Privacy Policy
We are INS8LABORATORY SRL (Ins8Laboratory), a small data consultancy in Romania. Here is what we do with personal data, in plain words.
This website
It does not track you. No cookies, no analytics, no ad pixels. Our hosting provider keeps the usual server logs (your IP address, which page you opened, when) for a short while, for security. That is it.
If you email us
We keep your email and what you wrote so we can answer you and remember the conversation. If nothing comes of it, we delete it after a couple of years. We do not add you to any list.
The work we do for clients
Most of what we do is building data systems for other companies: retail, services, health and government organisations. Those systems handle their customers' data, not ours. In legal terms, the client is the "controller" and we are the "processor": we only do what the client tells us to do, under a written agreement, and the data stays theirs.
The kind of data involved: orders and transactions, customer contact details the client already has (name, phone, email, app ID, address), whether someone agreed to or opted out of marketing, and reporting numbers from advertising and analytics platforms.
What it is used for: understanding customers, measuring whether marketing works, and choosing who the client contacts and who they leave alone. We also like control groups, which means some people are deliberately not contacted so we can tell if anything worked.
Data from advertising platforms (Meta, Google, TikTok)
Some clients let our software read their advertising accounts through the platforms' official APIs. When they do:
- we read only what the client authorised and only what reporting needs (campaign and ad performance numbers);
- the data lives in the client's own cloud account, in the EU;
- we never sell it, never mix one client's data with another's, and never use it for anything except that client's reporting and audiences;
- we delete it when the client asks, when access is revoked, or when the work ends;
- we follow each platform's developer rules.
Where it all sits and who sees it
Google Cloud, in the EU, in the client's own account. Only named people from our team have access, with individual logins and the minimum permissions needed. Passwords and API keys live in a secret store, never in code. Where we use other services (cloud hosting, the messaging providers a client chose, our own email and chat tools), they are bound by the same European data rules.
How long we keep things
- Emails from you: up to 2 years after the last message, longer if we end up working together.
- Website logs: up to 90 days.
- Client data: for as long as we work together, then deleted or handed back, normally within 30 days.
- Invoices and contracts: as long as Romanian law requires (5 to 10 years).
Your rights
You can ask us what we hold about you, ask us to fix it or delete it, object to how we use it, or take it with you. Just write to start@ins8laboratory.com. If your data is in a system we run for a client, we will point you to that client or pass your request on, because it is their data to answer for.
If you think we got something wrong, you can also complain to the Romanian data protection authority, ANSPDCP, at dataprotection.ro.
Who to talk to
INS8LABORATORY SRL, registered in Romania (J2025004575004, CUI 51174508), Splaiul Independenței 3, Râmnicu Vâlcea 240166, Romania. Email start@ins8laboratory.com.
If we change this page, the date at the top changes too.