corelab.

Legal

Privacy Policy

Version 1.3 · Effective date: April 17, 2026

Last updated: April 18, 2026

Data Controller: CoreLab Creative · info@corelabcreative.com

1. Data Controller Identity

CoreLab Creative ("CoreLab", "we", "our", "us") operates the design services subscription platform available at its main domain and associated subdomains (the "Platform"). As the data controller, CoreLab determines the purposes and means of processing personal information collected through the Platform.

2. Scope of Application

This Privacy Policy applies to:

  • Visitors to CoreLab's public website.
  • Registered users who subscribe to services through an active subscription ("Clients").
  • Team members of a Client invited to the Platform ("Team Members").
  • CoreLab's internal staff with administrative access to the system ("Staff" and "Platform Admins").
  • Persons who submit inquiries through the public contact form.

This policy does not apply to third-party websites that the Platform may link to.

3. Personal Data We Collect

3.1 Registration and Account Data

When you create an account with CoreLab, we collect:

FieldPurposeRequired
Email addressUnique account identifier and communicationsYes
Password (securely stored via hash)Authentication — never stored in plain textYes
Full nameIdentification and personalized communicationsYes
Company/organization nameWorkspace creationYes
Selected subscription planService configuration and billingYes
Custom offer tokenAccess to individually negotiated plansNo

3.2 User Profile Data

Once registered, users have associated: display name on the Platform, email address linked to the account, profile picture (when authenticated via Google), and language preference stored in user metadata.

3.3 Authentication and Security Data

  • Active sessions: Session tokens managed by our authentication provider, stored in secure browser cookies. Session metadata (device type, browser, start date) is accessible by the user from the Platform's security settings.
  • Multi-factor authentication (MFA): If the user enables two-factor authentication (TOTP), the descriptive name of the registered device is stored. 6-digit codes are never stored — only verified at the moment of use.
  • Invitation tokens: Temporary signed tokens sent by email to onboard new members or staff. Invalidated upon use.
  • Session history: Sign-out actions are logged in the account activity history.

3.4 Service Request Data

When creating a design request, we collect: title and description of the work, request type and priority, estimated deadline (optional), associated project (optional), custom fields depending on the request type, attachments (up to 10 MB per file), as well as timestamps for the first staff response and request resolution.

The history of status changes for each request (including the responsible user, previous and new status, and reason for change when applicable) is also recorded.

3.5 Internal Communication Data

  • Text of comments made by clients or staff on service requests.
  • Resolution description provided by staff, with attachments if applicable.
  • Internal notification records (type, content, read status).

3.6 Billing and Payment Data

CoreLab does not store payment card data. Processing is handled entirely by Stripe. What CoreLab stores in its own database:

  • Client and subscription identifiers in the payment system.
  • Subscription status (active, cancelled, past due, incomplete, etc.).
  • Current billing period and trial end dates.
  • Remaining balance for single-payment projects.
  • Scheduled cancellation at end of period indicator.

Payment method details visible to the user (brand, last 4 digits, expiry) are obtained directly from the payment processor in real time and are not persisted in CoreLab's database.

3.7 Organization Data

For each registered organization: name, URL identifier derived from the name, custom domain (if applicable), logo (if applicable), workspace settings, and membership relationships (which users belong to the organization and with which role).

3.8 File Attachments

Uploaded files are stored in a private storage system. The following file metadata is recorded: original name, internal storage path, size, file type, uploading user, associated request or resolution, and upload date.

Permitted types: Images (PNG, JPEG, GIF, WebP), documents (PDF, TXT, DOC/DOCX, XLS/XLSX, PPT/PPTX), compressed files (ZIP). Maximum size: 10 MB per file.

3.9 Public Contact Data

When using the website's contact form: name, email address, message, selected language, and the source URL of the request (automatically detected — not entered by the user).

3.10 Technical and Audit Data

The internal audit system automatically records: the user who performed the action, the organization involved, the type of action executed, the affected resource, additional relevant context, IP address, browser type and HTTP client, and the action timestamp.

4. Processing Purposes and Legal Basis

PurposeData InvolvedLegal Basis
Provision of subscription serviceAccount, profile, requests, comments, files dataContract performance (Art. 6.1.b GDPR)
Authentication and identificationEmail, hashed password, session tokens, MFA factorsContract performance / Legitimate interest
Billing and collectionSubscription data, payment processor identifiersContract performance / Legal obligation
Transactional communicationsEmail, name, ticket/invitation dataContract performance
Team invitation managementInvitee email, assigned roleLegitimate interest of the controller
Internal security auditIP, browser type, action performed, resourceLegitimate interest (security)
Fraud detection and preventionIP, access patterns, activity historyLegitimate interest
Technical supportTicket data, attachments, commentsContract performance
Service improvementAggregated and anonymized usage dataLegitimate interest
Compliance with legal obligationsThose required by applicable regulationsLegal obligation (Art. 6.1.c GDPR)

5. Data Transfers to Third Parties

CoreLab shares personal data only with the following providers, as data processors, under agreements that ensure adequate levels of protection:

5.1 Database and Authentication Provider

Our infrastructure provider stores all application data (user accounts, organizations, subscriptions, requests, comments, attachments, activity logs). Data is hosted on servers with encryption at rest and in transit.

5.2 Payment Processor

Payments are processed through a PCI-DSS certified processor. The client's email, organization name, and subscription metadata are shared. CoreLab never sends payment card data directly — users enter it on a form hosted by the payment processor.

5.3 Transactional Email Provider

The recipient's email address, name, and email content are shared (may include organization name, plan name, ticket title and status, invitation URLs).

5.4 Google (OAuth authentication — optional)

Only when the user chooses to authenticate with Google. CoreLab receives the user's email, name, and profile picture through the standard OAuth flow.

5.5 Google (Typography)

Loading typography from Google's CDN means the browser makes a request to Google's servers, which may include the IP address and browser type. For more information: Google Fonts Privacy FAQ.

CoreLab does not sell personal data to third parties under any circumstances.

6. Storage, Retention and Deletion

6.1 Retention Period

Data CategoryRetention Period
Active account dataWhile the account is active
Cancelled account data90 days after cancellation, then deletion or anonymization
Activity logs2 years
File attachmentsDuring subscription + 30 days post-cancellation
Unaccepted invitation tokens7 days (automatic expiry)
Billing dataPer applicable accounting obligations (generally 5–7 years)

6.2 Account Deletion

Upon requesting deletion: profile data is deleted or anonymized; tickets and associated files may be retained in anonymized form for workspace record integrity; payment processor data is retained per tax obligations; a confirmation email is sent.

7. Data Subject Rights

RightDescription
AccessObtain confirmation of whether your data is processed and a copy thereof
RectificationCorrect inaccurate or incomplete data
Erasure ("right to be forgotten")Request deletion of your personal data
PortabilityReceive your data in structured, machine-readable format
ObjectionObject to processing based on legitimate interest
RestrictionRequest temporary restriction of processing
Non-automationNot be subject to decisions based solely on automated processing
Withdrawal of consentWithdraw at any time when processing is based on consent

To exercise any of these rights: info@corelabcreative.com with subject [PRIVACY]. We will respond within a maximum of 30 days.

8. Data Security

CoreLab implements the following technical and organizational measures:

  • Encryption in transit: All communications between client and Platform are conducted over HTTPS/TLS.
  • Encryption at rest: Stored data is encrypted at rest by the infrastructure provider.
  • Passwords: Never stored in plain text — secure hashing is delegated to the authentication provider.
  • Multi-factor authentication (MFA): Available and recommended for all users via TOTP authenticator.
  • Role-based access control: Differentiated roles for clients and internal staff, with restrictions applied at both application logic and database policy levels.
  • Organization isolation: Database security policies ensure no organization can access another's data.
  • Private file storage: Files are served only via temporary signed URLs.
  • Audit: All critical actions are logged with user, IP, browser type, and timestamp.

9. Cookies and Browser Storage

See the Cookie Policy for detailed information.

No third-party tracking cookies or advertising cookies are used.

10. Minors

The Platform is directed exclusively to users aged 18 or older, or to legal representatives of business entities. CoreLab does not intentionally collect personal data from minors. If we identify that data has been collected from a minor without parental consent, we will proceed with its immediate deletion.

11. Changes to this Policy

In the event of material changes, active users will be notified by email at least 14 days in advance. Continued use of the Platform after the effective date implies acceptance of the changes.

12. Supervisory Authorities

If you believe that the processing of your data infringes applicable regulations, you may lodge a complaint with the competent authority in your jurisdiction:

RegionSupervisory Authority
European UnionSupervisory authority of the Member State of residence
SpainSpanish Data Protection Agency — aepd.es
United KingdomInformation Commissioner's Office (ICO) — ico.org.uk
BrazilNational Data Protection Authority (ANPD)
MexicoNational Institute of Transparency (INAI)
ArgentinaAgency for Access to Public Information (AAIP)
ColombiaSuperintendence of Industry and Commerce (SIC)
ChileCouncil for Transparency
PeruNational Data Protection Authority (MINJUS)
CanadaOffice of the Privacy Commissioner (OPC)
USA (California)California Privacy Protection Agency (CPPA)
USA (other states)Attorney General of state of residence

13. Additional Rights for California Residents (CCPA/CPRA)

This section applies exclusively to California residents and supplements the rights in §7.

13.1 Categories of information collected

CCPA CategoryExamplesCollected
IdentifiersName, email address, IP address, user identifierYes
Commercial informationSubscription and payment history, subscribed planYes
Internet activitySession logs, browser type, platform action historyYes
Approximate geolocationInferred from IP addressYes (indirect)
Professional informationCompany name, role/position in organizationYes
Inferred preferencesPreferred language, interface theme, tutorial statusYes
Sensitive personal informationPassword (hashed), MFA factorsYes

13.2 No Sale or Sharing Declaration

CoreLab does not sell or share its users' personal information with third parties for advertising purposes. No California residents' data has been sold or shared in the last 12 months.

13.3 Rights of California Residents

RightDescription
KnowRequest information about categories of data collected, sources, purposes, and third parties
DeleteRequest deletion, subject to legal exceptions
CorrectRequest correction of inaccurate data
Opt-out of sale/sharingNot applicable in practice — CoreLab does not sell or share data
Non-discriminationCoreLab will not discriminate for exercising these rights
Limit sensitive dataCoreLab already complies with this by design: only uses sensitive data to provide the service

Exercise: info@corelabcreative.com — Subject: [CCPA] - description. Response within 45 days (extendable to 90 with notice).

14. UK Residents (UK GDPR)

Processing of data of UK residents is governed by UK GDPR (Data Protection Act 2018). The same rights as in §7 apply with the same response timelines. Data transfers are carried out under mechanisms approved by the ICO, including the UK IDTA where applicable. Supervisory authority: Information Commissioner's Office (ICO) — ico.org.uk.

15. Canadian Residents (PIPEDA / Quebec Law 25)

Processing of Canadian residents' data complies with PIPEDA's ten principles: accountability, identifying purposes, consent, limiting collection, limiting use, retention and disclosure, accuracy, safeguards, openness, individual access, and challenging compliance.

For Quebec residents, Quebec Law 25 (in effect since 2023) additionally applies. Contact to exercise rights: info@corelabcreative.com — Subject: [PIPEDA].

16. Other U.S. State Laws

CoreLab acknowledges and respects the rights established by the following state laws: VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), UCPA (Utah), TDPSA (Texas), OCPA (Oregon), MCDPA (Montana), ICDPA (Iowa), MCDPA (Minnesota).

Universal commitments: CoreLab does not sell personal data under any state definition, does not use data for behavioral advertising, does not carry out profiling with significant effects, honors opt-out signals (including GPC), and responds to requests within 45 days (extendable to 90).

If a request is denied, the individual may appeal within 30 days. CoreLab will resolve the appeal within 60 additional days and inform the right to complain to the state Attorney General. Exercise: info@corelabcreative.com — Subject: [PRIVACY-US] - [State] - description.

17. Global Privacy Control and Do Not Track

GPC (Global Privacy Control): CoreLab detects and respects the GPC signal. Since CoreLab does not sell or share data for advertising purposes, its activation does not alter Platform behavior — these commitments already apply to all users by default.

DNT (Do Not Track): CoreLab registers this signal. Since no advertising tracking cookies or behavioral analytics systems are used, there is no practical difference between users with or without DNT enabled.

18. Indian Residents (DPDPA 2023)

CoreLab acts as a Data Fiduciary under the Digital Personal Data Protection Act 2023. Processing is based on free, specific, and informed consent granted at registration. The data principal may withdraw it at any time, which may result in service termination if the data is necessary for its provision.

Rights: access to information, correction and erasure, grievance redress mechanisms, and nomination of a representative. In the event of a security breach, CoreLab will notify the Data Protection Board of India and affected data principals. Contact: info@corelabcreative.com — Subject: [DPDPA] - description.

19. Australian Residents (Privacy Act 1988 / APPs)

CoreLab complies with the 13 applicable Australian Privacy Principles (APPs): transparent management, collection limited to declared purposes, notification at time of collection, use restricted to primary purposes, no unsolicited direct marketing, cross-border disclosure under safeguards, no use of Australian government identifiers, maintenance of accurate data, appropriate security measures, and right of access and correction.

To exercise rights or submit complaints: info@corelabcreative.com — Subject: [PRIVACY-AU] - description. If the complaint is not satisfactorily resolved, it may be escalated to the Office of the Australian Information Commissioner (OAIC) — oaic.gov.au.

20. Contact

CoreLab Creative
Email: info@corelabcreative.com
Suggested subject: [PRIVACY] - brief description

Version 1.3 — Last updated: April 18, 2026. Coverage: GDPR · UK GDPR · LGPD · ePrivacy · CCPA/CPRA · VCDPA · CPA · CTDPA · UCPA · TDPSA · OCPA · MCDPA · ICDPA · PIPEDA · Loi 25 · DPDPA 2023 · Privacy Act 1988 (Australia)