Legal

Privacy Policy

Last modified: April 2026

1. Identity and contact

Virtual Lab ABN: 87 281 797 293 Email: contact@virtual-lab.studio For privacy-related inquiries, contact us at the email above.

2. Information we collect

Contact form data (provided by you)

Name (required)
Email address (required)
Company / project name (optional)
Message describing your project (required)
Timeline preference (optional)
Budget range (optional)

Automatically collected

IP address — used solely for rate limiting and security
Browser type and device information — standard server logs via Vercel

We do not collect

Cookies (no tracking cookies at launch)
Location data
Financial information
Information from persons under 14 years of age

3. Purpose of collection

We collect your personal information to:

Respond to your inquiry
Send a confirmation email acknowledging your message
Send an internal notification to our team for follow-up
Prevent spam and abuse through rate limiting

We will not use your information for marketing, newsletters, or any purpose beyond responding to your inquiry without your explicit consent.

4. How we use and process your data

You submit the contact form
Server validates input and checks rate limits
Confirmation email sent to you via Resend
Internal notification sent to our support inbox via Resend
Optional: notification sent to our internal Discord channel

No database storage — form data exists only in email inboxes.

5. Third-party service providers

We engage a minimal set of service providers to operate the website and deliver services. Each is bound by a Data Processing Agreement (DPA) or equivalent, requiring encryption in transit, purpose limitation, data subject request handling, and breach notification.

Resend Inc.

Purpose: Transactional email delivery (contract notifications, payment receipts, reminders)
Data processed: Name, email address, email content
Location: United States
Retention: 30 days in delivery logs
Safeguards: DPA, TLS encryption in transit, SOC 2 Type II

Vercel Inc.

Purpose: Website hosting, edge delivery, server logs
Data processed: IP address, User-Agent, URL path, timestamp
Location: United States (global edge CDN)
Retention: 30 days in access logs
Safeguards: DPA, TLS 1.3, ISO 27001, SOC 2 Type II

Neon Inc. (via Vercel Postgres)

Purpose: Database hosting for contact form leads and contracts
Data processed: Form submissions, contract records, client records
Location: United States
Retention: Leads: 12 months. Contracts: 7 years (tax/audit). Otherwise per Section 7.
Safeguards: DPA, AES-256 at rest, TLS in transit, SOC 2 Type II

Stripe Inc.

Purpose: Payment processing and invoicing (applies only to contracted clients, not general website visitors)
Data processed: Billing name, email, company, invoice amount. Card details handled directly by Stripe; never stored on our servers.
Location: United States; Ireland for EU-based clients
Retention: 7 years for tax and audit compliance (Stripe retention policy)
Safeguards: DPA, PCI-DSS Level 1, TLS 1.3, SCCs for cross-border transfers

Discord Inc.

Purpose: Internal team notifications via webhook (optional; used only if configured)
Data processed: Summary of contact form submission (name, email, project type, message excerpt)
Location: United States
Retention: Until manually deleted from internal Discord channel
Safeguards: TLS encryption in transit, access restricted to authorized team members

Each provider processes personal information solely on our instructions and under its respective Data Processing Agreement. We do not sell or share personal information for advertising or marketing purposes.

6. Cross-border data transfer

Your personal information is transferred to and processed in the United States by the service providers listed in Section 5 (including Resend, Vercel, Neon, Stripe, and optionally Discord). See Section 5 for each provider's specific purpose, data categories, retention period, and safeguards.

US privacy regime

The United States does not have a single comprehensive federal privacy law equivalent to Australian Privacy Principles, PIPA, or APPI. However, each of our service providers is bound by a Data Processing Agreement that requires: (i) processing only on our documented instructions; (ii) confidentiality obligations on their personnel; (iii) appropriate technical and organizational security measures; (iv) assistance with data subject rights requests; (v) prompt breach notification; (vi) return or deletion of data on request. Additional sector-specific US laws (CCPA/CPRA for California, HIPAA for health data, GLBA for financial data) may also apply to specific providers.

For Australian users: This cross-border disclosure is made in accordance with Australian Privacy Principle 8.1. Our service providers are contractually obligated to handle your personal information in a manner consistent with the Privacy Act 1988 (Cth).

For South Korean users: Pursuant to the Personal Information Protection Act (PIPA) Article 28-8, by submitting any personal information through this website you consent to the cross-border transfer described above. This consent covers: (i) the recipients listed in Section 5; (ii) the destination country (primarily the United States, and Ireland for some Stripe processing); (iii) the date, method, and items of transfer as described in Section 5; (iv) the purposes and retention periods described in Section 5. You may withdraw consent at any time by contacting us, though we may be unable to respond to your inquiry without it.

For Japanese users: Pursuant to APPI Article 28, by submitting any personal information through this website you consent to the cross-border transfer described above. The information regarding the recipient country's personal information protection regime required by Article 28(2) is set forth under "US privacy regime" above. Our service providers implement safeguards equivalent to measures required under APPI through their Data Processing Agreements as described in Section 5.

7. Data retention

Contact form data is delivered via email only — not stored in a database
Email records retained for 90 days for follow-up purposes, then deleted
IP addresses for rate limiting stored in-memory only — cleared on server restart, not persisted
No backup copies are maintained beyond email inbox retention

8. Your rights

All users may:

Request access to personal information we hold about you
Request correction of inaccurate information
Request deletion of your information
Withdraw consent for data processing

Australian users — under the Privacy Act 1988:

You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

South Korean users — under PIPA:

You may request: access, correction, deletion, suspension of processing, and withdrawal of consent. You may lodge a complaint with the Personal Information Protection Commission (PIPC) at pipc.go.kr. We will respond to rights requests within 30 days.

Japanese users — under APPI:

You may request: disclosure, correction, deletion, cessation of use, and cessation of third-party provision. You may lodge a complaint with the Personal Information Protection Commission (PPC) at ppc.go.jp. We will respond to rights requests within 30 days. No fee is charged for verification requests.

9. Children's privacy

We do not knowingly collect personal information from persons under 14 years of age. If a parent or guardian believes we have collected such information, please contact us immediately and we will delete it.

10. Data breach notification

In the event of a data breach affecting your personal information:

We will notify affected individuals without unreasonable delay
We will notify the OAIC (Australia), PIPC (South Korea, within 72 hours), and/or PPC (Japan) as required by applicable law
We will provide information about the breach and remedial steps taken

11. Changes to this policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last modified" date. Material changes will be highlighted.

Virtual Lab