Privacy Notice
Last updated 27 October 2026
Who is responsible
Project Lab is the data controller for personal data processed through the Project Lab service.
What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, login credentials | Creating and securing your account | Contract |
| Profile details (headline, bio, industry, location, rates) | Showing your public profile and Hire talent listing | Contract / consent |
| Artifacts, discussions, messages | Providing the service | Contract |
| Prompts and AI usage counts | Generating content and enforcing plan limits | Contract |
| Device data, IP address, usage logs | Security, fraud prevention, improving the product | Legitimate interests |
| Support messages | Customer support | Contract / legitimate interests |
Who we share it with
- Service providers that host, run and support the service, including AI model providers that process prompts.
- Paddle.com, our Merchant of Record, for selling plans, subscription management, payments, tax compliance and invoicing.
- Professional advisers (legal, accounting).
- Authorities where required by law.
International transfers
Some providers may process data outside your country, including outside the UK/EEA. Where they do, we rely on safeguards such as Standard Contractual Clauses or adequacy decisions.
Retention
We keep data while your account is active and for up to 30 days after closure, then delete or anonymise it, unless the law requires longer.
Your rights
You can request access, correction, deletion, restriction, portability, object to processing, and withdraw consent. You may complain to your data protection authority. We respond within one month.
Security
We use encryption in transit, access controls and least-privilege policies to protect your data.
Cookies
We use only essential cookies and local storage needed to keep you signed in. We do not use advertising cookies.