This policy explains how PricerLab (pricerlab.com) collects, uses and protects personal data, and how we use cookies. It is written to the standard of the UK GDPR and the EU GDPR. Please also read our Terms of Use and the in-app/in-site Disclaimer.
The data controller is PRICERLAB LTD (company no. 17543984), a private company limited by shares registered in England and Wales ("we", "us", "our").
| Data | Source | Purpose | Lawful basis (UK/EU GDPR) |
|---|---|---|---|
| Account email and authentication identity (Google / Microsoft / email, via Clerk; plus a Clerk user identifier) | You, when you register (paid tier) | To create and secure your account and sign you in | Contract |
| Billing & subscription metadata (plan, status, Stripe customer/subscription identifiers) — we do not store card numbers | Stripe, when you subscribe (paid tier) | To take payment and manage your subscription | Contract |
| Saved strategies, structures and portfolios | You (paid tier) | To store and return the content you create | Contract |
| Workspace layout (server-stored copy, paid tier only) | You | To restore your workspace | Contract |
| Marketing-list email address | You, via the sign-up form | To send product updates | Consent (withdraw any time) |
| Security / operational data (request metadata, abuse/fraud signals, error logs) | Automatically, via our infrastructure | To keep the Service secure, reliable and working | Legitimate interests |
| Aggregate website analytics | Cloudflare Web Analytics | To understand site traffic in aggregate | Not personal data (cookieless, no IP/PII — see §4) |
We do not sell personal data, and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects.
We use Cloudflare Web Analytics, which is privacy-preserving and cookieless. It does not use cookies, does not fingerprint or track individuals across sites, and (per Cloudflare) does not collect your IP address or other personally identifying information. It gives us only aggregate traffic statistics. We also record a small number of product events (for example, when a feature is used or a paywall is shown) to improve the Service; these are not used to identify you.
| Provider | What it does for us | Data involved |
|---|---|---|
| Cloudflare | Hosting (Pages / Workers / KV), content delivery, security, cookieless Web Analytics; the email sign-up list and product events are stored in Cloudflare KV | Site traffic (aggregate), request/security metadata, marketing email addresses, product events |
| Clerk | Authentication / identity (Google, Microsoft, email); sets auth/session cookies | Account email, auth identity, session data |
| Stripe | Payments — Stripe hosts the checkout and handles your card data; we never store card numbers | Billing/payment data; card data held by Stripe |
| Neon | Serverless PostgreSQL database (hosted on AWS, London / eu-west-2) | Account, subscription metadata, saved strategies/portfolios, server-stored workspace |
6.1 Our primary database (Neon on AWS, London / eu-west-2) keeps the data it holds within the UK / EU — i.e. UK/EU data residency.
6.2 Some of our processors are US-based or operate globally — in particular Clerk, Stripe and Cloudflare. Where personal data is transferred outside the UK/EEA, we rely on an appropriate safeguard, which is intended to be the UK International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures required.
6.3 You can ask us for more information about these safeguards using the contact details in section 1.
We keep personal data only as long as necessary for the purposes above:
Under UK/EU GDPR you have the right to: access a copy of your personal data; rectify inaccurate or incomplete data; erasure ("right to be forgotten"), where applicable; restrict or object to processing, including processing based on legitimate interests; data portability; withdraw consent at any time (e.g. for marketing emails — this does not affect prior processing); and complain to a supervisory authority — in the UK, the Information Commissioner's Office (ICO), ico.org.uk.
To exercise any right, contact [email protected]. We will respond within the timeframes required by law (generally one month).
We use technical and organisational measures appropriate to the risk, including: authentication and session management via Clerk; payment handling delegated to Stripe (so card data never reaches our systems); transport encryption (HTTPS); access controls; and reputable infrastructure providers. No system is perfectly secure, and we cannot guarantee absolute security.
The Service is not intended for, or directed at, anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
We expect to serve users in Hong Kong in the future. When we do, the Hong Kong Personal Data (Privacy) Ordinance (PDPO) will apply to those users, and we will update this policy accordingly.
We keep cookies to a minimum and use no non-essential/tracking cookies at this time.
Essential / authentication cookies — Clerk. When you sign in (paid tier), our authentication provider Clerk sets essential auth/session cookies necessary to keep you signed in and to secure your session.
Payment cookies — Stripe. During Stripe-hosted checkout, Stripe may set cookies needed to process your payment securely and to help prevent fraud.
Analytics — no cookies. Cloudflare Web Analytics does not use cookies and does not track individuals (see section 4).
Because we currently use only strictly necessary cookies, no consent banner is required. If we later introduce any non-essential cookies, we will implement a cookie-consent mechanism and obtain consent before setting them, as required by the UK PECR and GDPR. You can control or delete cookies through your browser settings, but blocking essential cookies may stop account/payment features from working.
We may update this policy from time to time. The "Last updated" date will change, and material changes may be notified in-app, by email (for account holders) or on the website.
Privacy queries: [email protected]
PRICERLAB LTD, registered in England and Wales (company no. 17543984).
Supervisory authority (UK): Information Commissioner's Office (ICO), ico.org.uk.