Privacy Policy

Your privacy matters to us. This policy covers what Optima Lab collects, how we use it, and how you can control it.

1. Who we are

Optima Lab is operated by [Legal Entity Name], [registered address], [country of registration], company registration number [XXXXXXX] (“Optima Lab,” “we,” “us”).

For privacy questions, contact us at privacy@optimalab.io.

2. Scope

This policy covers optimalab.io and any subdomains. It does not cover third-party sites we link to, or a client's own website once we've completed an audit of it, that site's privacy practices are the client's responsibility, which is usually the entire point of us being there.

3. What we collect

When you use the free compliance scanner: the URL you submit; your email address, only if you choose to unlock the full results; and automatically, your IP address and browser type, for basic security and abuse prevention.

When you submit the inquiry form: name, work email, company name, and whatever you write in the message field, plus which service areas you flagged if you used the issue picker first.

When you browse the site generally: standard server log data (IP address, browser type, pages visited, referring page), and cookies, as described in our Cookie Declaration, based on the choice you make in the consent banner.

If you become a client: billing and contact details needed to deliver and invoice the engagement, and any information you share with us about your own site's trackers, vendors, and configuration, so we can produce your audit report.

We do not collect data from your website's own visitors when we audit your site. We observe and report on what your site does; we don't sit in the data pipeline the way a consent management tool does.

4. Legal basis

Where GDPR applies, we rely on:

• Consent (Art. 6(1)(a)) for non-necessary cookies and for the scanner's email capture
• Contract (Art. 6(1)(b)) for delivering a paid audit engagement you've booked
• Legitimate interest (Art. 6(1)(f)) for basic security logging and responding to inquiries you initiate

5. How we use it

• To run the scanner and email you the results you asked for
• To respond to inquiries and book calls
• To deliver, document, and invoice audit engagements
• To improve the scanner's detection accuracy over time (using aggregated findings, not your identity, unless you're a client we're actively working with)
• To send you engagement-related updates if you're a client

We do not sell personal information. We do not share scan results or inquiry details with third parties except where necessary to deliver the service you asked for.

6. Retention

• Scanner submissions: kept for [12 months], then deleted, unless you've become a client
• Inquiry form submissions: kept for [24 months], then deleted
• Client account and engagement records: kept for [X years] after the engagement ends
• Server logs: kept for [30 days]

7. Who we share data with

• [Hosting provider — DigitalOcean], which hosts our application and database
• [Email delivery provider — TBD], to send scan results and respond to inquiries
• Independent legal counsel, only for specific client engagements where a legal review is part of the deliverable, and only with that client's knowledge

We do not sell, rent, or trade personal information to advertisers.

8. Cookies

See our Cookie Declaration for the full list by category. In short: necessary cookies run the site and cannot be turned off; preference, statistics, and marketing cookies only run if you allow them in the banner, and you can change your choice at any time.

9. Your rights

If you're in the EU/EEA or UK (GDPR): access, correction, deletion, restriction, portability, and objection to processing. Contact privacy@optimalab.io to exercise any of these.

If you're a resident of a US state with a comprehensive privacy law (California, Colorado, Connecticut, Virginia, Texas, and others as they take effect): the right to know what we've collected, delete it, correct it, and opt out of any sale or sharing of personal information. We do not sell personal information. To exercise these rights, email privacy@optimalab.io. We'll verify your request and respond within the timeframe your state's law requires, generally 45 days.

Global Privacy Control: our site is configured to recognize and honor GPC signals as an opt-out request for non-necessary cookies, consistent with the states that require it.

10. Children

Our services are directed at businesses, not children. We don't knowingly collect data from anyone under 16.

11. International transfers

If you're located outside [primary jurisdiction] and use our services, your data may be processed in [jurisdiction]. Where required, we rely on [Standard Contractual Clauses / an adequacy decision, confirm which applies once hosting and vendor locations are finalized].

12. Changes to this policy

We'll update the date at the top of this page when we make changes. Material changes will be noted here directly.

13. Contact

Optima Lab
[Address]
privacy@optimalab.io