Privacy Policy

This Privacy Policy explains how ConsciousLab, Inc. and ConsciousLab GmbH ("ConsciousLab", "we") collect, use and share personal data when you visit our websites, create an account or use our services. It also explains your rights and how to exercise them.

ConsciousLab GmbH, Schlesische Straße 26, 10997 Berlin, Germany, is the controller for personal data of users in the European Economic Area, the United Kingdom and Switzerland. ConsciousLab, Inc., 548 Market Street, Suite 400, San Francisco, CA 94104, is the controller for all other users.

1. Data we collect

Account data. Name, email address, password hash, role, time zone and notification preferences when you create an account or are invited to a workspace.

Billing data. Billing address, VAT number and the last four digits and expiry of your card. Full card numbers are processed by our PCI DSS Level 1 payment partners and never stored by us.

Usage data. Log data such as IP address, browser, device, pages visited, actions taken in the app and API requests, used to operate, secure and improve the services.

Customer data. Data you submit to the services, such as events, telemetry, agent prompts and payment or trading records. We process customer data on your behalf as a processor under our Data Processing Addendum, not under this policy.

Communications. Messages you send through our contact form, support channels or email.

Cookies. See our Cookie Policy.

2. How we use personal data

We do not sell personal data and we do not use customer data or prompts to train models offered to other customers.

3. Sharing

We share personal data only with:

• Sub-processors that host and operate the services, such as cloud infrastructure in Frankfurt and Oregon, email delivery and customer support tools. The current list is published in our trust centre, and we give 30 days' notice of changes.
• Regulated partners for Payments and Trading, such as our e-money issuer and broker-dealer partner, where you use those modules.
• Authorities where required by law, after reviewing each request for validity.
• Successors in a merger or acquisition, subject to this policy.

4. International transfers

Workspaces choose an EU or US data region, and customer data is stored in that region. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses and, for transfers to the United States, the EU-US Data Privacy Framework where the recipient is certified.

5. Retention

We keep account data for as long as your account is active and for 30 days afterwards. Billing records are kept for 10 years to meet German tax law. Security logs are kept for 13 months. Payment and trading records are kept for the periods required by financial regulation, typically 5 to 7 years.

6. Security

ConsciousLab is certified to ISO 27001 and audited annually for SOC 2 Type II. Data is encrypted in transit with TLS 1.3 and at rest with AES-256. Access to production systems requires hardware-key authentication and is logged. We notify affected customers of a personal data breach without undue delay and within 72 hours where required.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete or port your personal data, to object to or restrict processing, and to withdraw consent. California residents have the rights described in the CCPA, including the right to know and to delete, and we do not sell or share personal information for cross-context behavioural advertising.

To exercise a right, email privacy@consciouslab.xyz. We respond within 30 days. You can also lodge a complaint with a supervisory authority; our lead authority is the Berlin Commissioner for Data Protection and Freedom of Information.

8. Contact

Our Data Protection Officer can be reached at dpo@consciouslab.xyz or by post at the Berlin address above.