Privacy policy

Who we are

Blank Labs (Pty) Ltd provides the Blank Labs website and software. If you have a privacy question, write to info@blanklabs.co.za.

For personal information that Blank Labs determines the purpose and means of processing for, Blank Labs acts as the responsible party under applicable South African data protection law.

What this policy covers

We process information to operate the public website, create and authenticate accounts, run company workspaces, deliver products, bill subscriptions and respond to support. We do not sell personal information.

Authentication and account data

To create and sign in to an account we use authentication services on Google Firebase. That typically includes your name, email address and a securely stored password or equivalent sign-in credential. We use this to identify you, protect the workspace and contact you about the account.

Company and user data

A workspace is tied to a company. We store company details you provide — such as company name, registration or VAT numbers, telephone, address and country — together with the users invited into that workspace, their roles and whether they are active. Each company is limited to 10 users.

Administrators can see and manage members of their own company. We use this information to apply permissions, seat limits and product access.

Files

Products such as The Records Room and attachments let a company store files in its workspace. Those files are held on our hosting infrastructure so authorised users in that company can open them. We do not use customer files or private workspace content to train public models or to market to other organisations.

Atlas and AI processing

Some Blank Labs products, including Atlas, may use artificial-intelligence models to process prompts, instructions, files or other content submitted by authorised users. Where an AI feature requires a third-party model provider, only the information reasonably required to perform that request is sent to the configured provider.

Blank Labs does not use customer files or private workspace content to train public models. Third-party AI providers may process data under their own contractual and technical safeguards. The providers used by Blank Labs may change as the platform develops, and we will update this policy where a material change affects how personal information is processed.

Usage data

We record operational usage needed to run the subscription — for example Atlas instruction use, storage used, product entitlements, login activity and technical logs. This helps us provide the service, apply plan limits and diagnose faults.

Support data

If you email us or otherwise ask for help, we keep the correspondence, the workspace email and enough account context to find the company and respond. Support mail is handled at info@blanklabs.co.za.

Firebase and Google Cloud

Blank Labs runs on Google Firebase and Google Cloud. That infrastructure hosts the website, authentication, application backends, files and related logs. Google processes this data as our hosting and identity provider so the service can run. We may use limited operational analytics, telemetry and technical logs where reasonably necessary to operate, secure, diagnose and improve the service. We do not sell personal information or customer lists.

Paddle and payments

Subscriptions are billed monthly through Paddle. Prices are exclusive of applicable tax where stated. Paddle collects and processes payment details. Blank Labs does not store card numbers, expiry dates or CVV.

Paddle may receive the email, company name and subscription details needed to take payment, issue invoices and handle tax. Payment records that Paddle returns to us — such as subscription status — are used to turn product access on or off.

Why we use this information

We use the information above to provide the service, authenticate users, apply the 10-user company limit, bill and cancel subscriptions, store authorised files, keep the platform secure and answer support requests. We process personal information where it is necessary to provide the services requested, perform our contractual obligations, comply with legal obligations, protect the security and integrity of the platform, and pursue legitimate operational purposes permitted by applicable law.

Sharing

We share information with processors who help us run Blank Labs — currently Google (Firebase and Google Cloud) and Paddle. We may also disclose information if required by law. We do not sell customer lists.

International processing

Some of the technology providers used by Blank Labs may process or store information in countries outside South Africa. Where personal information is transferred internationally, we take reasonable steps to use service providers and arrangements that provide appropriate safeguards in accordance with applicable law.

Retention

Account, company, file and billing-status records are kept while the workspace is active. After cancellation, access continues only until the end of the already-paid period. We may retain limited records afterwards where needed for security, accounting or legal obligations, then delete or anonymise them when they are no longer required.

Your privacy rights

Workspace administrators can update company and user records in the account area. Under applicable South African data protection law, a person may request:

• access to personal information Blank Labs holds about them;
• correction or updating of inaccurate information;
• deletion where Blank Labs is legally permitted to delete it;
• objection to certain processing where applicable;
• restriction or cessation of processing where applicable law provides that right;
• information about how their personal information is being used.

How to make a request

Some information may need to be retained for billing, security, legal, accounting or regulatory reasons. Requests can be sent to info@blanklabs.co.za.

Information Regulator

You may lodge a complaint with the Information Regulator of South Africa if you believe personal information has been handled unlawfully. Complaints may be submitted to the Information Regulator of South Africa through its official website at https://inforegulator.org.za/.

Security

Access is authenticated. Company environments are logically separated. We use reasonable technical and organisational safeguards designed to protect personal information and customer data. No method of transmission or storage is completely secure, and you should protect your own login.

Contact

Privacy requests can be sent to info@blanklabs.co.za.