Privacy Policy

1. Who we are

[TODO: legal entity name] ("Lobby Labs," "we," "us," or "our") operates lobbylabs.net. We are responsible for the personal data described in this policy. You can reach us at privacy@lobbylabs.net or by mail at [TODO: legal entity name], [TODO: postal address or PO box], Dallas, TX [TODO: ZIP].

2. What this policy covers

This policy covers only the website at lobbylabs.net (the "site"), our early-access list, and the emails we send to people on it. The Lobby product, its SDKs, any hosted service, and our open-source code will have their own privacy terms. The site is intended for people in the United States.

3. What we collect and why

When you confirm your signup, our email provider may also record the IP address and time of the confirmation as further proof of consent.

4. What we do not do

• We do not use analytics tools, advertising pixels, or tracking scripts on the site.
• We do not set cookies (see section 6).
• Our emails do not contain tracking pixels or tracked links.
• We do not sell personal data, and we do not share it for targeted (cross-context behavioral) advertising.

5. Who we share it with

We share personal data only with:

• Our email service provider, which stores the early-access list and sends our emails on our behalf.
• Cloudflare, which hosts the site and processes request data to deliver and secure it.
• Professional advisers, such as lawyers and accountants, under duties of confidentiality.
• Authorities, when the law requires it, or when needed to protect the rights, property, or safety of you, us, or others.
• A buyer or investor, and their advisers, in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business or assets, including during due diligence. Any buyer must handle your data consistently with this policy.

Our service providers may use personal data only to provide their services to us, except where their own terms allow them to use it to secure and improve their services. We will also share data if you ask us to.

6. Cookies and Global Privacy Control

We do not set any cookies. Cloudflare may set strictly necessary security cookies, for example to tell people from bots or to remember that your browser passed a security check. These cookies are required to protect the site and are not used for advertising or to track you across other sites. See Cloudflare's cookie documentation for details.

We honor Global Privacy Control (GPC) signals as a valid request to opt out of the sale of personal data and of sharing for targeted advertising. We do neither today, and if that ever changes, we will continue to honor GPC.

7. Emails and consent

• Double opt-in. After you sign up, we send a confirmation email. You are added to the list only after you click the link in it.
• One-click unsubscribe. Every email we send includes a link to unsubscribe in one click, and our postal address. We process unsubscribes promptly, and always within 10 business days.
• Suppression list. When you unsubscribe, we keep your email address on a suppression list so we do not email you again by mistake. If you ask us to delete it from that list too, we will, but we will then be unable to block future emails if the address is signed up again.

8. How long we keep it

• Signup data: until you unsubscribe or ask us to delete it, except for the suppression record described above.
• Request data: Cloudflare keeps it for limited periods under its own policies. We look at it only to operate and secure the site, and copy it only to investigate a specific security incident.
• Emails you send us: as long as needed to respond and keep reasonable business records, unless you ask us to delete them sooner.
• Backups: deleted data may remain in backups until they age out, within 90 days.

We keep data longer only when we must preserve it for a legal hold or a legal obligation.

9. Security

We use reasonable administrative, technical, and physical safeguards to protect personal data, including encrypted connections (HTTPS) and limited access to the early-access list. No system is perfectly secure, and we cannot guarantee the security of any data. If you find a security problem, please report it under our Security Research Policy.

10. Your choices and rights

• Unsubscribe at any time with the link in any email.
• Ask for a copy, a correction, or deletion of your personal data by emailing privacy@lobbylabs.net. To protect you, we may ask you to confirm the request from the email address it concerns. You may use an authorized agent; we may ask for proof of the agent's authority.

We respond within 45 days. If we need more time, we will tell you why within that period and may take up to 45 more days where the law allows. Requests are free. We will not treat you differently for exercising your rights.

Appeals. If we decline your request, in whole or in part, we will explain why. You can appeal by replying to our decision or emailing privacy@lobbylabs.net. We will answer your appeal in writing within 60 days. Texas residents who are unhappy with the result of an appeal may contact the Texas Attorney General.

11. California and other US states

Depending on where you live, state privacy laws may give you rights such as the right to know what personal data a business has about you, to get a copy of it, to correct or delete it, and to opt out of its sale, its use for targeted advertising, or certain profiling. Many of these laws apply only to businesses above certain size or data-volume thresholds, and some may not apply to us. We offer the rights in section 10 to everyone, wherever they live. This policy describes the categories of personal data we collect, their sources, why we use them, and who receives them, and we do not sell or share personal data for targeted advertising or use it for profiling.

12. Visitors from the EU and UK

The site is intended for people in the United States, and we do not target people in the European Union or the United Kingdom. If EU or UK data protection law applies to our handling of your data:

• Controller. [TODO: legal entity name] is the controller, reachable at privacy@lobbylabs.net.
• Legal bases. We send early-access emails based on your consent, which you can withdraw at any time by unsubscribing. We process request data and keep records of your consent based on our legitimate interests in delivering and securing the site and being able to prove consent. We answer your emails based on our legitimate interest in responding. We also process data where needed to comply with a legal obligation.
• Your rights. You may request access, correction, deletion, restriction, or portability of your data, object to processing based on legitimate interests, and withdraw consent. You also have the right to complain to the data protection supervisory authority where you live or work, or where an alleged infringement occurred (in the UK, the Information Commissioner's Office).
• Transfers. Your data is processed in the United States and other countries where our providers operate. Where required, we rely on appropriate safeguards for those transfers, such as the European Commission's standard contractual clauses, the UK International Data Transfer Addendum, or a provider's certification under the EU-US Data Privacy Framework and its UK Extension. You can ask us for more information about these safeguards.

13. Children

The site and the early-access list are not for anyone under 18. We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child under 13, we will delete it. If you believe a child has given us personal data, contact us at privacy@lobbylabs.net.

14. Changes to this policy

When we change this policy, we will post the new version on this page with a new version number and effective date. If a change is material, we will email it to everyone on the early-access list before it takes effect. Earlier versions are kept in the legal archive.

15. Contact

[TODO: legal entity name]
[TODO: postal address or PO box], Dallas, TX [TODO: ZIP]
privacy@lobbylabs.net