Privacy Policy

This policy explains how your personal data is collected, used, shared and protected when you use LabMe OS, what your rights are and how to exercise them. By using the Service you agree to your data being processed in line with this policy.

Definitions

Service: the websites at labmeos.com and app.labmeos.io, LMOS (the lab operating system that runs in your browser), lessons, the simulator, incident drills and real labs.
Real lab: temporary virtual machines of your own, cut off from the internet, in which real security tools run.
Account: the record created so that you can use the Service, identified by your username.
Personal data: any information relating to an identified or identifiable person.
Service provider: a company that processes data on our behalf so that we can provide the Service (for example server and infrastructure providers).
"LabMe OS", "we", "us": the party operating the Service. "You": the person using the Service, or the organisation on whose behalf it is used.

1. Data controller

For any question or request about data protection: info@labmeos.com. Technical support: support@labmeos.com.

2. Data we collect

Account: the codename (username) you choose; your language, theme and sound preferences; when the account was created and last used.
Google sign-in (the only way to sign in): your Google account's permanent ID, your email address and whether Google has verified it. We never see your Google password and we do not ask for your name, photo, contacts, files or any other Google data.
Learning data: completed lessons, points (XP), time spent and number of commands typed in a lesson, quiz results and your decisions in incident drills. The commands you type into the simulator are not sent to our servers; only whether a step was completed is recorded.
Session and security records: the IP address and browser of the device you sign in on; security records with time and IP address for sign-ins and account actions (such as export, deletion or resetting progress).
Server logs: for every request to our sites, the IP address, the address requested, the time and browser information. We use them to detect attacks and faults; addresses that run automated scans are blocked for 24 hours.
Real lab (if you use it): when your lab was opened and closed, internet requests made through the lab proxy (address, time, size) and rule-violation records. We do not record the commands you type or the terminal output. Lab machines are deleted with everything in them when the session ends.
Correspondence: if you email us, your email address and the content of the conversation.
Payments (once paid plans are available): your card details go directly to the payment provider and never reach us. We keep only the plan, amount, date and the details needed for invoicing.

3. Cookies and browser storage

We use a single cookie: the essential "lhm_sid" cookie that keeps you signed in (at most 365 days; it cannot be read by JavaScript in the page). If you block it you cannot sign in, but you can keep learning as a guest.

Preferences such as language, theme, sound, desktop layout, keyboard shortcuts and your progress as a guest are kept in your browser's local storage (localStorage) and are not sent to our servers; you can clear them in your browser settings.

We use no advertising, analytics, tracking pixels or third-party tracking cookies, which is why we show no cookie consent banner.

4. Why we use your data, and on what legal basis

To create your account, sign you in and keep your progress across devices: entering into and performing our contract with you.
To run the real labs safely, detect and stop abuse and attacks, and prevent account takeover: our legitimate interests and legal obligations.
To answer support requests and tell you about important changes and security notices: performance of the contract and legitimate interests.
To improve the Service: only with aggregated statistics that do not identify you (for example how many people completed a lesson).
Marketing emails: only with your explicit consent; every email has a one-click unsubscribe.
To meet our legal obligations and protect our rights.

We do not sell your data, use it for advertising, or make automated decisions about you based on profiling that have legal or similarly significant effects. The automatic rule-violation detection in real labs only closes the lab and temporarily suspends lab access; to contest it, write to support@labmeos.com.

5. Who we share it with

DigitalOcean: our servers, database and real-lab server (Frankfurt, Germany).
Cloudflare: domain names, content delivery, email forwarding and attack protection. All connections to our sites pass through Cloudflare.
Google: only if you use "Continue with Google", to verify your sign-in.
A payment provider: once paid plans are available, only to process your payment.
Authorities, when the law requires it or in response to valid requests from courts or public bodies.
When we believe in good faith that it is necessary to comply with a legal obligation, investigate or stop abuse of the Service, protect the safety of our users or the public, or defend our rights.
In a merger, acquisition or sale of assets: your data remains protected by this policy, and we will tell you before it becomes subject to a different one.
With your consent, for other purposes you agree to.

Leaderboard: your codename, XP and number of finished lessons are shown to other learners on the dashboard leaderboard. Your email address and Google details are never shown. You can hide yourself in Profile → "Hide me from the leaderboard".

6. International transfers

Some of our service providers are located outside your country, so your data may be processed in countries whose data protection rules differ from yours. We transfer data only for the purposes above and under the providers' data protection commitments (such as the European Commission's standard contractual clauses) and the safeguards required by applicable law.

7. How long we keep it

Account and learning data: until you delete your account. Deleting it removes this data immediately and permanently, and your username becomes available again.
Sessions: until you sign out, at most 365 days.
Security records: 365 days.
Server logs: 14 days.
Real-lab proxy and violation records: 90 days.
Correspondence: at most 2 years after your request is resolved.
Payment and invoice records: for as long as tax and commercial law requires.

Where needed to resolve a dispute, meet a legal obligation or investigate abuse, we may keep the relevant records beyond these periods until the matter is closed.

8. Your rights

Depending on where you live, you have the following rights:

European Economic Area and United Kingdom (GDPR and UK GDPR): access your data and get a copy, rectification, erasure, restriction of processing, objection to processing (including for marketing), data portability, and withdrawing your consent at any time.
Turkey (Personal Data Protection Law No. 6698, Art. 11): learn whether your data is processed and request information about it, learn the purpose and whether it is used accordingly, know the third parties it is transferred to, have it corrected or erased and those parties notified, object to a result against you arising solely from automated analysis, and claim compensation for damage caused by unlawful processing.
Certain U.S. states (California CCPA/CPRA, Virginia, Colorado, Connecticut, Utah and similar laws): know what data we collect and how we use it, access, correct and delete it, and not be discriminated against for exercising these rights. We do not sell personal data or share it for targeted advertising.

How to exercise them:

A copy of all your data: LMOS → Profile → "Download my data".
Delete your account and all its data: LMOS → Profile → "Delete account" (permanent, immediate).
Anything else: info@labmeos.com. We may ask for information to verify your identity. We reply within 30 days.

If you are not satisfied with our answer, you can complain to the data protection authority of your country.

9. Security

All connections are encrypted (HTTPS). Session tokens are stored only as hashes; we store no passwords, sign-in happens through Google. Our servers are protected by firewalls and attack detection. Real labs run on a server separate from the website and the database, cut off from the internet and isolated from each other. No method of transmission over the internet or of electronic storage is completely secure; we take reasonable measures but cannot guarantee absolute security. If you find a vulnerability, please report it to support@labmeos.com.

10. Children

Children under 13 may not create an account. Users under 18 should use the Service with the permission of a parent or guardian. If we learn that we have collected data from a child under 13 we delete it; if you know of such a case, write to info@labmeos.com.

11. Google user data

We use the information we receive from Google sign-in (account ID and email) only to recognise you and sign you in. We do not sell it, use it for advertising, transfer it to others, or allow our staff to read it (except for security, legal obligations or with your explicit permission). LabMe OS's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove LabMe OS's access to your Google account at any time in your Google account's security settings; to delete your account and all its data, use LMOS → Profile → "Delete account".

12. Links to other websites

Lessons and the Service may link to other websites (for example the official documentation of tools). We are not responsible for their content or privacy practices; we recommend reading the privacy policy of every site you visit.

13. Changes

We may update this policy to reflect changes in our practices or in the law. When we do, we change the date on this page and announce important changes before they take effect in the app and, if you have given us your email address, by email.

14. Contact

Questions about this policy: info@labmeos.com.