Privacy Policy
What we collect, what we deliberately do not, and what you can ask us to do about it.
Version 2.0 · Effective 1 September 2026
Signed up before 1 September 2026? Version 1.0 remains available.
Introduction
Labshock Security LLC ("Labshock", "we", "our", or "us") values your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how long we keep it, who we share it with, and what rights you have over it. It covers the labshocksecurity.com website and the Labshock platform. It does not cover the environments you build and run inside your own Labshock deployment — see "Customer Environments" below.
Data Controller
Labshock Security LLC Registered in South Carolina, United States Mailing address: 108 W 39th Street, Ste 1006 PMB2509 New York, NY 10018 United States Email: info@labshocksecurity.com For privacy questions, data requests, or to exercise any of the rights described below, write to info@labshocksecurity.com with "Privacy" in the subject line.
Account Information
Collected when you register and while you hold an account: - Name - Email address - Organization, where applicable We sign you in with a one-time code sent to your email address. Labshock never asks for, uses or stores a password.
Platform Data
Generated as you use the platform: - User progress - Lab completion - Achievements - License information - Support requests
Technical Data
Labshock does not record your IP address. Our web servers keep no access log, and the platform stores no client address. Abuse is prevented by limiting how many sign-in codes can be requested for an email address and across the service as a whole — neither of which needs to know where you are. We do not record your browser, device type or operating system, and we do not build a profile of you. What is kept: application error logs, retained for 7 days and then deleted automatically. These record what went wrong, not who was using the service.
Support Data
Information you voluntarily submit when asking for help — messages, screenshots, logs or configuration you choose to send — is processed solely to resolve that issue. Please do not send production credentials or sensitive operational data in a support request. If you do, we will ask you to rotate anything shared.
Customer Environments
Labshock does not access, inspect or monitor customer OT environments unless the customer explicitly requests support. Organization deployments run on infrastructure you control. Once installed, environments operate with no outbound connection required, and there is no Labshock-side copy of the process data, packet captures, telemetry or lab activity produced inside them. Nothing in this policy gives us a right to reach into a running deployment.
Customer Data Ownership
Customers retain ownership of the data they create within their own Labshock deployments — the topologies they build, the logic they write, the captures they take and the material they produce for their own teaching or testing. Labshock claims no ownership over customer-created content.
How We Use Your Information
We use the information described above to: - Provide and maintain the platform and your account - Issue and verify licenses - Answer support requests - Secure the service and prevent fraud or abuse - Meet legal and accounting obligations - Send service messages about your account or license We do not sell personal data, and we do not share it for advertising.
Legal Basis
Where the GDPR applies, we process personal data on the following bases: - Performance of a contract — providing the platform and the license you purchased - Legitimate interests — securing the service, preventing abuse, and improving the product - Legal obligations — tax, accounting and compliance record-keeping - Consent — where required, and withdrawable at any time
Data Retention
We retain personal data only for as long as necessary to provide our services, comply with legal obligations, resolve disputes and enforce agreements. Inactive accounts may be deleted after a reasonable period. Billing and tax records are kept for the period required by law, which is generally longer than the account itself.
International Transfers
Labshock Security LLC is established in the United States. Personal data may be processed in the United States or in other countries where our service providers operate. Where required by law, appropriate safeguards are used for those transfers.
Third-Party Services
We share personal data with a small number of providers, only as needed to run the service: - Stripe — payment processing and subscription management - Lemon Squeezy — payment processing and subscription management Payment card details are handled by those providers and are never stored by Labshock. The labshocksecurity.com website uses no third-party analytics, advertising or tracking services. There is no Google Analytics, no tag manager and no advertising pixel on it.
Cookies & Local Storage
The Labshock platform does not set cookies. Your sign-in token is held in your browser's local storage. It stays on your device, is sent only to Labshock when you use the platform, and is removed when you sign out. We do not use advertising or analytics cookies, and we do not participate in cross-site tracking.
Security Measures
We use encryption in transit, access controls, authentication, logging and other reasonable administrative, technical and organizational measures to protect personal data from unauthorized access, alteration, disclosure or destruction. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires it.
Your Rights
Subject to applicable law, you have the right to: - Access the personal data we hold about you - Correct data that is inaccurate or incomplete - Delete your data - Receive your data in a portable format - Restrict how we process your data - Object to processing based on legitimate interests - Withdraw consent, where processing is based on consent - Opt out of marketing communications at any time To exercise any of these, contact info@labshocksecurity.com. You also have the right to complain to your local data protection authority.
California Privacy Rights
California residents may have additional rights under applicable law, including rights to know, delete and correct personal information, and the right not to be discriminated against for exercising them. Labshock does not sell personal information and does not share it for cross-context behavioural advertising.
Children
Our services are not directed to children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact info@labshocksecurity.com and we will delete it.
Changes to This Policy
We may update this Privacy Policy. Every update is published on this page with a new version number and effective date, and the superseded version remains available. Material changes will be communicated to account holders by email or in-product notice before they take effect.
Contact Us
Questions, data requests or complaints about this Privacy Policy: Labshock Security LLC South Carolina, United States Email: info@labshocksecurity.com Please put "Privacy" in the subject line so the request is routed correctly.