Privacy policy

1. Controller of account data

88Lab-2024 EOOD, UIC 207811865 processes registration, subscription, support and security data. Contact: support@88lab.eu, 0888530444, Bulgaria, Sofia 1324, Lyulin District, Lyulin residential area, 13 Ivan Boychev St., entrance 1, floor 5, apartment 15.

2. Customer-account data

We process name, email address, phone number, domain, registration IP address, login information, subscription status, billing identifiers and the history of administrative actions. The purposes are entering into and performing the contract, security, support, accounting obligations and the establishment, exercise or defence of legal claims.

3. Data from visitors to customer websites

The tracking code may send an IP address, hostname, approximate geolocation/provider, browser and operating system, visited-page URL and referrer, visit counts, total and active time, interaction counts and maximum scroll depth. We do not record the text of clicked elements, form contents or keystrokes.

Within this functionality, the customer determines the website and purpose of the analysis and is generally the controller of visitor data, while the Provider processes the data to deliver the service under the customer’s contractual instructions. The precise roles should be set out in a contract or data-processing agreement.

4. Session storage and language cookie

The tracker uses sessionStorage for a temporary random session identifier and aggregated counters. The data is limited to the current browser session and is not intended for advertising profiling across different websites.

The platform uses the strictly necessary fraud_language cookie to remember whether the interface is displayed in Bulgarian or English. It stores only the value bg or en, is available across the platform, is protected with HttpOnly and SameSite=Lax, and expires after one year. Changing the language replaces the previous value.

5. AI and external providers

Only selected candidates and technical or aggregated metrics required for analysis are sent to the AI provider, not the entire database. Data required for Checkout, subscriptions and the customer portal is sent to Stripe. Hosting and infrastructure providers may process data when technically delivering the service.

Before production use, the Provider should maintain an up-to-date list of processors, processing locations and applicable safeguards for international transfers.

6. Retention periods

Data is retained for the duration of the active contract and for reasonable periods afterwards according to retention settings, backups, accounting requirements, security needs and the defence of legal claims. AI snapshots and behavioural session records are cleaned according to the configured retention period.

7. Security

The service uses website-level access control, encrypted storage of API secrets, HTTPS, signed Stripe webhook events, CSRF protection, request limiting and logs of administrative actions. No system can guarantee absolute security.

8. Rights

Data subjects may request access, rectification, erasure, restriction, objection or portability where the relevant right applies. For data collected by a customer website, the request should generally first be addressed to the owner of that website. Data subjects also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection.

9. Cookies and Google Consent Mode v2

The landing page uses strictly necessary technologies for security, sessions, registration, language preference and storing the visitor’s privacy choice. Analytics and advertising technologies are enabled only according to the visitor’s selection.

The consent panel sends separate Google Consent Mode v2 signals for analytics_storage, ad_storage, ad_user_data and ad_personalization. These categories are denied by default for visitors without a saved choice. Necessary security_storage remains allowed for protection, authentication and abuse prevention.

The choice can be changed at any time through the “Cookie settings” link in the footer. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

10. Changes

This policy may be updated when the service or applicable law changes. The current version is published on this page.