Privacy Policy

Generator Labs, Inc. ("Company", "us", "we", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and monitoring services (collectively, the "Service"). Your privacy is important to us, and we want to be as clear as possible about the data we collect and the terms governing our services.

This Privacy Policy applies to our websites, services, applications, and any other services we provide, whether online or offline. It does not apply to third-party websites, services, or applications, even if they link to or from our Service.

When we process personal data for our customers, such as their alert contacts, we act as their processor and our Data Processing Addendum applies.

1. Information We Collect

1.1 Personal Information You Provide

We collect personal information that you voluntarily provide to us when you:

Register for an Account: Name, email address, password, and timezone. You can add a company name, billing address, and tax ID in your account settings
Make a Purchase: Billing information, payment method details (processed securely through our payment providers)
Contact Support: Your name, email address, and any information or files you include in your support requests or communications with us
Configure Monitoring: The assets you want to monitor, and your alert contacts (such as email addresses, phone numbers for SMS, and chat or webhook destinations)

1.2 Information Collected Automatically

When you access or use our Service, we automatically collect certain information about your device and usage:

Device Information: Device type, operating system, IP address, and screen resolution
Browser Information: Browser type and version, language preferences, referring URLs, and pages visited
Usage Data: Information about how you interact with our Service, including features accessed, actions taken, time spent on pages, and usage patterns
Log Data: Server logs including IP addresses, timestamps, error messages, and system activity
Cookies and Tracking Technologies: Data collected through cookies, web beacons, and similar technologies (see Section 7 below)
Approximate Location: Country, region, and city derived from your IP address at signup and login, used for security, fraud prevention, and tax
Advertising Attribution: If you reach us from an ad, the ad click identifiers and campaign tags (such as Google, LinkedIn, and Reddit click IDs and utm values) are stored with your account to measure our advertising

1.3 Monitoring Service Data

As part of providing our monitoring services, we collect and process:

Check results for the assets you configure, such as blacklist status, certificate details, and TLS configuration
Historical monitoring data, trends, and check results over time
Alert and notification delivery status

1.4 Information from Third-Party Sources

We don't buy personal data or receive it from data brokers or marketing partners. The only third-party data we receive comes from accounts you connect (Section 1.5 and Section 14).

1.5 Connected Accounts

Microsoft SNDS: If you connect a Microsoft SNDS account, we store its email address and access tokens and import SNDS data for your IP addresses. You can disconnect it at any time in the portal.
Google Postmaster Tools: See Section 14.

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data based on the following legal grounds:

Contractual Necessity: Processing is necessary to perform our contract with you (e.g., providing the monitoring services you purchased)
Legitimate Interests: Processing is necessary for our legitimate business interests, such as improving our services, preventing fraud, and ensuring network security
Legal Obligations: Processing is necessary to comply with our legal obligations
Consent: Where we have obtained your explicit consent to process your personal data for specific purposes

You have the right to withdraw consent at any time where we rely on consent as the legal basis for processing.

3. How We Use Your Information

We use the information we collect for the following purposes:

Provide, operate, maintain, and improve our monitoring services
Process your transactions and send you related information including purchase confirmations and invoices
Send you monitoring alerts, notifications, and reports based on your configured preferences
Send you technical notices, security alerts, updates, and support messages
Respond to your comments, questions, and customer service requests
Conduct research, analytics, and generate aggregate statistics about Service usage
Monitor and analyze trends, usage patterns, and activities to improve user experience
Diagnose technical problems and maintain system security
Detect, investigate, and prevent fraudulent transactions, unauthorized access, and other illegal activities
Comply with legal obligations, enforce our Terms of Service, and protect our rights and property
Send you marketing communications about products, services, and events (with your consent where required)
Measure and improve our advertising
Fulfill any other purpose disclosed to you at the time of collection

We do not sell or rent your personal information. Our website uses advertising cookies (Section 7), which some laws treat as sharing. We may share your information in the following circumstances:

4.1 Service Providers

We share information with third-party vendors, consultants, and service providers who perform services on our behalf, including:

Payment processing (Stripe, PayPal)
Hosting, storage, and email delivery (Amazon Web Services)
SMS alerts and phone number validation (Twilio)
Bot protection on forms (Google reCAPTCHA)
Analytics and advertising (Google, LinkedIn, Reddit), through cookies on our website

These service providers are contractually obligated to protect your data and use it only for the purposes we specify. The current list of service providers that process customer data, with their locations, is on our Subprocessors page.

4.2 Legal Requirements and Protection

We may disclose your information if required to do so by law or in response to:

Valid legal process (subpoena, court order, search warrant)
Government or regulatory requests
Protect the safety, rights, or property of Generator Labs, our users, or the public
Detect, prevent, or investigate security incidents, fraud, or illegal activity
Enforce our Terms of Service or other agreements

4.3 Business Transfers

If Generator Labs is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

4.4 With Your Consent

We may share your information with third parties when you give us your explicit consent or direct us to do so.

4.5 Aggregate and De-Identified Data

We may share aggregated or de-identified information that cannot reasonably be used to identify you for research, marketing, analytics, or other purposes.

5. Data Security

We implement technical, administrative, and organizational security measures to protect your personal information:

Encryption: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or 1.3. All data at rest is encrypted with AES-256.
Access Controls: Access controls limit who can access personal information. Access is granted on a need-to-know basis and protected by multi-factor authentication.
Security Assessments: Continuous vulnerability scanning and yearly penetration testing by a third-party service.
Employee Training: All employees receive training on data protection, privacy, and security best practices.
Secure Development: Security is integrated into our software development lifecycle with static analysis and security review.
Incident Response: We maintain an incident response plan to quickly address any security incidents.
Infrastructure Security: Our infrastructure is hosted on Amazon Web Services, which maintains industry-standard security certifications.

Details are on our Security page.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we use appropriate technical and organizational measures to protect your personal information, we cannot guarantee absolute security.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Our retention practices include:

Active Accounts: We retain your information for as long as your account remains active or as needed to provide you services.
Monitoring Data: Historical monitoring data is kept for a limited period set by each product, then deleted.
Legal Obligations: We retain information as necessary to comply with legal obligations, tax requirements, and regulatory obligations.
Dispute Resolution: Information may be retained to resolve disputes, enforce our agreements, and protect our legal rights.
After Account Closure: When you close your account, we delete your personal data within 30 days, and backup copies expire within a further 30 days. We keep billing records for six years after the end of the tax year they relate to, as Canadian tax law requires.

When personal information is no longer needed, we securely delete or anonymize it in accordance with our data retention policies.

7. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to collect information and improve our Service:

7.1 Types of Cookies We Use

Essential Cookies: Necessary for the Service to function, including authentication and security cookies that keep you logged in, a cookie that remembers your cookie choice, and Google reCAPTCHA, which protects our forms from abuse.
Analytics Cookies: Help us understand how visitors use our Service, which pages are popular, and how users navigate our site, using Google Analytics and Google Tag Manager.
Advertising Cookies: Google Ads, the LinkedIn Insight Tag, and the Reddit Pixel on our website measure our ads and help us reach similar audiences. Our own attribution cookie keeps the ad details from your first visit (such as click IDs and campaign tags) for 30 days, so we can credit your sign-up to the ad that brought you.

7.2 Managing Cookies

In the EEA, the UK, and Switzerland, analytics and advertising cookies are set only after you accept them. You can change your choice at any time from the Cookie Settings link in our footer.

Most web browsers are set to accept cookies by default. You can usually choose to set your browser to remove or reject cookies. Please note that if you choose to remove or reject cookies, this may affect the availability and functionality of our Service. You may not be able to log in or use certain features.

8. Your Privacy Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

8.1 General Rights

Access: Request access to the personal information we hold about you and receive a copy of it.
Correction: Request that we correct, update, or amend inaccurate or incomplete personal information.
Deletion: Request deletion of your personal information, subject to certain legal exceptions.
Portability: Request that we transfer your information to another organization or directly to you in a structured, commonly used format.
Restriction: Request that we limit the use or disclosure of your personal information in certain circumstances.
Objection: Object to our processing of your personal information based on legitimate interests.
Withdraw Consent: Withdraw your consent to processing where we rely on consent as the legal basis.

8.2 Marketing Communications

You can opt out of receiving promotional emails by:

Clicking the "unsubscribe" link in any marketing email we send you
Visiting our opt-out page at https://portal.generatorlabs.com/main/optout
Contacting us directly at legal@generatorlabs.com

Please note that even if you opt out of marketing communications, we will still send you transactional and service-related messages necessary to provide our Service (e.g., monitoring alerts, account notifications, security updates).

8.3 Exercising Your Rights

To exercise any of these rights, please contact us at legal@generatorlabs.com with your request. We will respond to your request within thirty (30) days. We may need to verify your identity before processing your request to ensure the security of your personal information.

9. International Data Transfers

Your information may be transferred to, stored, and processed in countries other than your country of residence, including the United States and Canada, where our servers and service providers are located. These countries may have different data protection laws than your country.

To run the checks you configure, the Service sends queries to third-party sources (such as blocklist operators' DNS servers) and connects to the endpoints you monitor, which may be in any country. They receive only what each check needs, such as the IP address or domain being checked, and they aren't our subprocessors.

When we transfer personal information from the EEA, UK, or Switzerland to other countries, we implement appropriate safeguards, including:

Standard Contractual Clauses approved by the European Commission
Adequacy decisions recognizing equivalent data protection
Other legally approved transfer mechanisms

10. Children's Privacy

Our Service is not intended for, and we do not knowingly collect personal information from, individuals under the age of 18. If we learn that we have collected personal information from a child under 18, we will delete that information as quickly as possible. If you believe we have collected information from a child under 18, please contact us immediately at legal@generatorlabs.com.

11. Sensitive Personal Information

We do not intentionally collect sensitive personal information such as Social Security numbers, financial account information, health information, genetic data, biometric data, or information about racial or ethnic origin, political opinions, religious beliefs, or sexual orientation. Please do not submit such information through our Service.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

Post the updated Privacy Policy on this page
Update the "Effective Date" at the top of this policy
Notify you via email or through a prominent notice on our Service

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.

13. Region-Specific Privacy Information

13.1 European Economic Area (EEA), United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent laws:

Privacy Contact: Contact our privacy team at legal@generatorlabs.com for any GDPR-related inquiries.
Legal Basis: See Section 2 above for our legal bases for processing your personal data.
Rights: You have the rights described in Section 8 above, including access, rectification, erasure, restriction, portability, and objection.
Automated Decision-Making: We do not use automated decision-making or profiling that produces legal or similarly significant effects.
Supervisory Authority: You have the right to lodge a complaint with your local data protection authority if you believe we have violated your privacy rights. Contact information for EU data protection authorities is available at https://www.edpb.europa.eu/. In the UK, contact the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner.

13.2 California Residents (CCPA/CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Categories of Personal Information Collected

We collect the following categories of personal information (see Section 1 for details):

Identifiers (name, email, IP address, advertising click IDs)
Commercial information (purchase history, account information)
Internet or network activity (browsing history, usage data)
Geolocation data (approximate location based on IP address)
Professional information (company name)

Your California Rights

Right to Know: Request disclosure of what personal information we collect, use, disclose, and sell.
Right to Delete: Request deletion of your personal information, subject to certain exceptions.
Right to Correct: Request correction of inaccurate personal information.
Right to Opt-Out of Sale/Sharing: We don't sell personal information. Our advertising cookies may count as sharing; you can turn them off from the Cookie Settings link in our footer.
Right to Limit Use of Sensitive Personal Information: We do not collect or use sensitive personal information beyond what is necessary to provide our services.
Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Exercising California Rights

To exercise your California privacy rights, email us at legal@generatorlabs.com or use our contact form. We will verify your identity before processing your request and respond within 45 days.

Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

13.3 Canada

We're a Canadian company, and the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to the personal information we handle. You have the rights described in Section 8, including access and correction. If you're not satisfied with our response, you can complain to the Office of the Privacy Commissioner of Canada.

Generator Labs integrates with Google services in two ways. Our use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

14.1 Sign In with Google

If you choose to sign in with Google, we receive your Google account email address and basic profile information (such as your name). We use this information solely to authenticate you and to create or access your Generator Labs account. We do not use it for advertising.

14.2 Google Postmaster Tools

If you connect a Google account to our Blacklist Monitoring product, you authorize us, through the Google Postmaster Tools scopes (postmaster.domain and postmaster.traffic.readonly), to import deliverability and reputation data for the domains registered in your Google Postmaster Tools account. This includes spam rate, authentication success rate, delivery errors, TLS encryption rate, and sender compliance status (SPF, DKIM, DMARC, and unsubscribe requirements).

We use this data only to display monitoring dashboards and graphs, and to send deliverability alerts, for your own domains within your account. We do not sell or transfer this data, we do not use it for advertising, and we limit human access to it except as necessary for security, to comply with applicable law, or where you have given consent.

14.3 Retaining and Revoking Access

You can disconnect a connected Google account at any time from within the Generator Labs portal, which removes our stored access tokens. You can also review and revoke access at any time from your Google Account permissions page. Imported Postmaster Tools data is retained as described in Section 6 and is deleted when you disconnect the account or close your Generator Labs account.

14.4 Sign In with Microsoft

If you choose to sign in with a Microsoft work or school account, we receive your name, your email address (if Microsoft has verified its domain), and your Microsoft account IDs. We use this information solely to authenticate you and to create or access your Generator Labs account. We do not use it for advertising.

15. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Email: legal@generatorlabs.com
Website: Contact Form

We will respond to all privacy-related inquiries within thirty (30) days.