Privacy policy
Last updated 2026-10-05.
Who is responsible
The data controller is Bob Labs. Contact for any privacy question or request: support@boblabs.eu.
What we collect, why, and for how long
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Email address | Your account and sign-in codes | Contract | Until you delete your account |
| Sign-in codes (stored only as a keyed hash) | Sign-in | Contract | 10 minutes, removed within 1 hour |
| Session data: IP address, browser user agent, times | Keeping you signed in, showing your active sessions, security | Contract; legitimate interest (security) | Until the session ends (at most 7 days) |
| API key metadata: name, identifier, dates, status | Managing your keys | Contract | Until you delete your account |
| Audit log of sign-ins and key actions, with IP address and user agent | Security, abuse investigation, proof of who did what | Legitimate interest (security) | 365 days, also after account deletion |
| Anti-abuse counters (IP address, hashed email) | Rate limiting | Legitimate interest (security) | 2 days |
| Usage figures per key | Showing you your usage | Contract | Cached for about 1 minute |
Encrypted database backups are kept for up to 30 days, so deleted data disappears from backups within 30 days.
The anti-robot check on the sign-in page runs entirely on our servers and in your browser. It uses no cookies and no third-party service.
Who else receives data
- OVH SAS (France): hosting of this portal and its database, encrypted backups.
- Infomaniak Network SA (Switzerland, covered by an EU adequacy decision): sending of sign-in emails.
We do not sell data, show advertising, or use analytics or tracking tools.
Cookies
We only use cookies that are strictly necessary: your session, the sign-in step and protection against cross-site request forgery. They need no consent, and there is no tracking cookie.
Your rights
You can access, correct, export or erase your data, restrict or object to its processing. From your account page you can download all your data and delete your account yourself. For anything else, write to support@boblabs.eu; we answer within one month. You may also complain to the French data protection authority, the CNIL (www.cnil.fr).
Security
Passwordless sign-in, hashed codes and session identifiers, encrypted connections, least-privilege database access, a tamper-resistant audit log and encrypted backups. See the legal notice for the hosting provider.