Privacy Policy
Effective date: 28 September 2026 · Last updated: 28 September 2026
LabKitPro ("the Service", "we", "us") is a software-as-a-service tool that helps laboratories generate ISO/IEC 17025:2017 best-practice management-system documents. This policy explains what data we collect, why, where it is stored, and the rights you have under the GDPR and other applicable laws.
1. Who is the data controller
The data controller for personal data processed through LabKitPro is the operator of the Service, reachable at support@labkitpro.com. For a data processing agreement (DPA) or to confirm the registered entity details, contact us at that address.
2. What we collect
- Account & lead data you submit — e.g. your email address and the laboratory profile fields (lab name, type, field, country/region, accreditation body, key parameter) you enter. This is used to deliver the Service and to follow up on licensing enquiries.
- Local application data — the documents you generate, internal-audit judgments, uncertainty calculations, and diagnosis inputs. These are stored only in your own browser's local storage on this device and are not transmitted to our servers unless you explicitly export or submit them.
- Optional analytics — if you accept non-essential cookies, we collect aggregated, non-identifiable usage statistics to improve the Service. This is disabled until you consent and can be rejected without loss of functionality.
3. Why we process it (legal basis)
- Performance of a contract — to provide the document-generation Service you request.
- Legitimate interest — to respond to licensing enquiries and maintain the Service.
- Consent — for optional analytics cookies (you may withdraw at any time).
4. Data residency & storage (GDPR)
eu-central-1) — to meet GDPR data-residency requirements. We do not transfer this data to servers outside the EU/EEA for primary storage.Local application data (your generated documents and tool inputs) never leaves your device unless you choose to export it. Where we use sub-processors (see §6), transfers are covered by the sub-processor's GDPR commitments (EU-US Data Privacy Framework / Standard Contractual Clauses where applicable).
5. How long we keep it
- Local application data: retained on your device until you clear browser storage or request deletion.
- Account & lead data: retained for the life of your relationship with us, then deleted or anonymised within 24 months of last contact, unless a longer period is required by law.
6. Sub-processors & third parties
- Supabase — database & authentication hosting (EU region).
- Dodo Payments — payment processing, used only when you subscribe to a paid plan. Dodo acts as Merchant of Record and handles tax collection/remittance.
- Email / transactional provider — used to send licence and support communications.
We do not sell your personal data. We share data only with the sub-processors above and only as needed to operate the Service.
7. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interest. You may also withdraw consent for analytics at any time. To exercise any right, email support@labkitpro.com. We respond within one month. You also have the right to lodge a complaint with your local supervisory authority.
8. Cookies
See our Cookie Policy. Essential cookies are required for the Service to function; non-essential analytics cookies load only after you accept.
9. Contact
Questions about this policy or your data: support@labkitpro.com.