Lab08 Making diligence delightful
Log in Start a screening

Lab08 Privacy Policy

Last updated: 21 October 2026

This Privacy Policy describes how Lab08 ApS (“Lab08,” “we,” “us,” or “our”) handles personal information in connection with Lab08, our platform for investment conviction & due diligence (the “Platform”), and on this website.

I. Who We Are

This policy applies to Lab08 ApS and to all of its 100% owned subsidiaries. Lab08 ApS is the company our customers contract with. Lab08 Ltd., in Sofia, Bulgaria, develops, operates and supports the Platform on our behalf.

For our customers’ content, we are a processor. Our customers use the Platform to keep their own records and to run their own due diligence. They decide what goes into their workspace, what analysis is run, what it is used for, and how long it is kept. For all of that content the customer is the controller and Lab08 acts solely as their processor, on their instructions and under our Data Processing Agreement with them. We do not use it for our own purposes.

For running our own business, we are the controller. That covers your account details, sign-in records and the technical logs described in section II; billing records; what you send us through this website, such as a sign-up, a newsletter subscription or a request for event invites; and our own marketing. Nobody else determines how that information is used.

So if you want information held in a customer’s workspace corrected or deleted, the decision is the customer’s, not ours. Write to us and we will pass your request on and support them in acting on it. Section IX explains this.

II. Information We Handle

Information we control. Your name, email address, sign-in records, your role and organisation; error reports, performance data, and a sample of interface sessions recorded by our monitoring provider so that we can diagnose faults; and which pages and features of the Platform you use, linked to your account, so that we can see how it is used and improve it.

Billing. If you buy a plan, you pay through Stripe, which collects your card details directly; we never see your full card number. We receive the billing details given at checkout, such as company name, billing address and VAT number, and a record of what was bought and paid.

This website. When you sign up here, we receive your name, work email, company and its website, your LinkedIn profile if you give it, your role, and why you are looking at a company, and we use them to open your workspace and run your free screening. When you subscribe to our newsletter, The Brief, or ask for event invites, we receive the details you give and the choices you tick. Website analytics run only if you accept cookies, as section X explains.

Connected Google accounts. If you connect your own Google account, the Platform reads recent email and calendar activity to file what matches the companies your workspace tracks, and to suggest companies that have emailed you. What it files becomes workspace content, handled for the customer as below. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements: we use it only to provide those features, we do not sell it, and we do not use it for advertising or to train models. You can disconnect at any time in the Platform’s settings; that deletes the access, and what was already filed stays in the workspace until the customer removes it.

WhatsApp. If a workspace turns on WhatsApp notifications, people on its team can opt in to receive them and to ask questions by WhatsApp. We store their phone number and consent, and the questions and answers become workspace content. Messages are sent through Meta’s WhatsApp Business Platform from one Lab08 number used for all workspaces. Replying STOP withdraws consent.

Document previews. Word, Excel and PowerPoint files uploaded to the Platform are shown with Microsoft’s Office for the web viewer, which fetches the whole file through a link that expires after an hour.

Information we process for our customers. Everything a customer puts into or generates inside their workspace: the documents, notes, comments, and messages they create or upload; the deals their team is assigned to and the analyses they run; their chat sessions with the assistant. These records may contain personal information about people who do not use the Platform. The customer decides what goes in; we hold it for them.

Research the Platform carries out on a customer’s instructions. When a customer asks us to evaluate a company, the Platform gathers information about that company and the people who work for it, lead it or own it, and produces written analysis, including of the team, for that customer. It reads public sources: company websites, public company registers, LinkedIn company pages and the public profiles of up to 150 people per company (name, photo, headline, location, roles, education, skills, languages, certifications and recommendations), Trustpilot reviews, Reddit, Hacker News, GitHub, the Internet Archive and the press. It searches the web through DuckDuckGo, and tests the company’s website with public security and performance tools. Everything it finds is kept in that customer’s workspace, as their content. The customer decides that this research happens and what is done with the result. Section IX explains how to object.

We do not deliberately collect special categories of personal information, such as health, biometric, ethnic origin, political opinion, religious belief, trade union membership, or sexual orientation data. If you tell us that such information has appeared, we will act to remove it.

III. The Slack App

Lab08 for Slack (the “Slack app”) lets a customer receive notifications from their Lab08 workspace in Slack channels they choose, and lets members of their team ask Lab08 questions from Slack. It is optional. This section describes what the Slack app handles in addition to everything above; the rest of this policy applies to it in full.

What we receive from Slack. When a customer’s administrator installs the Slack app, Slack gives us the workspace’s identifier and name, a bot user identifier, and a bot access token. We store the token encrypted, bound to that customer’s record. When the administrator chooses channels for Lab08 to post in, we store those channels’ identifiers and names. When a team member links their Slack account, we store their Slack user identifier alongside their Lab08 account. When someone asks Lab08 a question, we receive the text of that message, the channel and thread it was posted in, and the Slack identifier of the person who asked.

What we do not receive. The Slack app does not request permission to read channel history, direct messages, files, or your workspace’s member directory or anyone’s email address. It receives a message only when that message mentions Lab08 or is a /lab08 command, and it acts only in channels the administrator has bound. It holds no permissions tied to the person who installed it.

How we use it. To post the notifications the administrator configured, to answer questions, and to act on buttons pressed in Slack. To answer a question, the question is sent together with the relevant company’s workspace content to the artificial intelligence models described in section VI, which generate the answer. The question and the answer are saved as a conversation in the customer’s Lab08 workspace, exactly as a chat typed in the Platform would be. We do not use Slack content to train models, and we do not use it for anything else.

Who controls it. The customer, as in section I. The administrator decides which channels Lab08 posts in and what about. Everyone in a bound channel can read what Lab08 posts; only people who have linked a Lab08 account can ask questions or take actions, and Lab08 will not show anyone something they could not already see in Slack or in Lab08. Messages Lab08 posts into Slack are then held by Slack under the customer’s own agreement with Slack.

How long we keep it. Questions and answers are part of the customer’s workspace content and are kept for as long as the customer instructs. Transient copies used to process a question are deleted within 24 hours. When the Slack app is uninstalled or its access is revoked, we stop using the token immediately, revoke it with Slack where we can, and disable every channel binding and account link. We erase the remaining Slack records, including the token, within fourteen business days.

Your rights. As set out in section IX. A team member can unlink their own Slack account at any time with /lab08 unlink. Questions about the Slack app can also go to support@lab08.com.

IV. How We Use It

We use the information we control to create and manage your account, let you sign in, send service emails such as invitations and sign-in links, respond to your support requests, take payment for your plan, keep the Platform secure and diagnose faults, and meet our legal and accounting obligations. We use what you send us through this website to open your workspace and to follow up on your sign-up or enquiry, and we send The Brief and event invites only to people who asked for them.

Everything else we process only on our customers’ instructions and only for the purposes they set. We do not use their workspace content for our own purposes, we do not use it for advertising, and we do not sell personal information.

The analyses the Platform produces are there to help investors think, not to decide anything on their behalf. We do not make decisions about you by automated means alone that produce legal or similarly significant effects.

V. Legal Basis

For the workspace content we process on our customers’ behalf, the customer is the controller and determines the legal basis. We act on their instructions.

For the information we control, we rely on:

VI. Who We Share It With

Sub-processors for the Platform. We use these service providers to run the Platform. Where they handle personal information on our behalf they act as our sub-processors, engaged with our customers’ authorisation. They are:

To carry out screenings, the Platform also sends the name and website of the company under review, and search terms, to public services such as DuckDuckGo, Google PageSpeed, Mozilla Observatory and the Internet Archive. They receive what any visitor would send them and are not our sub-processors.

Services we use for our own business. These handle the information we control, not our customers’ workspace content:

Where your organisation enables single sign-on, your identity provider also processes your sign-in, under your organisation’s own agreement with it. Connected services you choose to use, such as your own Slack or Google account, or an AI client you connect to the Platform, process information under your own agreement with them, as sections II and III describe. We tell our customers by email at least 30 days before we add or replace a sub-processor, as the Data Processing Agreement sets out, and update this list.

We may also share information where the law requires it, and with our professional advisers under a duty of confidentiality. If Lab08 is ever acquired or merged, information may transfer to the acquirer, who would remain bound by this policy until it lawfully tells you otherwise.

We do not use advertising networks, and we do not sell or rent personal information.

VII. Where We Store It

The Platform is hosted on Amazon Web Services in the Frankfurt region, Germany, with backup copies of the knowledge graph in Ireland. By default the AI models run through Amazon Bedrock on its EU inference profiles, so those prompts and outputs stay in AWS’s EU regions; what is processed by Anthropic directly goes to the United States. Sentry and PostHog keep their data in the EU. Lab08 Ltd. works on the Platform from Bulgaria, and this website is hosted there; both are in the EU.

Some of the providers in section VI process personal information outside the European Economic Area: Anthropic, GitHub, Resend and Slack in the United States, Meta and Microsoft in the United States for the features described above, Snyk in the United Kingdom, and the providers we use for payments, marketing and website analytics. Where that happens we rely on an adequacy decision of the European Commission, including the EU-US Data Privacy Framework where the provider is certified under it, or on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the safeguards we rely on by writing to support@lab08.com.

VIII. Security and Retention

We take reasonable measures to protect personal information from unauthorised access, loss, and misuse. We encrypt information in transit and at rest. Access tokens for connected Google, Slack and WhatsApp accounts are stored encrypted. We use role-based access control, serve files through links that expire after an hour, and limit access to production systems to named people who need it. Lab08 staff who support the Platform can act as a user inside a customer’s workspace, and each time they do it is logged. No system is completely secure. If a breach happens we will notify the affected customers without undue delay, and the supervisory authority within 72 hours where we are required to.

We keep personal information only for as long as we need it:

IX. Your Rights

You may have the right to access your personal information, to have it corrected or deleted, to restrict or object to how it is used, to receive it in a portable format, to withdraw consent where it is relied on, and to complain to a supervisory authority.

Where those rights concern the information we control, write to support@lab08.com and we will handle your request. We will respond within one month.

Where they concern information held in a customer’s workspace, including research and analysis about you, the customer is the controller and the decision is theirs. Write to us anyway: we will identify the customers concerned as far as our systems allow, pass your request on, support them in acting on it, and tell you honestly what we found and what we could not reach.

You have the right to complain to a supervisory authority. Ours is the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk. You may also complain to the authority in the country where you live or work.

X. Cookies

The Platform does not use advertising or marketing cookies. Our sign-in system sets cookies that are strictly necessary to keep you signed in, and the Platform keeps a few preferences, such as how far you are through a tour, in your browser. PostHog, for product analytics, and Flows, for onboarding tours, store an identifier in your browser. Our monitoring provider records a sample of sessions to help us reproduce faults; the recording masks text and blocks images, so the documents and deal information you are looking at are not captured.

This website is separate from the Platform and does use two third-party services, but only if you agree to them. Google Analytics tells us which pages are read and how people arrive. HubSpot lets us recognise a returning visitor so a conversation already under way is not started again from scratch. Both set cookies in your browser and both send data outside the EU.

Neither one loads until you choose Accept on the cookie banner. Choosing Decline means they are never requested at all, and the site behaves the same either way. Your choice is remembered in your browser rather than in a cookie, and you can change it whenever you like through Cookie settings at the bottom of any page. Withdrawing consent reloads the page so nothing keeps running; cookies already set by those services can be cleared through your browser.

XI. Changes to This Policy

We may update this policy from time to time. The date at the top shows when it was last changed. Where a change materially affects you, we will let you know by email or through the Platform before it takes effect.

XII. Contact Us

If you have any questions about this policy, or you would like to exercise any of your rights, please contact us: