Privacy policy
Last updated 29 October 2026
Who we are
ZuzeLabs is run by [name and postal address], the controller of the personal data described here. Write to [contact email] about anything on this page.
Your lab's data
What a lab keeps in ZuzeLabs (its inventory, notes, label photos, safety data sheets and spreadsheets) belongs to the lab. We process it on the lab's behalf and only to run the service. If you work in a lab, its organisation decides what is kept there; ask your lab's admin first. Labs can ask us for a data processing agreement.
What we collect
- Your account: your email address, your name, the labs you belong to and your role. People are added by an admin who enters their name and email to invite them.
- Activity log: who changed what in the inventory, and when.
- Technical data: IP address, browser and request times, in our providers' server logs and in short-lived counters that limit how many sign-in emails and scans can be sent.
We don't use analytics, advertising or tracking of any kind, and we don't sell data.
Why, and on what basis
- To give you an account and run the service you or your lab signed up for (GDPR Art. 6(1)(b)).
- To keep the service secure, stop abuse and keep backups (our legitimate interest, Art. 6(1)(f)).
- To send the invitation an admin asks us to send (the lab's legitimate interest, Art. 6(1)(f)).
No decisions about you are made automatically.
Cookies and browser storage
We use only the cookies needed to keep you signed in, so there is no cookie banner. Your browser also remembers your light or dark theme and the last location you scanned to, on your device only.
Who processes it for us
These companies process data on our behalf, under data processing agreements:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, stored files, sign-in | Frankfurt, Germany |
| Vercel | Runs the app | Frankfurt, Germany |
| Brevo | Sends sign-in links and invitations | EU |
| Anthropic | Reads label photos, scanned safety data sheets and spreadsheet notes | USA |
| Google Cloud Vision | Finds the text on label photos (text recognition) | EU |
| Cloudflare R2 | Stores the nightly encrypted backups | EU |
| GitHub | Runs the nightly backup job | USA |
Some of these are US companies. Transfers outside the EU rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. Anthropic doesn't use what it reads to train its models. Substance lookups send only CAS numbers and substance names to ECHA, never personal data.
How long we keep it
- Your account: while you're a member of a lab, or until you ask us to delete it.
- Lab data and the activity log: as long as the lab uses ZuzeLabs. The activity log can't be edited.
- Uploaded spreadsheets: deleted when the import is saved or discarded, at the latest after 7 days.
- Sign-in and scan counters: 2 days. Backups: 30 days.
Your rights
You can ask to see, correct, export or delete your personal data, or to restrict or object to how we use it. Write to [contact email] and we'll answer within a month. You can also complain to your data protection authority; in Latvia that's the Data State Inspectorate (dvi.gov.lv).
Changes
When this policy changes, we update this page and the date at the top.