Lab Manager Pro
EN/DE

Privacy Policy (Datenschutzerklärung)

Last Updated: October 30, 2026

1. Introduction

This Privacy Policy (Datenschutzerklärung) explains how Lab Manager Pro ("we," "us," or "our") processes personal data when you visit our website, create an account, subscribe to the Service, or otherwise interact with us. It is prepared for users and customers in the European Union and the Federal Republic of Germany under the EU General Data Protection Regulation (GDPR / DSGVO), the German Federal Data Protection Act (BDSG), and the TTDSG / TDDDG where applicable.

Provider details are stated in our Impressum. Related documents: Terms (AGB), Cookie Policy, DPA / AVV, Subprocessors.

2. Controller (Verantwortlicher)

The controller is the operator of Lab Manager Pro as identified in the Impressum (Sadia Khan).

Privacy contact: contact@labmanagerpro.com

If we appoint a Data Protection Officer under Art. 37 GDPR / § 38 BDSG, contact details will be published here and in the Impressum.

3. Controllership Roles

  • Account, billing, and marketing data: We typically act as independent controller (Art. 4(7) GDPR).
  • Customer Content in a lab workspace: your organization is the controller; we process as processor under Art. 28 GDPR and our AVV / DPA.
  • Invited staff / portal users: Requests about workspace data should usually go to the laboratory that invited you.

4. Categories of Personal Data

4.1 Data you provide

  • Identity and account data (name, email, role, workspace membership)
  • Organization and branding settings
  • Billing data (payment instruments processed by Stripe; we do not store raw card numbers)
  • Support and sales correspondence
  • Customer Content you upload

4.2 Data collected automatically

  • Authentication and session data
  • Technical usage data needed for security and operation
  • Cookies and similar technologies — see Cookie Policy (TTDSG / TDDDG § 25)
  • Audit logs of significant workspace actions

4.3 Third-party sources

  • Stripe (subscription and payment status)
  • Invitation details supplied by a workspace administrator

5. Purposes and Legal Bases (Art. 6 GDPR)

  • Art. 6(1)(b) Contract: Providing the Service, authentication, support, and subscription management
  • Art. 6(1)(c) Legal obligation: Tax, accounting, and mandatory retention under German/EU law
  • Art. 6(1)(f) Legitimate interests: Securing the Service, preventing abuse, improving reliability, enforcing Terms/AUP
  • Art. 6(1)(a) Consent: Where required (e.g. non-essential cookies); withdrawable at any time

We do not sell personal data. We do not use Customer Content to train public AI models.

6. Recipients and Subprocessors

We share personal data only as needed with processors listed at Subprocessors, with professional advisors under confidentiality, with authorities where legally required, or in a corporate transaction under appropriate safeguards. Workspace data is not shared with other laboratories.

6.1 Data Hosting and Server Locations (EU / Frankfurt)

Primary application compute (Vercel serverless functions in region fra1, Frankfurt, Germany) and laboratory database, authentication, and file storage (Supabase in AWS eu-central-1, Frankfurt, Germany) are hosted exclusively within the European Union (Frankfurt am Main, Germany). Customer laboratory data remains stored in the EU.

7. International Transfers (Chapter V GDPR)

Some subprocessors process data in the United States or other third countries. Where the GDPR applies, transfers rely on SCCs, an adequacy decision, or other lawful mechanisms. Request further information via contact@labmanagerpro.com.

8. Retention (Speicherdauer)

  • Account and contract data: for the contractual relationship and thereafter as required under German commercial and tax law (often up to 6 or 10 years for certain records under HGB / AO)
  • Customer Content: while the workspace is active; deletion/return after termination as described in the AVV/DPA
  • Security logs: limited periods for security and abuse prevention

9. Security (Art. 32 GDPR)

We implement appropriate technical and organizational measures, including TLS in transit, multi-tenant isolation (including PostgreSQL RLS), role-based access, and audit logging. Absolute security cannot be guaranteed.

10. Your Rights (Art. 15–22 GDPR / BDSG)

Subject to statutory limits, you have the right to access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may lodge a complaint with a supervisory authority (Art. 77 GDPR), including the competent German Landesdatenschutzbehörde (for Baden-Württemberg: LfDI Baden-Württemberg) or BfDI where applicable.

For account/billing data we control, contact contact@labmanagerpro.com. For Customer Content, contact your laboratory administrator first.

11. Automated Decision-Making

We do not use personal data for solely automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR.

12. Children

The Service is for business use and not directed at persons under 16.

13. Changes

We may update this policy. The "Last Updated" date will change accordingly. Material changes may be notified by email to the account owner or in-product notice.

14. Contact

Privacy requests: contact@labmanagerpro.com