Privacy policy.

This policy explains how 100xLab ("we", "us") handles personal data when you visit 100xlab.com or contact us. 100xLab is a launch studio operated by Deb Pradhan, based in India.

For the purposes of data protection law, we are the controller (the "data fiduciary" under India's Digital Personal Data Protection Act, 2023) of the personal data described here.

This policy covers our website and enquiries. When we work for a client, how we handle data inside that project is set out in our contract with that client.

Data you give us, through the contact form or by writing to us:

1. 01Your name and work email.
2. 02Your company or product name and website.
3. 03What you are launching, your stage, the services you are interested in and your timeline.
4. 04Anything else you choose to write to us.

Chat messages: if you use the Ask the lab assistant, the messages you type in that conversation.

Data collected automatically when you visit:

1. 01Technical data our hosting provider records to deliver and protect the site: IP address, browser and device type, the page requested, the referring page and the time. These logs are kept briefly and used for security and reliability.
2. 02Analytics data, only if you switch analytics on (Google Analytics): pages viewed, time on page, how far you scroll, which sections and cards you look at, which links and buttons you use (such as booking a call), how the contact form is filled in (which fields, never what you type), the topic of a question asked to Ask the lab (never the question), technical errors and page speed, approximate location (country or city level), device type and how you arrived. We do not send your name, email or anything you type to analytics.

Data stored on your own device: the small preference items listed in our Cookie Policy (your cookie choices, light or dark mode, and whether the opening animation has played). These stay in your browser; we do not receive them.

We do not use your data for automated decisions that have legal or similarly significant effects on you, and we do not use it to train AI models.

We will send you marketing emails only if you ask for them. Every such email will include a way to stop them.

We do not sell personal data, and we do not "share" it for cross-context behavioural advertising as those terms are defined under California law. We share it only with:

1. 01Service providers who help us run the studio, such as website hosting, email, scheduling and (if you consent) analytics (Google). They process data only on our instructions and under contracts that require them to protect it.
2. 02Specialists who work on a project with us, only where you become a client and only what they need, under confidentiality obligations.
3. 03Professional advisers (lawyers, accountants) under a duty of confidentiality.
4. 04Authorities, where the law requires it or to protect our rights, safety or property.
5. 05MiniMax, the AI provider that generates Ask the lab answers. Messages are sent only when you use the chat, are not stored by us, and are processed under MiniMax's terms.
6. 06A successor, if the studio or its business is reorganised, merged or sold, subject to this policy.

A current list of our main service providers is available on request.

We are based in India and work with clients worldwide, so your data may be processed in India and in other countries where our service providers operate, such as the United States or the European Union. Where the law requires it (for example for data from the EU, UK or UAE), we use recognised safeguards such as Standard Contractual Clauses and check that our providers protect the data to an equivalent standard. We will not transfer data to any country the Government of India has restricted under the DPDP Act.

Messages you type into the Ask the lab chat are sent to MiniMax, our AI provider, and are processed in the countries where MiniMax operates, under MiniMax's terms. Do not include personal or confidential details in the chat.

When data is no longer needed, we delete it or make it anonymous.

Depending on where you live, you have some or all of these rights. We extend the core rights to everyone, wherever you are:

1. 01Access: ask for a copy of the personal data we hold about you and how we use it.
2. 02Correction: ask us to fix data that is wrong or incomplete, or to update it.
3. 03Deletion: ask us to erase your data where we no longer need it or you withdraw consent.
4. 04Withdraw consent: change your cookie choices at any time from "Cookie settings" in the footer, or tell us to stop using data we hold on the basis of consent. This does not affect what we did before.
5. 05Object or restrict: object to use based on our legitimate interests, or ask us to limit use while a concern is resolved.
6. 06Portability: receive data you gave us in a common, machine-readable format.
7. 07Opt out of sale or sharing (California): we do not sell or share personal data, and we honour Global Privacy Control signals automatically.
8. 08Nominate (India): nominate another person to exercise your rights if you die or become incapable.
9. 09No discrimination: using your rights will never change how we treat you.

To use any right, use the contact form at 100xlab.com/contact. We may ask for information to confirm your identity. We reply within 30 days, and sooner where the law requires. You can also use an authorised agent; we may ask them for proof of authority.

Our Grievance Officer under India's DPDP Act is Deb Pradhan. To raise a concern, use the contact form at 100xlab.com/contact. We aim to resolve grievances within 30 days.

If you are not satisfied, you may complain to your data protection authority: in India, the Data Protection Board of India; in the EU, your local supervisory authority; in the UK, the Information Commissioner's Office; in Singapore, the Personal Data Protection Commission; in the UAE, the UAE Data Office. We would appreciate the chance to fix things first.

We use reasonable technical and organisational measures to protect personal data: encrypted connections (HTTPS), access limited to the people who need it, two-factor authentication on our accounts, and reputable providers. No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authorities as the law requires.

This site and our services are for businesses and are not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has sent us data, tell us and we will delete it.

We will update this policy when our practices or the law change, and change the date at the top. If a change materially affects how we use data you have already given us, we will tell you before it applies, and ask for consent where required.