1. Controller
Privacy questions, access requests and deletion requests may be sent to LabCheck@proton.me.
2. Current account service
Authentication runs inside the LabCheck application and stores its account records in LabCheck’s database. The public member profile is separate and does not contain the account email address. The support and source-application forms send their contents to the LabCheck contact mailbox through the transactional email provider.
3. Information we may collect
Private account data includes an email address, chosen username, customer number, password hash, email-verification state, age confirmation, legal acceptance records, essential session identifiers and timestamps. The public member record contains the username, role, account status, consent timestamps and membership level, but no email address or real name. Membership data may include the selected plan, subscription state, billing periods and provider reference numbers. LabCheck does not store readable passwords, full card details or wallet private keys. Community data may include source ratings, written experiences, posts, reports, uploaded source images and documents, moderation records and source applications. Communications include messages you send to support. Hosting and security systems may transiently process IP address, browser information, request timestamps, pages requested and security events. LabCheck session rows intentionally omit IP address and user-agent values; database rate-limit keys are pseudonymised with a keyed hash. Before public launch, account data may also record whether you requested the one-time release notification and whether the email provider accepted its delivery schedule. Affiliate records include personal codes, referral relationships, discount use, commission transactions, balances and payout requests. PayPal email addresses or crypto wallet addresses entered for a payout are encrypted in the database and are not included in payout-notification emails.
4. Purposes and legal bases
Data may be used to create and secure accounts, provide forum features, display submissions, process source applications, prevent abuse, operate affiliate attribution and payouts, respond to requests, send a one-time launch notification where you explicitly request it, enforce rules and comply with legal obligations. Depending on the activity, processing may rely on performance of a contract, legitimate interests in operating and protecting the service, consent or compliance with law.
5. Service providers and recipients
Vercel provides application hosting, Neon provides the PostgreSQL database, Resend delivers account, support and requested one-time launch emails, and Cloudflare Turnstile helps prevent automated form and account abuse. These providers may process the limited information required for their role. When paid memberships open, the selected payment provider will process checkout details and send LabCheck limited customer, subscription and payment-status references. Information may also be disclosed where required by law or reasonably necessary to protect rights and safety. For a bank transfer, the sending and receiving banks process the account-holder names, account identifiers, amount, payment reference and transaction date needed to execute and reconcile the transfer.
6. Cookies and local storage
LabCheck uses an essential, secure, HTTP-only session cookie for account access and security. LabCheck does not use marketing or advertising cookies. Non-essential analytics are not enabled without a separate legal basis and, where required, prior consent.
7. Member-visible content and third parties
Source ratings, experience reports and forum posts are shown with the member’s username and may become public if LabCheck’s access policy changes later. Do not include private information that should not be published. Links to external websites are governed by those parties’ own privacy practices.
8. International processing
Some service providers may process information outside your country. Where the GDPR applies, LabCheck relies on the safeguards and transfer mechanisms made available by its service providers.
9. Retention
Account and membership records are kept while an account is active. Sessions expire after seven days unless renewed. Email-verification links expire after one hour, password-reset links after 30 minutes, and pseudonymised rate-limit entries are deleted after approximately 24 hours. A member can permanently delete the account and associated forum posts, reviews, consent and membership records from the account page. Limited billing or security records may be retained separately where required by law or necessary for an active dispute. Support and application emails are normally removed within 12 months after the last related contact unless a longer period is required for an active dispute or legal obligation. Full affiliate payout destinations are removed from the active payout record when a request is paid or rejected; a masked hint and accounting record may be retained where needed for fraud prevention, financial reconciliation or legal obligations. Bank-transfer requests and their reconciliation records may be retained where necessary for accounting, payment disputes and statutory record-keeping duties.
10. Your rights
Members can download a machine-readable copy of their account, consent, membership, forum and review data or delete their account from the account page. Depending on applicable law, you may also request correction, restriction or portability of personal information, object to certain processing and withdraw consent. You may complain to the competent data-protection authority. Identity verification may be required before a request is completed.
11. Security
LabCheck uses encrypted transport, server-side access controls, origin checks, Argon2id password hashing, email verification, short-lived reset tokens, rate limiting and human verification. Account emails are kept out of public profile tables, and session records do not retain IP address or browser strings. Payment providers handle sensitive payment credentials; LabCheck stores only the limited references needed to track membership status. For bank transfers, LabCheck stores the requested amount, membership period, unique reference, status and reconciliation timestamps. Affiliate payout destinations are encrypted at rest and are available only in the administrator payout workflow while a request is open. No storage or transmission method is completely secure.
12. Age restriction
LabCheck is restricted to adults aged 21 or older. If an underage account is identified, appropriate steps will be taken to remove its information and close the account.
13. Changes and contact
This notice may change as the service develops. The updated version and date will be posted here. Contact LabCheck@proton.me for privacy questions or rights requests.