Legal

Privacy Policy

Last modified: April 2026

1. Identity and contact

Virtual Lab ABN: 87 281 797 293 Email: contact@virtual-lab.studio For privacy-related inquiries, contact us at the email above.

2. Information we collect

Contact form data (provided by you)

Name (required)
Email address (required)
Company / project name (optional)
Message describing your project (required)
Timeline preference (optional)
Budget range (optional)

Automatically collected

IP address — used solely for rate limiting and security
Browser type and device information — standard server logs via Vercel

We do not collect

Cookies (no tracking cookies at launch)
Location data
Financial information
Information from persons under 14 years of age

3. Purpose of collection

We collect your personal information to:

Respond to your inquiry
Send a confirmation email acknowledging your message
Send an internal notification to our team for follow-up
Prevent spam and abuse through rate limiting

We will not use your information for marketing, newsletters, or any purpose beyond responding to your inquiry without your explicit consent.

4. How we use and process your data

You submit the contact form
Server validates input and checks rate limits
Confirmation email sent to you via Resend
Internal notification sent to our support inbox via Resend
Optional: notification sent to our internal Discord channel

No database storage — form data exists only in email inboxes.

5. Third-party service providers

The following service providers process data on our behalf:

Provider	Location	Purpose	Data shared
Resend	United States	Transactional email delivery	Name, email address
Vercel	United States	Website hosting, server logs	IP address, browser info
Discord	United States	Internal team notifications (optional)	Name, email, message summary

These providers process data under their own privacy policies and data processing agreements (DPAs).

6. Cross-border data transfer

Your personal information may be transferred to and processed in the United States by our service providers (Resend, Vercel, Discord).

For Australian users: This transfer is disclosed in accordance with Australian Privacy Principle 8. Our service providers are contractually obligated to handle your data in accordance with the Privacy Act 1988.

For South Korean users: Pursuant to PIPA, by submitting the contact form you consent to the cross-border transfer of your personal information to the United States. The United States may provide different levels of data protection than South Korea. You may withdraw this consent at any time by contacting us, though we may be unable to respond to your inquiry without it.

For Japanese users: Pursuant to APPI Article 28, by submitting the contact form you consent to the transfer of your personal information to countries outside Japan. We have ensured our service providers implement safeguards equivalent to APPI protections through data processing agreements.

7. Data retention

Contact form data is delivered via email only — not stored in a database
Email records retained for 90 days for follow-up purposes, then deleted
IP addresses for rate limiting stored in-memory only — cleared on server restart, not persisted
No backup copies are maintained beyond email inbox retention

8. Your rights

All users may:

Request access to personal information we hold about you
Request correction of inaccurate information
Request deletion of your information
Withdraw consent for data processing

Australian users — under the Privacy Act 1988:

You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

South Korean users — under PIPA:

You may request: access, correction, deletion, suspension of processing, and withdrawal of consent. You may lodge a complaint with the Personal Information Protection Commission (PIPC) at pipc.go.kr. We will respond to rights requests within 30 days.

Japanese users — under APPI:

You may request: disclosure, correction, deletion, cessation of use, and cessation of third-party provision. You may lodge a complaint with the Personal Information Protection Commission (PPC) at ppc.go.jp. We will respond to rights requests within 30 days. No fee is charged for verification requests.

9. Children's privacy

We do not knowingly collect personal information from persons under 14 years of age. If a parent or guardian believes we have collected such information, please contact us immediately and we will delete it.

10. Data breach notification

In the event of a data breach affecting your personal information:

We will notify affected individuals without unreasonable delay
We will notify the OAIC (Australia), PIPC (South Korea, within 72 hours), and/or PPC (Japan) as required by applicable law
We will provide information about the breach and remedial steps taken

11. Changes to this policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last modified" date. Material changes will be highlighted.

Virtual Lab