Last updated: August 13, 2026
LabCraft is an interactive learning platform for systems technologies. This policy explains what personal data we collect when you use the platform, why we collect it, how long we keep it, who we share it with, and the rights you have over it.
LabCraft, Inc., a Delaware corporation, operates LabCraft and is the data controller responsible for your personal data. If you have any question about this policy or want to exercise your rights, contact legal@labcraft.dev.
Primary account and learning data, including encrypted backups, are stored in the European Economic Area. Some information is processed elsewhere by the provider categories described under Who we share it with.
We collect the following categories of personal information:
What you provide, or your sign-in provider shares, when you create and manage an account, such as your name, email address, profile image, account settings, and signup or referral information. An inactive account may represent a place on the waitlist.
You sign in through a provider you choose or by using an email link. A sign-in provider may share basic profile information, such as your name, email address, and profile image. We do not receive your password.
Your course progress, assessment results, lab checkpoints, and activity in lab environments. During an active lab, this may include commands and limited command output needed to validate objectives, provide mentor guidance, improve the course, and protect the service. Relevant mentor observations and guidance may be stored with your account.
Information collected automatically as you use the site — such as cookies and session identifiers, limited information stored in your browser (including a coarse record of how you first reached the site), pseudonymous product analytics, and standard server logs (which may include IP addresses). See Cookies below.
Information you include when you contact us, request support, or provide feedback.
Where the EU or UK GDPR applies, we rely on these legal bases:
Email, basic account and authentication information, and learning activity are required to provide an account and its learning features. Without them, we cannot provide the service. Optional information may be omitted.
We use first-party cookies for authentication, session security, and preferences. We do not use third-party advertising or cross-site tracking cookies, and we do not allow other parties to track your activity across unrelated services for advertising.
Product analytics may use an internal learner identifier and limited account or usage properties, but not your name or email address. The tracker does not require analytics cookies.
We also store a small amount of information in your browser's local storage rather than in a cookie: a coarse record of how you first reached LabCraft — the referring channel and, where a link is tagged, the campaign name — so that if you create an account we can understand which channels bring learners to us. We keep only a sanitized, coarse value, never the full referring web address, and it remains in your browser until you clear your browser's storage.
We do not sell your personal data and do not share it for advertising. We disclose information only as needed to these categories of providers and recipients:
A provider you choose may also process information under its own privacy policy. Providers are subject to contractual data-protection terms where required. Some authentication, communications, and AI providers may process information in the United States. Where EU or UK transfer rules apply, we use an applicable adequacy mechanism, approved standard contractual clauses, or another legally recognized safeguard. Contact us for information about the safeguard used for a particular transfer.
We keep active account information and associated learning records while your account is active or as otherwise needed to provide the service.
When you delete your account or we approve a deletion request, we remove account-linked records from active systems unless limited retention is needed to comply with law, resolve a dispute, or protect the service. Deleted data may remain in encrypted backups for up to 35 days before expiring.
Authentication records, logs, analytics, and communications are kept only while reasonably needed for their stated purposes. We delete or aggregate them when they are no longer needed.
We may retain and use aggregate or de-identified statistics, analyses, and other derivatives that cannot reasonably be linked to you. We maintain and use de-identified information only in de-identified form and do not attempt to re-identify it, except to test whether our de-identification measures work. We require any recipient of de-identified information to follow the same restrictions.
If you are in the EU/EEA or UK, you have the right to access your data, correct it, delete it, restrict or object to its processing, receive a portable copy, and withdraw consent where processing is based on consent. In particular, you may object to processing based on our legitimate interests, including product analytics. You may also lodge a complaint with your local data protection authority.
If you are a California resident, you have the right to know what personal information we collect and why, to request its deletion or correction, and to not be discriminated against for exercising these rights. We do not sell or “share” your personal information as those terms are defined under California law, and we do not use it for cross-context behavioral advertising.
To exercise any of these rights, email legal@labcraft.dev. We will respond without undue delay and ordinarily within one month where the GDPR or UK GDPR applies. We may need to verify your identity before acting on a request. Some rights depend on the circumstances and are not absolute.
LabCraft does not make decisions based solely on automated processing that produce legal or similarly significant effects about you. The AI mentor provides optional learning guidance and does not decide whether you may use the service or whether you pass an assessment.
We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including access controls and encryption where appropriate. No system is completely secure.
LabCraft is not directed at children. You must be at least 18 years old to create an account. If you believe a child has given us personal data, contact us and we will delete it.
We may update this policy as the platform evolves. When we do, we'll change the “Last updated” date above, and for material changes we'll provide a more prominent notice.
Questions, requests, or complaints: legal@labcraft.dev.