Official Website Policy

Privacy Policy for Keran Labs

Effective from: October 26, 2025

Last updated: October 26, 2026

1. Data Controller & Developer Identity

This Privacy Policy applies to the website accessible at https://keranlabs.com (the “Website” or “Service”).

The Website and Keran Labs projects are owned, maintained, and operated by Jarosław Paweł Jarosz, an individual developer operating under the brand and trade name Keran Labs (“We”, “Us”, or “Our”), located in Poland (European Union).

For any questions, data requests, or privacy concerns, please contact our dedicated email: [email protected].

2. Definitions

• Account: A secure authenticated user profile created through Auth0 to access portal features on the Website.
• Cookies: Small text files placed on your computer or mobile device to store preferences, session state, and diagnostic telemetry.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Service Providers: Third-party entities, software vendors, and platforms contracted to process data on our behalf (e.g., Auth0, MailerLite, Google).
• Usage Data: Information generated automatically through your navigation, such as your IP address, browser type, referral paths, and page response times.
• You / User: Any individual visiting, registering, or interacting with the Website.

3. Personal Information We Collect

A. Information You Voluntarily Provide

• Account Profile Data (Auth0): When you create an account on the Website, your authentication credentials (first name, last name, email address, password hash, and unique user identifier) are collected and processed via Auth0.
• Newsletter & Marketing Subscription (MailerLite): If you opt in to subscribe to the Keran Labs newsletter or product announcements, we collect your email address and first name via MailerLite.
• Direct Correspondence: If you contact us via support forms or by emailing [email protected], we collect your name, email, and message contents to respond to your inquiry.

B. Automatically Collected Usage Data & Cookies

When you visit the Website, our servers and integrated services record telemetry including:

• Your Internet Protocol (IP) address (truncated/anonymized where required by EU law).
• Browser engine, browser version, operating system, and device screen dimensions.
• Time, date, and duration of visits, along with pages viewed, referral URLs, and exit paths.

4. Authentication Services (Auth0)

We utilize Auth0 (an Okta company) as our identity and access management provider. Auth0 stores and verifies user credentials using enterprise-grade encryption and security protocols.

By creating an account on the Website, you acknowledge that your authentication data will be processed by Auth0 in accordance with their privacy standards. For details, refer to the Auth0 Privacy Policy.

5. Email Communications & Newsletter (MailerLite)

We use MailerLite to administer our email marketing campaigns and automated notification broadcasts. When you subscribe:

• Your email address and subscription timestamp are stored on MailerLite’s secure servers.
• Emails sent through MailerLite may include web beacons or tracking pixels to track aggregate open rates and link clicks, allowing us to deliver relevant content.
• Unsubscribe at any time: Every promotional email includes an unambiguous “Unsubscribe” link at the footer. You can opt out at any time with immediate effect, or by contacting [email protected].

6. Advertising and Analytics

A. Google Analytics

We use Google Analytics to examine website traffic patterns and improve our web experience. Google Analytics uses cookies to generate statistical summaries. IP anonymization is enabled by default so that your full IP address is not stored. You can prevent Google Analytics from identifying you by installing the Google Analytics Opt-out Browser Add-on.

B. Google AdSense (Display Advertising)

We display third-party advertisements via Google AdSense. Google and its ad partners use cookies to serve ads based on your visits to this and other websites across the Internet.

• In the European Economic Area (EEA) and the UK, personalized ads are served only where you have explicitly granted consent through our cookie consent banner.
• You may opt out of personalized advertising by visiting Google’s Ads Settings or via www.aboutads.info.

7. Cookies and Tracking Technologies

Our website uses Cookies to recognize your device across sessions, maintain your logged-in state, and capture aggregated analytics. We classify cookies into three categories:

• Strictly Necessary: Essential for page routing, security, and Auth0 account authentication.
• Performance & Analytics: Managed via Google Analytics to analyze navigation without directly identifying individuals.
• Marketing & Advertising: Set by Google AdSense to deliver relevant advertising based on your consent.

For complete details regarding cookie lifespans and granular controls, please review our dedicated Cookie Policy (EU).

8. Legal Bases for Processing under GDPR (EEA & UK)

If you reside within the European Economic Area (EEA) or the United Kingdom, we process your Personal Data under the lawful bases set out in Article 6 of the General Data Protection Regulation (GDPR):

• Consent (Art. 6(1)(a) GDPR): For delivering newsletters via MailerLite, placing non-essential analytics cookies, and displaying personalized Google AdSense advertising.
• Performance of a Contract (Art. 6(1)(b) GDPR): For authenticating your user Account via Auth0 and providing requested web portal tools.
• Legitimate Interests (Art. 6(1)(f) GDPR): For maintaining server security, investigating fraud, and diagnosing website performance.
• Legal Obligation (Art. 6(1)(c) GDPR): For maintaining accounting, billing, and tax records where statutory retention applies.

9. Data Subject Rights (GDPR)

Under European data protection law, you possess enforceable rights regarding your Personal Data:

• Right of Access & Portability: Obtain a copy of all personal information held about you.
• Right to Rectification: Request correction of incomplete or outdated data.
• Right to Erasure (“Right to be Forgotten”): Request complete deletion of your account and personal records.
• Right to Restrict or Object: Object to processing based on legitimate interest or direct marketing.
• Right to Withdraw Consent: Withdraw cookie or newsletter consent at any time without retroactive penalty.

Lodging a Complaint: You also have the right to lodge a formal complaint with the competent supervisory authority in Poland: Urząd Ochrony Danych Osobowych (UODO), Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

10. Account Management & Deletion Procedures

In accordance with data protection regulations and app store standards, we offer straightforward account deletion mechanisms:

• Online Deletion Request: Visit our automated deletion request portal at
  https://keranlabs.com/delete-account/.
• Direct Email: Send an email from your registered address to [email protected] with the subject line “Account Deletion Request”. Your account and associated cloud records will be removed within 30 days.

11. Children’s Privacy (COPPA & GDPR Protections)

Keran Labs recognizes the vital importance of protecting children’s privacy online, particularly for visitors under the age of 13 in the United States (under the Children’s Online Privacy Protection Act – COPPA) and children under the age of 16 in the European Union (under GDPR Article 8):

• Verifiable Parental Consent: Where users or visitors under the age of 13 (or under 16 in the EU) register for an Account or submit personal details, we require verifiable parental or legal guardian consent prior to processing.
• Limited Data Collection: We do not condition a child’s participation in any activity or game on disclosing more personal information than is reasonably necessary.
• No Targeted Advertising to Children: We do not intentionally serve personalized, behavioral tracking ads to known child users.
• Parental Rights: Parents and legal guardians can review, edit, or request the immediate deletion of their child’s personal data, or refuse further collection, by contacting us at [email protected].

12. California Privacy Rights (CCPA / CPRA & CalOPPA)

Under the California Consumer Privacy Act (as amended by the California Privacy Rights Act – CPRA) and the California Online Privacy Protection Act (CalOPPA):

• Right to Know & Access: You may request the categories and specific pieces of personal information collected over the preceding 12 months.
• Right to Delete: You can request deletion of personal information collected from you, subject to legal exceptions.
• Right to Correct: You have the right to correct inaccurate personal data.
• Opt-Out of “Sale” or “Sharing”: We do not sell your personal data for monetary compensation. Any sharing of pseudonymous identifiers via Google AdSense for cross-context behavioral advertising can be opted out of via our cookie manager or browser controls.
• Non-Discrimination: We will not discriminate against any California resident for exercising their privacy rights.
• Do Not Track (DNT) Notice: Because there is no industry consensus on how to interpret DNT signals, our website does not alter its data collection practices upon receiving automated DNT headers. You can manage tracking preferences via browser cookie settings.

13. Third-Party Service Providers

We partner with reputable infrastructure and service providers that uphold GDPR compliance and appropriate cross-border transfer mechanisms (Standard Contractual Clauses):

Service Provider	Purpose	Privacy Details
Auth0 (Okta)	Identity management & user authentication	Auth0 Privacy Policy
MailerLite	Email newsletters & announcement delivery	MailerLite Privacy Policy
Google Analytics	Aggregate web traffic telemetry	Google Privacy Policy
Google AdSense	Display ad delivery & monetization	Google Ads Privacy

14. Data Retention and Security

We retain your personal information only as long as necessary to fulfill the purposes set out in this policy:

• Auth0 Accounts: Retained while the account is active plus up to 24 months post-closure for dispute resolution and legal defense.
• MailerLite Subscriptions: Stored until you unsubscribe or request deletion.
• Analytics & Server Logs: Stored in aggregated or pseudonymous form for up to 14 months.

We implement technical and organizational safeguards (including SSL/TLS encryption and strict access controls) to prevent unauthorized access or disclosure.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When changes are made, the “Last updated” date at the top will be updated. We encourage you to review this page periodically to stay informed about how we protect your personal information.

16. Contact Us

For any questions or requests concerning this Privacy Policy, please contact:

• Data Controller: Jarosław Paweł Jarosz (operating as Keran Labs)
• Location: Poland (European Union)
• Email: [email protected]
• Website: https://keranlabs.com
• Account Deletion: https://keranlabs.com/delete-account/