Privacy Policy
What we collect, what we deliberately do not, and what you can ask us to do about it.
Version 2.0 · Effective 1 September 2026 · Updated 9 October 2026
Signed up before 1 September 2026? Version 1.0 remains available.
Introduction
Labshock Security LLC ("Labshock", "we", "our", or "us") values your privacy. This Privacy Policy explains what personal data we collect, why we collect it, how long we keep it, who we share it with, and what rights you have over it. It covers the labshocksecurity.com website, Labshock-operated online account and learning services, licensing, billing and support. Customer-controlled installations have different data flows from online services; see "Customer Environments" and "Organization Accounts and Learning Reports" below.
Data Controller
Labshock Security LLC Registered in South Carolina, United States Mailing address: 108 W 39th Street, Ste 1006 PMB2509 New York, NY 10018 United States Email: info@labshocksecurity.com For privacy questions, data requests, or to exercise any of the rights described below, write to info@labshocksecurity.com with "Privacy" in the subject line.
Account Information
Collected when you register and while you hold an account: - Name - Email address - Organization, where applicable Online World accounts use a one-time code sent to your email address. Local Portal installations may use a username and password, with a password hash stored in that installation. The organization operating a local installation controls those credentials.
Platform Data
Generated as you use the platform: - Account and player identifiers, display name and organization association where applicable - Guide, quest and lab progress, skills and achievements - Submitted quiz/question answers, attempts, scores and completion timestamps - Mission objective checks, attempts, outcomes and rewards - Challenge participation and results where the feature is used - License, subscription and purchase records - Support requests These records support learning, assessment, reporting and access management. Records held by Labshock-operated online services are distinct from process data held only in a customer-controlled lab.
Technical Data
The online application uses account/email-based limits to help prevent sign-in abuse. Network connections necessarily expose connection information, including an IP address, to the infrastructure serving them; this policy does not promise that every hosting, proxy or customer-operated system keeps no connection logs. Application logs support troubleshooting, security and abuse prevention. They can contain account identifiers such as an email address or the context of a failed action. The online application’s standard log-retention setting is 7 days. Customer-controlled deployments and infrastructure logs follow the operator’s configuration. We do not use technical information for advertising or cross-site tracking.
Support Data
Information you voluntarily submit when asking for help — messages, screenshots, logs or configuration you choose to send — is processed solely to resolve that issue. Please do not send production credentials or sensitive operational data in a support request. If you do, we will ask you to rotate anything shared.
Customer Environments
Labshock does not access, inspect or monitor customer OT environments unless the customer explicitly requests support. Customer-controlled environments run on infrastructure you control. Process data, packet captures, local telemetry and customer-created configurations remain there unless you deliberately send them to an online service, support or a third-party integration. Supported disconnected operation, activation and update workflows depend on the licensed build and deployment configuration. Using Labshock-operated online accounts, learning services or reporting transmits the account, progress and assessment records required by those features. Do not treat those online records as wholly local lab data. Nothing in this policy gives us a right to reach into a running deployment.
Organization Accounts and Learning Reports
Authorized organization administrators and instructors can review the progress, assessment attempts, objective results and reports of users assigned to their licensed scope, where supported by the deployed release. These records may identify the learner and show what they completed and when. The organization determines its teaching, assessment and access purposes, informs its users and controls authorized access. A software license does not grant unrestricted access to personal data or replace the organization's data-protection responsibilities. Labshock acts as controller for its own account, licensing, billing and support purposes. If Labshock is engaged to process learner or personnel data on an organization's behalf, the parties must document those processing activities and agree the data-processing terms required by applicable law. A customer-controlled installation alone does not mean Labshock hosts or processes its local data. Automatic grading checks defined exercise conditions; it does not independently decide employment, admission or other decisions with legal or similarly significant effects. Instructors remain responsible for their assessment decisions.
Customer Data Ownership
Customers retain ownership of the data they create within their own Labshock deployments — the topologies they build, the logic they write, the captures they take and the material they produce for their own teaching or testing. Labshock claims no ownership over customer-created content.
How We Use Your Information
We use the information described above to: - Provide and maintain the platform and your account - Record learning progress and exercise outcomes and provide authorized instructor/administrator reports - Issue and verify licenses - Answer support requests - Secure the service and prevent fraud or abuse - Meet legal and accounting obligations - Send service messages about your account or license We do not sell personal data, and we do not share it for advertising.
Legal Basis
Where the GDPR applies, we process personal data on the following bases: - Performance of a contract — providing the platform and the license you purchased - Legitimate interests — securing the service, preventing abuse, and improving the product - Legal obligations — tax, accounting and compliance record-keeping - Consent — where required, and withdrawable at any time
Data Retention
We retain personal data only for as long as necessary to provide our services, comply with legal obligations, resolve disputes and enforce agreements. Account and learning records are retained while needed to provide the account, learning history and authorized organizational reporting. You may request deletion; we may retain records where needed for legal obligations, disputes or legitimate security purposes. Billing and tax records follow applicable statutory retention requirements. Customer-controlled local records follow the organization’s own retention and deletion rules. Removing an online account does not automatically erase local installations or third-party copies. Contact us for the retention criteria and deletion arrangements applicable to your account or organization, including any agreed backup handling.
International Transfers
Labshock Security LLC is established in the United States. Personal data may be processed in the United States or in other countries where our service providers operate. Where required by law, appropriate safeguards are used for those transfers.
Third-Party Services
We share personal data with a small number of providers, only as needed to run the service: - Stripe — payment processing and subscription management - Lemon Squeezy — payment processing and subscription management - Email delivery providers — sign-in codes and service messages - Hosting and infrastructure providers — operation of online services Email delivery may use Maileroo where configured. Providers used for a customer-controlled installation depend on its configuration. Contact us for the providers and processing locations applicable to your service or for organization procurement. Payment card details are handled by those providers and are never stored by Labshock. The labshocksecurity.com website uses no third-party analytics, advertising or tracking services. There is no Google Analytics, no tag manager and no advertising pixel on it.
Cookies & Local Storage
Labshock services use necessary browser storage for authentication and preferences. Online World stores its sign-in token in local storage. Local Portal uses an authentication cookie, and connected challenge services may use session cookies. Local/session storage may also remember interface preferences and draft settings. Authentication data is sent to the relevant service when you use it. Signing out removes the relevant authentication token or session cookie; other local preferences may remain until you clear browser storage. Blocking necessary storage may prevent sign-in or connected features from working. We do not use advertising or analytics cookies, and we do not participate in cross-site tracking.
Security Measures
We use encryption in transit, access controls, authentication, logging and other reasonable administrative, technical and organizational measures to protect personal data from unauthorized access, alteration, disclosure or destruction. No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities where the law requires it.
Your Rights
Subject to applicable law, you have the right to: - Access the personal data we hold about you - Correct data that is inaccurate or incomplete - Delete your data - Receive your data in a portable format - Restrict how we process your data - Object to processing based on legitimate interests - Withdraw consent, where processing is based on consent - Opt out of marketing communications at any time To exercise any of these, contact info@labshocksecurity.com. You also have the right to complain to your local data protection authority.
California Privacy Rights
California residents may have additional rights under applicable law, including rights to know, delete and correct personal information, and the right not to be discriminated against for exercising them. Labshock does not sell personal information and does not share it for cross-context behavioural advertising.
Children
Our services are not directed to children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact info@labshocksecurity.com and we will delete it.
Changes to This Policy
We may update this Privacy Policy. Updates are published with a visible update date. Prior published versions remain available where applicable; existing signed data-processing agreements retain their agreed terms. Material changes will be communicated to account holders by email or in-product notice before they take effect.
Contact Us
Questions, data requests or complaints about this Privacy Policy: Labshock Security LLC South Carolina, United States Email: info@labshocksecurity.com Please put "Privacy" in the subject line so the request is routed correctly.