Privacy Policy

1. Who we are

LexLab runs lexlabtools.com. It is operated by one engineer, and the operator is the controller for the personal data described on this page. Contact: support@lexlabtools.com, or Telegram @lexlabtools. Company identity details are published on the Legal page.

This policy covers data we hold about you as a visitor or customer. Data you put into our services, such as your recipient lists or whatever you store on a VPS, is yours. We process it on your behalf, and the terms for that are in the Data Processing Agreement.

2. What we collect

Account. Your Telegram username (this is your login name and is required), your email address, and a password that we store only as a hash. Optionally, whatever you add to your profile: name, phone number, company, website, bio, postal address, social links, an avatar, and cryptocurrency payout addresses. If you link the Telegram bot, we store your Telegram chat ID so we can message you.

Orders and payments. What you ordered, the amount, the crypto asset you paid in, the payment status, and the payment processor's reference for the payment. Wallet top-ups and spending are recorded as wallet transactions.

Service requests and provisioning. Details you give us for a job: domain names, server location and operating system, expected mail volume, your requirements, and any access credentials you hand over so we can do the work. For hosting we store the server's IP address, its operating system, and the server password we generate, so we can provision the server and send you access. For SMTP we store the credentials we issue you. Section 9 says why you should change these after delivery.

Contact form. Name, email, subject and message. These are not stored in our database. They are forwarded to the operator's Telegram. A hash of your IP address, the subject and the message is cached for 10 minutes to stop duplicate submissions, then discarded.

Newsletter. Your email address, if you subscribe.

Product demos. Your IP address and browser user agent when you launch a product demo.

Sign-up fraud signals. When you register we record your IP address, its /24 subnet, its network (ASN) and whether that network is a datacenter, VPN or residential provider; a canonical form of your email address and whether its domain is a disposable-mail service; a device fingerprint built in your browser from canvas and WebGL rendering, installed fonts, screen size, platform, user agent, timezone and language; the timing of how the form was filled in; and a risk score computed from all of it. This is kept in a fraud-prevention table linked to your account. Today it only flags accounts for a human to look at. It does not block anyone on its own.

Login attempts. IP address, user agent, the username tried, and the path. Ten failed attempts lock that IP out for 30 minutes.

Server and application logs. The web server records each request: IP address, user agent, URL and timestamp. The application keeps its own logs. A security middleware that rejects malformed requests logs the names of the fields it blocked, not your IP address.

Telegram bot. If you use the bot: your chat ID, Telegram username and first name.

3. Why we use it, and the lawful basis

• Contract: running your account, taking and fulfilling orders, provisioning servers, domains and SMTP, and answering support.
• Legitimate interests: preventing fraud at sign-up and at payment, security logging and lockouts, handling abuse reports, and aggregate statistics on the research hub. We keep this data narrow and weigh it against your interests.
• Consent: the newsletter, and linking your Telegram account to the bot. You can withdraw either at any time.
• Legal obligation: keeping payment and tax records, and answering lawful requests from authorities.

We do not sell personal data, share it for marketing, or use it for advertising. We make no automated decisions with legal or similarly significant effect: fraud scores are reviewed by a human before anything happens to an account.

4. Cookies

Three cookies: sessionid for login, csrftoken for form protection, and telegram_popup_dismissed if you close the Telegram prompt. No advertising or analytics cookies, no third-party cookies, no localStorage. None of them needs consent, so there is no cookie banner. The Cookie Policy has the table. It also covers the sign-up device fingerprint described in Section 2, which is not a cookie but belongs in the same conversation.

5. Analytics

We run GoatCounter, self-hosted on our own server, on the security research post pages only. It uses no cookies. It records the page path, the referrer, screen size, browser family, language, and a salted hash of your IP address and user agent that changes every day, so visits cannot be linked from one day to the next. The IP address itself is not stored. Nothing is sent to any analytics company. The rest of the site has no analytics at all.

No request goes to a third party when a page loads: fonts and icons are served from our own server. A product page can load a YouTube or Vimeo player, but only after you click to play a product video. Their privacy terms apply from that point.

6. Who we share it with

These providers process data for us. Each gets only what its job needs.

When you order a marketplace item or an SMM service, the order details needed to fulfil it go to the seller or the upstream provider. Beyond that, we disclose data only when the law requires it, to answer a valid legal request, or to protect our rights or someone's safety.

7. International transfers

Our server and database are in Germany. Namecheap, Cloudflare and Google are in the United States, Telegram is in Dubai, and Paystack and Flutterwave are in Nigeria. For processors outside the EEA and the UK we rely on standard contractual clauses or the processor's equivalent safeguards.

8. How long we keep it

9. Security

Connections to the site use TLS. Account passwords are stored as salted hashes and cannot be read back. Access to the server and the database is limited to the operator.

One thing to be clear about. The server passwords and SMTP credentials we provision for you are stored in our database in a form we can read, because we have to deliver them to you. That means they are only as safe as our database. Change them as soon as you have access.

10. Your rights

Under the GDPR and similar laws you can ask for access to your data, correction, erasure, restriction of processing, a portable copy, to object to processing based on legitimate interests, and to withdraw consent. You can also complain to the data protection supervisory authority where you live.

Email support@lexlabtools.com from the address on your account. We answer within 30 days. There is no self-service export or delete button yet, so these requests are handled by hand. Erasure does not cover records we must keep by law, such as payment records.

11. Children

The services are for adults. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we delete it.

12. Changes

Changes are posted on this page with a new date at the top. For significant changes we also tell you by a notice on the site, by email, or by Telegram if you have linked the bot.

13. Contact

Questions or requests about your data: support@lexlabtools.com, Telegram @lexlabtools, or the contact form.