that data, the customer is the controller and we act as a processor under the customer agreement and data processing agreement.
It also does not cover other websites we link to. Their own privacy policies apply.
Data we collect
| Category | Examples | Source |
|---|---|---|
| Request form data | Demo topic (demo, enterprise, government, university, training or press); full name; work email (and whether it uses a free-mail domain); organization, university or publication; job title; country; platforms (iOS, Android); primary use case; team size; course or research group; number of participants; course of interest; press deadline; your message; your Acceptable Use Policy confirmation; an enterprise cost estimate, only if you attach one; campaign tags in the link you followed (utm_source, utm_medium, utm_campaign), if present; the path of the page on our site that sent you to the form; a request ID and the time we received it | You |
| Spam-protection signals | Browser and device signals and your IP address, processed by Cloudflare Turnstile to tell people from bots; whether a hidden anti-spam field was filled in; how long the form took to fill in, kept only as aggregate counts | Your browser, via Cloudflare |
| Technical and security data | IP address, browser user agent and request details processed by Cloudflare’s network to deliver the site, protect it from attacks and limit repeated form submissions | Your browser |
| Aggregated analytics | Page views, referring site, country, device type and page performance, from Cloudflare Web Analytics, without cookies or a persistent identifier | Your browser |
| Correspondence | Emails you send us and our replies | You and us |
| Vetting data | [Results of sanctions-list or identity checks made when we review an access request] | [Provider / public lists] |
We don’t ask for sensitive information such as health data, religious beliefs or political opinions. Please don’t include it in your message.
Why we use it and legal bases
| Purpose | Data | Legal basis (GDPR Art. 6(1)) | Retention |
|---|---|---|---|
| Answer and manage your request; arrange a demo, evaluation or access | Form data, correspondence | (b) steps at your request before entering a contract; (f) legitimate interests for press and university inquiries | [PERIOD] |
| Review requests for lawful use, including sanctions and export screening | Form data, vetting data | (c) legal obligation where sanctions law applies; otherwise (f) legitimate interests in preventing misuse | [PERIOD] |
| Protect the site and form from spam and abuse | Spam-protection signals, technical data | (f) legitimate interests | [PERIOD] |
| Understand how the site is used and how fast it is, in aggregate | Aggregated analytics | (f) legitimate interests | [PERIOD] |
| Comply with the law and establish or defend legal claims | Any relevant data | (c) legal obligation; (f) legitimate interests | [PERIOD] |
Where we rely on legitimate interests, we have weighed them against your rights; you can ask us for details and you can object (see below).
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. A person reviews every request.
Cookies and similar technologies
We don’t use cookies for analytics or advertising. Cloudflare Web Analytics works without cookies.
Cloudflare and its Turnstile spam check may set a small number of strictly necessary cookies or similar items to protect the site and the form: [COOKIE / STORAGE INVENTORY].
If you use our enterprise estimate calculator and choose to attach the result to a request, the estimate is kept in your browser’s session storage. It expires after 30 minutes and is cleared when you send your request, remove the estimate or close the tab. It is not used for tracking. We don’t use local storage for tracking.
Who we share it with
| Recipient | Role | Purpose | Location and transfer mechanism |
|---|---|---|---|
| Cloudflare, Inc. | Processor | Hosting, content delivery, form handling (Workers), spam protection (Turnstile), rate limiting, cookieless analytics (Web Analytics) | United States, with a global network; Cloudflare data processing addendum; [EU-U.S. Data Privacy Framework / Standard Contractual Clauses] |
| [SUBMISSION DESTINATION] | [Processor] | [Receiving and storing form submissions] | [Location / mechanism] |
| [EMAIL PROVIDER] | [Processor] | [Sending and receiving email, including replies to requests and privacy correspondence] | [Location / mechanism] |
| Professional advisers (lawyers, accountants, auditors) | Independent recipients bound by confidentiality | Advice and audits | [Location] |
| Authorities, courts and regulators | Independent recipients | Where the law requires it, or to protect rights and safety | Varies |
| A buyer or successor in a merger or acquisition | Independent recipient | Continuing the business; we will give notice | Varies |
We do not sell personal information and do not share it for cross-context behavioural advertising.
International transfers
Cloudflare runs a global network, so your data may be processed in data centres outside your country, including in the United States. [SUBMISSION DESTINATION] processes data in [LOCATION].
When personal information leaves the EEA, the UK or Switzerland, we rely on [an adequacy decision / the EU-U.S. Data Privacy Framework and its UK and Swiss extensions / Standard Contractual Clauses / the UK International Data Transfer Addendum]. You can ask for a copy of the relevant safeguards at [PRIVACY EMAIL].
How long we keep it
- Requests we don’t take forward (declined or unanswered): [PERIOD], then deleted.
- Requests that lead to a demo or customer relationship: [PERIOD], then moved under the customer agreement or deleted.
- Press inquiries: [PERIOD].
- Vetting records: [PERIOD, or as sanctions law requires].
- Security logs we control (which contain no form contents): [PERIOD].
- Aggregated analytics: [PERIOD] in Cloudflare Web Analytics.
Cloudflare also keeps some network and security logs under its own policies: [CLOUDFLARE LOG RETENTION].
Your rights (EEA, UK, Switzerland)
If data protection law in the EEA, the UK or Switzerland applies to you, you have the right to:
- access the personal information we hold about you;
- have inaccurate information corrected;
- have your information erased;
- restrict how we use it;
- receive it in a portable format;
- object to our use of it, including where we rely on legitimate interests;
- withdraw consent at any time, where we rely on consent (this doesn’t affect earlier use);
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects.
You can also complain to a data protection supervisory authority, for example where you live or work. [Name of lead or competent authority] We’d appreciate the chance to resolve your concern first.
See How to exercise your rights.
Your rights (California and other US states)
Notice for California residents. In the last 12 months we have collected these categories of personal information:
- Identifiers — name, email address, IP address, request ID.
- Professional or employment information — organization, job title.
- Internet or network activity — pages viewed, referring page, spam-protection signals.
- Geolocation — country only.
- Inferences — none.
We collect them from you and your browser, for the business purposes in Why we use it, and disclose them only to the categories of recipients in Who we share it with.
We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. We honour Global Privacy Control signals, although we have no sale or sharing to opt out of.
You have the right to know what we collect and how we use it, to delete it, to correct it, and not to be discriminated against for using these rights. The rights to opt out of sale or sharing and to limit use of sensitive personal information don’t apply, because we do neither.
You may use an authorized agent; we’ll ask for proof of their authority. We verify every request by matching the details you give with what we hold, usually by replying to the email address you used.
Other US states. Residents of other states with comprehensive privacy laws, such as Virginia, Colorado, Connecticut, Texas and Oregon, have similar rights. Contact us the same way.
How to exercise your rights
Email [PRIVACY EMAIL]. Tell us which right you want to use and include the email address you used with us. We may ask for more information to confirm it’s you.
We reply within one month under GDPR (extendable by two further months for complex requests, in which case we’ll tell you why) and within 45 days under California law. Using your rights is free unless a request is clearly unfounded or excessive.
Security
The site is served only over encrypted connections (TLS, with HSTS). We collect only the data we need, restrict access to request data to the staff who handle requests, and keep form contents out of our server logs.
For how we protect data on the platform, see Security.
Children
The site and platform are for professionals. They are not directed at children under 16, or under 13 in the United States. If we learn that we’ve collected a child’s data, we delete it.
Changes and contact
When we change this policy, we update the date at the top. We highlight material changes on this page for at least 30 days.
Questions about privacy: [PRIVACY EMAIL]
Post: Recuritylab LLC, [POSTAL ADDRESS]
To book a demo, use our contact form. Related: Terms of Use · Acceptable Use Policy.