This policy explains what personal information Blackbird Lab (“Blackbird”, “we”, “us”) collects through blackbird-lab.com, why we collect it, and the choices and rights you have. It applies to this website only. Personal data we process on behalf of clients during an engagement is governed by our agreement with that client.
01Who we are
Blackbird Lab is a software engineering company that works with clients in North America and Europe. For the personal information described here, Blackbird Lab is the controller (the organization responsible for deciding how it is used). You can reach us at hello@blackbird-lab.com.
02What we collect
We keep this to what we need:
- Information you send us. When you use the contact form or email us: your name, email address, company, the engagement type you select and anything you write in your message.
- Usage data, with your consent. If you accept analytics cookies: pages viewed, referring site, approximate location (country or city, derived from your IP address), device and browser type, and how you interact with the site.
- Technical data. Our hosting provider processes standard server logs (such as IP address, time of request and user agent) to deliver the site and keep it secure.
We don’t ask for sensitive personal information, and we ask you not to include it in your message.
03How we use it, and why
- To reply to your inquiry and discuss a possible engagement. Legal basis: steps you ask us to take before entering a contract, and our legitimate interest in responding to business inquiries.
- To understand how the site is used and improve it. Legal basis: your consent, which you can withdraw at any time.
- To keep the site secure and prevent spam or abuse. Legal basis: our legitimate interest in operating a safe website.
- To meet legal obligations, such as responding to lawful requests from authorities.
We do not sell your personal information, we do not “share” it for cross-context behavioural advertising, and we don’t add you to marketing lists without your permission. Under Canadian law (PIPEDA), we rely on your consent, which is implied when you choose to contact us and express when you accept analytics cookies.
04Cookies and analytics
We use Google Tag Manager to load Google Analytics. Analytics cookies are off by default and are only set if you accept them in our cookie banner. We use Google’s Consent Mode, so until you opt in, analytics storage is denied. Advertising storage stays denied regardless of your choice. If your browser sends a Global Privacy Control signal, we treat it as a refusal.
We store your choice in your browser’s local storage so we don’t ask on every visit, and we ask again after twelve months. You can change your mind at any time: . If you withdraw consent, we remove the Google Analytics cookies from your browser.
We also store your light or dark theme preference in local storage. It never leaves your device.
05Who we share it with
We use a small number of service providers that process information on our behalf and under contract:
- HubSpot, which receives and stores contact form submissions so we can respond to them.
- Google (Tag Manager and Analytics), only if you accept analytics cookies.
- Our hosting and content providers, which serve the website and its content.
- Email and collaboration tools our team uses to reply to you and schedule calls.
We may also disclose information if required by law, or as part of a merger or acquisition, in which case this policy would continue to apply.
06International transfers
Our team works from several European countries, including countries outside the European Union, and some of our providers are based in the United States. Your information may therefore be processed outside your country. Where the law requires it, we rely on safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision, and we require providers to protect the information to the standard described here.
07How long we keep it
- Inquiries: up to 24 months after our last contact with you, unless we start working together, in which case our client agreement governs.
- Analytics data: up to 14 months, under our Google Analytics retention setting.
- Server logs: for the short period our hosting provider needs for security and operations.
08Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you;
- correct it if it’s inaccurate;
- ask us to delete it;
- object to or restrict how we use it;
- receive a copy in a portable format;
- withdraw consent at any time, without affecting earlier processing;
- opt out of the sale or sharing of personal information (we do neither).
To make a request, email hello@blackbird-lab.com. We’ll respond within the time the law requires, usually 30 days, and may need to verify your identity first. We won’t treat you differently for exercising your rights. If you’re not satisfied, you can complain to your local data protection authority, such as a supervisory authority in the EU or UK, or the Office of the Privacy Commissioner of Canada.
09Security
We protect personal information with access controls, encryption in transit and the security practices described on our Trust center. Access is limited to the people who need it to respond to you. No system is perfectly secure, but we take reasonable measures and will notify you and the authorities of a breach where the law requires.
10Children
This website is for businesses and is not directed at children under 16. We don’t knowingly collect their personal information.
11Changes to this policy
We’ll update this page when our practices change and revise the date at the top. If a change is significant, we’ll make it clear on the site.
12Contact us
Questions, requests or concerns about privacy: hello@blackbird-lab.com. Please put “Privacy” in the subject line so it reaches the right person.