Privacy policy

The data controller is the operator of Labiqo, a sole proprietor based in Poland, in the European Union. For any privacy question or request, email support@labiqo.com.

• Account data: your email address, your name, and an optional timezone you can set in your profile.
• Practice history: your practice exam and lab attempts, answers, scores, and progress, so the product can grade your work and show your history.
• Auth audit events: security-relevant events such as sign-ins, including IP address and browser user agent, so we can detect abuse and let you review active sessions.
• Signup attribution: where your visit came from (UTM parameters and referrer), recorded once at signup so we know which channels work.
• Sign-in with GitHub or Google:both are switched OFF today and no button is rendered, so no provider has ever been contacted. If they are switched on, we receive your email address, whether the provider has verified it, an opaque provider account id and a display name, and nothing else. We never store a provider access, refresh or ID token, and we never call a provider's API: no repositories, no Drive, no contacts, no calendar.
• Cookies:a session cookie plus a small number of non-sensitive helpers, and Cloudflare's own cookies on the sign-up form. Details and lifetimes are in the cookie notice. There are no third-party advertising cookies.
• Purchases: for each payment, what was bought, the amount and currency charged, when it was paid or refunded, and a link to the receipt. We never see or store your card details.Payment is taken on Stripe's own hosted page and nothing about the card reaches our servers.
• Problem reports:if you use the “Report a problem” tab, what you wrote and which lab or attempt it was about. Nothing in the application reads one back to you; they go to us.

We ask for no date of birth, no address, no phone number and no payment details, and there is no field anywhere in the product for any of them.

• To provide the service (accounts, grading, progress, transactional email such as verification and password reset): performance of a contract, Art. 6(1)(b) GDPR.
• To keep the service secure (auth audit events, abuse detection, session management): legitimate interest, Art. 6(1)(f) GDPR.
• To understand which channels bring users (signup attribution): legitimate interest, Art. 6(1)(f) GDPR.
• To send marketing email: only with your consent, Art. 6(1)(a) GDPR. You opt in at signup or under Privacy in your account, and withdrawing consent is as easy as giving it: every marketing email carries an unsubscribe link that works without signing in, and the headers that let your own mail app offer its unsubscribe button. Either one takes effect immediately and we record when and how it was used. Account email - a verification code, a password reset, a receipt - is not marketing, carries no unsubscribe link, and continues for as long as the account exists.

• Account data and practice history: for as long as your account exists.
• Auth audit events: up to 12 months, then deleted or anonymized.
• Signup attribution: kept with your account record while the account exists.
• Purchase records: kept for as long as accounting law requires, which outlives your account. After a deletion the row keeps what was bought and what was charged and is no longer linked to a person. The INVOICE itself is Link's, not ours.
• Problem reports: kept while they are useful to fix the thing you reported.
• After account deletion: your account is soft deleted and personal identifiers are removed; practice statistics are anonymized so they can no longer be linked to you. Backups roll off on their regular schedule.

We do not sell your data. We use a small number of service providers who process data on our behalf under data processing agreements:

• Amazon Web Services (AWS): hosting and infrastructure in the EU (Stockholm region, eu-north-1), and AWS SES for transactional email delivery.
• Stripe, and its reseller Link: payments. Stripe is the merchant of record and Link is the seller you buy from, so they receive your email address and your payment details directly, and they decide and keep whatever their own terms say. We receive back only what was bought, what was charged and a link to the receipt. Their privacy policies govern what they hold.
• Cloudflare: the anti-bot check on the sign-up and password-reset forms. Cloudflare sees the request and sets its own cookies on its own domain; we receive a yes or no.
• Sentry (EU):application error reports, on Sentry's European instance. An error report can carry the URL you were on and your account id. It is off unless the error reporting is switched on for the stage.
• Anthropic:when you request AI feedback on an attempt, that attempt is sent to Anthropic's API: the questions, what you answered, what the grader said, and for a lab the commands you ran and any free text you wrote in an answer field. Your email address and your name are not sent.
• GitHub and Google: only if you choose to sign in with one, and both are switched off today. See the entry above for what they send us; what they log about the sign-in is governed by their own policies.

Where a processor handles data outside the EU, transfers rely on an adequacy decision or the European Commission's Standard Contractual Clauses.

Application data is hosted on AWS in the European Union (eu-north-1, Stockholm). We do not run advertising or third-party analytics scripts on the platform.

You have the right to:

• access the personal data we hold about you;
• have inaccurate data rectified;
• have your data erased;
• receive your data in a portable, machine-readable format;
• object to processing based on legitimate interest;
• withdraw consent at any time, without affecting past processing;
• lodge a complaint with a supervisory authority, in Poland the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority in your own EU country.

To exercise any right, use the self-service tools below or email support@labiqo.com. We respond within one month.

• Export: signed-in users can download a JSON copy of their data from the /account/privacy page. It includes your profile, your entitlements, your purchases, your attempts and what you typed into a lab.
• Deletion: you can delete your account from the same page. This soft deletes the account, removes personal identifiers, and anonymizes your practice statistics. It is not a refund request: if you want money back, ask first.

We set one essential session cookie on the platform host, two non-sensitive helper cookies on the .labiqo.com domain (lq_auth, a signed-in hint for the marketing site, and lq_attr, signup attribution), and a ten-minute lq_oauth_terms cookie only if you start a provider sign-up. Administrators get one more, in the admin area. Cloudflare sets its own on the sign-up form. No advertising and no analytics cookies. Full details, lifetimes, and how to clear them are in the cookie notice.

If we change what we collect or who we share it with, we will update this policy first and change the date at the top. For material changes we will notify registered users by email or an in-product notice.