Privacy Policy

1. Introduction

Welcome to Co-Lab ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, and password when you register
• Payment Information: Processed securely through PayPal (we do not store payment card details)
• Custom Research Requests: Product URLs, competitor information, and business details you submit
• Communications: Messages, feedback, and support requests you send us

2.2 Information Automatically Collected

• Analytics Data: Page views, clicks, and usage patterns via Vercel Analytics (privacy-friendly, no personal identifiers)
• Device Information: Browser type, operating system, IP address
• Session Data: Authentication cookies for maintaining your logged-in session

3. How We Use Your Information

We use your information to:

• Provide, operate, and maintain our services
• Process your payments and subscriptions through PayPal
• Deliver custom research reports you've purchased
• Send you important updates about your account and services
• Improve our website and develop new features
• Analyze usage patterns to enhance user experience (via Vercel Analytics)
• Respond to your inquiries and provide customer support
• Detect and prevent fraud or abuse

4. Cookies and Tracking Technologies

4.1 Essential Cookies (No Consent Required)

• Session Cookie: Required for authentication and keeping you logged in

4.2 Non-Essential Cookies (Require Consent)

• PayPal Cookies: Set by PayPal for payment processing and fraud prevention

4.3 Analytics

We use Vercel Analytics, a privacy-friendly analytics service that does NOT use cookies or collect personally identifiable information. It provides aggregated traffic data without tracking individual users across websites.

For more details, see our Cookie Policy.

5. Third-Party Services

5.1 PayPal

We use PayPal for payment processing. When you make a payment, your payment information is transmitted directly to PayPal and is subject to PayPal's Privacy Policy. We do not store your credit card or bank account information.

5.2 Google OAuth

We offer Google Sign-In as a convenient authentication method. When you use Google to sign in, we receive your name, email address, and email verification status from Google. This data is processed according to Google's OAuth 2.0 policies and our Privacy Policy. We do not store your Google password.

5.3 Polar (Payment Processing)

We use Polar for payment processing alongside PayPal. When you make a payment through Polar, your payment information is transmitted directly to Polar and is subject to Polar's Privacy Policy. We do not store your credit card or bank account information.

5.4 Vercel (Hosting & Analytics)

Our website is hosted on Vercel. Vercel Analytics collects anonymous, aggregated data about website usage without using cookies or tracking individual users.

5.5 Microsoft Clarity

We use Microsoft Clarity to understand how users interact with our website through session recordings and heatmaps. This helps us improve user experience by identifying pain points and optimizing navigation. Clarity collects anonymized behavioral data and does not track personally identifiable information without consent. You can learn more at Microsoft's Privacy Statement.

5.6 Tawk.to (Live Chat Support)

We use Tawk.to to provide live chat support. When you use our chat widget, Tawk.to may collect your IP address, browser information, and chat messages to facilitate support conversations. This data is stored securely and used only for customer support purposes. See Tawk.to's Privacy Policy for more details.

5.7 Neon (Database)

Your account data is securely stored in Neon's PostgreSQL database with encryption at rest and in transit.

6. Data Sharing and Disclosure

We do NOT sell your personal information. We may share your information only in these circumstances:

• Service Providers: With PayPal, Vercel, and Neon to provide our services
• Legal Requirements: When required by law or to protect our rights
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize us to share information

7. Your Privacy Rights

Depending on your location, you may have the following rights:

7.1 GDPR Rights (EU/UK Users)

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your account and data
• Data Portability: Receive your data in a portable format
• Withdraw Consent: Opt out of cookie consent at any time
• Object to Processing: Object to certain data processing activities

7.2 CCPA Rights (California Users)

• Know what personal information we collect and how we use it
• Request deletion of your personal information
• Opt-out of the sale of personal information (we do not sell personal data)
• Non-discrimination for exercising your rights

7.3 How to Exercise Your Rights

To exercise any of these rights, contact us at: privacy@co-lab.dev

8. Data Security

We implement appropriate technical and organizational security measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS)
• Encryption of data at rest in our database
• Secure password hashing (bcrypt)
• HTTP-only, secure session cookies
• Regular security audits and updates

9. Data Retention

We retain your personal information only as long as necessary to provide our services and comply with legal obligations:

• Account Data: Retained while your account is active
• Payment Records: Retained for 7 years for tax and accounting purposes
• Research Reports: Retained as long as your account is active
• Deleted Accounts: Data permanently deleted within 30 days of account closure

10. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses approved by the European Commission
• Privacy Shield certifications where applicable
• Adequate data protection measures as required by law

11. Children's Privacy

Our services are not intended for children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Updating the "Last updated" date at the top of this policy
• Sending an email to your registered email address
• Displaying a prominent notice on our website

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: