Privacy Policy

Lab63 ("we", "our", "us") operates the Octopus platform at octopusify.org. This Privacy Policy describes how we collect, use, store, and protect your personal information when you use our services.

We are committed to protecting your privacy in compliance with applicable data protection laws including GDPR, CCPA, and other relevant regulations.

Account Information: Name, email address, company name, job title, and phone number when you register or request a demo.

Usage Data: Log data, IP addresses, browser type, pages visited, features accessed, and session duration for platform analytics and security purposes.

Tenant Business Data: The risk, compliance, financial, and operational data your organization inputs into the platform for analysis. This data is stored in your isolated tenant database and is never shared with other tenants.

Payment Information: Billing details processed securely through Stripe. We do not store full card numbers on our servers.

Communication Data: Messages sent through our contact forms, email correspondence, and support tickets.

• Providing, maintaining, and improving the Octopus platform services
• Processing your AI analysis requests and generating risk intelligence outputs
• Sending transactional emails (alerts, reports, account notifications)
• Processing subscription billing and managing your account
• Responding to support requests and demo inquiries
• Detecting and preventing fraud, abuse, and security incidents
• Complying with legal obligations and regulatory requirements
• Improving our AI models (using anonymized, aggregated patterns only — never your identifiable data)

Each tenant organization's data is stored in a separate, isolated database (dboct_{slug}). Access controls ensure no user from one tenant can access data belonging to another tenant.

Our engineers access tenant data only for support purposes with your explicit consent, and all such access is logged in our audit trail.

Our AI analysis features are powered by Google Gemini. When you run AI analysis on your data, the relevant data is sent to Google's API for processing. Google's own privacy policies govern their handling of this data. We encourage you to review Google's AI privacy practices.

We use the following third-party services:

• Google Gemini — AI analysis processing
• Stripe — Payment processing
• Mailtrap — Transactional email delivery
• Redis / Bull — Job queue processing (self-hosted)

We retain your account data for as long as your subscription is active. Upon termination, you have 30 days to export your data before it is permanently deleted from all our systems.

Log data is retained for 90 days for security and debugging purposes. Billing records are retained for 7 years for legal and accounting compliance.

We implement industry-standard security measures including:

• TLS/HTTPS encryption for all data in transit
• AES-256 encryption for sensitive data at rest
• JWT-based authentication with rotating refresh tokens
• Rate limiting and DDoS protection via Helmet.js and infrastructure-level controls
• Regular security audits and penetration testing
• Role-based access control (RBAC) within tenant organizations

Depending on your jurisdiction, you may have the right to:

• Access — Request a copy of your personal data we hold
• Rectification — Correct inaccurate personal data
• Erasure — Request deletion of your personal data ("right to be forgotten")
• Portability — Export your data in a machine-readable format
• Objection — Object to certain processing activities
• Withdraw Consent — Withdraw consent for optional data processing at any time

To exercise any of these rights, contact us at one@lab63.org.

We use essential cookies for authentication sessions and platform functionality. We do not use tracking or advertising cookies. You can control cookie settings through your browser, though disabling essential cookies may affect platform functionality.

The Octopus platform is intended for enterprise use by adults (18+). We do not knowingly collect personal information from individuals under 18 years of age.

Our servers are hosted in the United States. If you access our services from outside the US, your information may be transferred to and processed in the US, which may have different data protection laws than your country.

For EEA/UK users, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission for international data transfers.

We may update this Privacy Policy from time to time. We will notify you of significant changes via email and by updating the "Last updated" date at the top of this page. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

For privacy-related inquiries, data subject requests, or to report a privacy concern:

Octopusify Ltd — Data Privacy
one@lab63.org

America: 17531 NW 47th Avenue, Miami Gardens, FL 33055
+1 (305) 924-3331

India: B-302, Vignesh Empire, Woriyur, Trichy, Tamilnadu - 620003
+91 9886356363