Privacy Policy
Last updated
Who we are
Notice Labs (“Notice Labs”, “we”, “us”) is based in London, United Kingdom.
Notice Labs runs noticelabs.co and the trust center product it hosts for our customers (software companies that use Notice Labs to publish security and compliance information to their own customers).
For any question about this policy, contact us at privacy@noticelabs.co.
The short version
- If you visit our website or fill in our contact form, we’re the controller of that data.
- If you’re a Notice Labs customer, we’re the controller of your account and billing data.
- If you visit Notice Labs’ own trust center (trust.noticelabs.co) and submit a request there, we’re the controller of that data too — it’s our trust center, not a customer’s.
- If you visit one of our customers’ trust center pages and submit a request there (a document request, a privacy request, a vulnerability report, or a “notify me” sign-up), we’re a processor acting on that customer’s instructions. For anything about how that data is used, contact the company running that trust center, not us.
What we collect, and why
Website visitors
We don’t run tracking or advertising cookies on noticelabs.co. We use Cloudflare Web Analytics, which is cookieless and does not identify individual visitors, to understand aggregate traffic to the site.
Contact form
If you submit our contact form, we collect your name, email address, optionally your company, and your message. Cloudflare Turnstile runs a bot check when you submit the form. We use this information to respond to you.
- What we collect: name, email address, company (optional), message content.
- Legal basis: legitimate interests (responding to enquiries sent to us) under UK GDPR and EU GDPR Article 6(1)(f).
- Storage: form submissions are sent by email via Resend to our inbox and are not stored in a database.
Customers (account and billing)
If you sign up for Notice Labs, we collect the information needed to create and run your account:
- Account details: your name, work email address and, if you add one, a profile picture. You sign in with a link we email you, so we hold no password.
- Sign-in session records: your IP address and browser user agent, kept for account security.
- Trust center content: the security controls, compliance status, documents, subprocessor lists, and other content you choose to publish.
- Billing details: your plan and subscription status. Payments are handled by Polar, our merchant of record, which holds your billing address and card details; we never see your card.
- Support communications: anything you send to hello@noticelabs.co, support@noticelabs.co, or security@noticelabs.co.
We use this information to provide the Notice Labs service, operate your account, process billing through Polar, respond to support requests, and comply with our legal obligations.
- Legal basis: performance of a contract (Article 6(1)(b)) for the core service and billing; legitimate interests (Article 6(1)(f)) for support and account security; legal obligation (Article 6(1)(c)) for tax and accounting records.
Notice Labs’ own trust center visitors (we act as a controller)
If you request a document, submit a privacy request, report a vulnerability, or sign up for update notifications on Notice Labs’ own trust center (trust.noticelabs.co), we’re the controller of that data, on the same legal bases as “Customers” above (legitimate interests in running the trust center, or performance of a contract where you’re acting for a customer of ours).
Trust center visitors on customer pages (we act as a processor)
Our customers use Notice Labs to run their own public trust center pages. Visitors to those pages can:
- request access to documents, and accept the company’s non-disclosure agreement where it asks for one (we record when you accepted it, the text you accepted, and your IP address and browser user agent, as evidence of the acceptance),
- submit a privacy or data subject request,
- submit a vulnerability disclosure report,
- sign up for “notify me” updates.
When you do any of this on a customer’s trust center, you’re submitting data to that customer — the company that owns the trust center. We process that data on their instructions, under a data processing agreement with them, purely to run the trust center feature (store the request, notify the customer, send the emails involved). We don’t use it for our own purposes.
If you have a question about how your data is used in this case, contact the company running the trust center you visited — not Notice Labs. We can direct you to them if you’re not sure who that is.
Every trust center: anonymous visit counts
On every trust center, including Notice Labs’ own, we count how many times the page is viewed and each document is downloaded, as a running total for each day. We use no cookies for this and store no IP address, browser details, or anything else about the visitor: a count goes up by one and nothing more is kept. We read your browser’s user agent only to skip crawlers and link previews, and don’t store it. This isn’t personal data, and the customer running the trust center sees only the daily totals.
Every trust center: logos
Every trust center — including Notice Labs’ own — loads subprocessor and customer logos from Logo.dev, which receives the visitor’s IP address and browser user agent to serve the right image. See “Subprocessors” below.
Subprocessors
We use a small number of subprocessors to run Notice Labs. This is the complete list — we don’t use any others:
| Subprocessor | Purpose |
|---|---|
| Cloudflare | Hosting, storage for uploaded documents and logos, bot protection (Turnstile), cookieless website analytics, custom domains |
| Supabase | Managed database for accounts, trust center content, and requests |
| Polar | Payments and subscription billing, as merchant of record |
| Resend | Transactional email |
| Google Workspace | Staff email and internal documents |
| Logo.dev | Loads subprocessor and customer logo images directly in your browser; receives your IP address and user agent (United States) |
If we add or change a subprocessor, we’ll give you advance notice by email and, if you’re a customer, at least 30 days to object before it takes effect, as set out in our Data Processing Agreement.
International transfers
Some of our subprocessors process data outside the UK and EEA, including in the United States. Where that happens, we rely on the UK’s international data transfer safeguards, including the UK’s adequacy regulations and the UK International Data Transfer Addendum (or equivalent EU Standard Contractual Clauses) with the relevant provider.
How long we keep data
| Data | Kept for |
|---|---|
| Contact form messages | Not stored by us — sent by email, kept only as long as we keep that correspondence |
| Customer account and trust-center content | While the subscription is active, then deleted 30 days after it ends (or sooner on request); backups roll off within a further 35 days |
| Visitor submissions on a trust center (requests, reports, notify-me subscribers) | Held on the customer’s behalf and deleted with the trust center, or earlier if the customer asks |
| Document access links | Expire 30 days after they’re issued |
| Anonymous daily view and download counts | Kept with the trust center and deleted with it |
| Billing and tax records | 6 years, to meet HMRC requirements |
| Support correspondence | 2 years after your last contact with us |
| Security and access logs | 90 days |
Cookies
The only cookie we set is a strictly necessary session cookie used to keep customer admins signed in to the Notice Labs dashboard. We don’t use tracking, advertising, or third-party marketing cookies. Cloudflare Web Analytics, used on our marketing site, is cookieless, and so are the visit counts on trust centers.
Security
We take reasonable technical and organisational measures to protect personal data, including relying on infrastructure providers (Cloudflare, Supabase) with strong security practices, encrypting data in transit, and restricting internal access to what’s needed to run the service. No system is completely secure, and we can’t guarantee absolute security.
Your rights
If you’re in the UK or EEA, you have rights under UK GDPR or EU GDPR, including the right to:
- ask what personal data we hold about you and get a copy of it,
- ask us to correct inaccurate data,
- ask us to delete your data,
- object to or restrict certain processing,
- ask for your data in a portable format,
- withdraw consent, where processing is based on consent.
To exercise any of these rights over data we hold as a controller (website, contact form, account/billing data, or Notice Labs’ own trust center), use the privacy request form on our trust center or email privacy@noticelabs.co. If your request relates to data submitted through a customer’s trust center, we’ll direct you to that customer, since they control that data.
If you’re in the UK, you also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk. If you’re in the EEA, you can complain to your local data protection authority.
Children
Notice Labs is a business-to-business product and our website is not directed at children. We don’t knowingly collect personal data from children.
Changes to this policy
We may update this policy as our product and practices change. We’ll give at least 30 days’ notice of material changes and update the “Last updated” date above when we do.
Contact
- Questions about this policy: privacy@noticelabs.co
- General enquiries: hello@noticelabs.co
- Support: support@noticelabs.co
- Security: security@noticelabs.co