How we handle your personal information.

1Scope & who we are

This Privacy Policy applies to 619Labs LLC ("619Labs," "we," "us," or "our"), a California limited liability company headquartered in San Diego, California. It covers personal information we collect through our website at 619labs.com, our client portal, our customer-support channels, and the websites we design, host, and operate for our clients.

If you interact with one of our client's websites, that client is the data controller and their own privacy notice applies. We process information on their behalf as a data processor. This policy describes only the information we collect directly as a business.

2Information we collect

The categories of personal information we collect fall into four buckets:

2.1 Information you provide directly

• Contact & account information — name, business email, phone number, firm name, and role when you request a quote, sign up for our newsletter, or create a client portal account.
• Project information — content, files, branding assets, and credentials you share with us to deliver our services.
• Billing information — handled exclusively by our payment processor (Stripe, Inc.). 619Labs never stores full payment card numbers on its systems.
• Communications — copies of emails, support tickets, and portal messages.

2.2 Information collected automatically

• Device & usage data — IP address, browser type, operating system, referring URL, pages viewed, and timestamps. Collected via privacy-respecting analytics (see Section 5).
• Security telemetry — firewall events, intrusion-detection alerts, and rate-limit triggers necessary to keep our services safe.

2.3 Information from third parties

• Service providers — billing status from Stripe, deliverability data from our email infrastructure (Postmark), uptime data from monitoring providers.
• Publicly available sources — limited firmographic information (firm size, industry) used to qualify and contextualize sales inquiries.

2.4 Information we do not collect

We do not collect government identifiers, biometric data, precise geolocation, or special categories of personal data (race, religion, health, etc.). We do not run third-party advertising trackers on 619labs.com.

3How we use information

We use the information we collect to:

• Provide, operate, and maintain our services and your client portal account;
• Process invoices, payments, and account communications;
• Respond to support requests and project communications;
• Monitor service performance, detect abuse, and prevent fraud;
• Send transactional emails (account events, billing, security notices) and, with your consent, our quarterly newsletter;
• Comply with legal obligations including tax, accounting, and security incident reporting; and
• Improve our services — always using aggregated or de-identified data where feasible.

We do not use personal information for automated decision-making with legal or similarly significant effects, and we do not sell personal information.

4Sharing & third parties

We share personal information only in the limited circumstances below, and we contractually require every recipient to safeguard the information.

We never sell or "share" (as that term is defined under California law) personal information for cross-context behavioral advertising.

5Cookies & tracking

619labs.com uses only strictly necessary cookies (session, CSRF, preference) and a single privacy-respecting, cookieless analytics tool. We do not use third-party advertising or social-media tracking pixels on our website. Where we are required to obtain consent before setting non-essential cookies, we do so via an in-page banner.

You can configure your browser to refuse cookies or alert you when one is set. Refusing cookies may impact certain account functionality.

6Data retention

We retain personal information only as long as needed to fulfill the purpose for which it was collected, including legal, accounting, or reporting obligations:

• Client account & project records: for the duration of our engagement plus seven (7) years for tax and accounting purposes.
• Marketing inquiries: 24 months from last contact, then deleted or anonymized.
• Newsletter subscribers: until you unsubscribe (every email contains a one-click unsubscribe link).
• Security telemetry: 90 days, then aggregated.
• Backups: rolling 90-day encrypted backup window, then overwritten.

7Security

We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These include encryption in transit (TLS 1.3) and at rest (AES-256), multi-factor authentication on all internal systems, least-privilege access controls, continuous security monitoring, and annual third-party penetration testing.

No security control is perfect. If we ever experience a security incident affecting your personal information, we will notify you and any applicable regulators in accordance with applicable law.

8Your rights

Regardless of where you live, you can:

• Request a copy of the personal information we hold about you;
• Ask us to correct inaccurate or incomplete information;
• Ask us to delete information we no longer need (subject to legal retention obligations);
• Object to or restrict certain processing;
• Withdraw consent (where processing is based on consent); and
• Lodge a complaint with a supervisory authority.

To exercise any right, contact us at privacy@619labs.com. We respond to verifiable requests within 30 days (45 in complex cases). We will not retaliate against you for exercising any privacy right.

9California rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act and California Privacy Rights Act give you additional rights, including the right to know the specific pieces of personal information we hold, the right to delete, the right to correct, the right to opt out of "selling" or "sharing" (we do neither), and the right to limit the use of sensitive personal information (we collect none).

We have not sold or shared personal information in the preceding 12 months, and we do not knowingly sell or share the personal information of any consumer under 16.

10European rights (GDPR/UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the GDPR / UK GDPR including access, rectification, erasure, restriction, portability, and objection. Our lawful bases for processing are:

• Contract — to deliver services you have requested;
• Legitimate interests — to operate, secure, and improve our services;
• Consent — for marketing communications and non-essential cookies;
• Legal obligation — for tax, accounting, and regulatory compliance.

You may lodge a complaint with your local data protection authority. We do not currently have an EU representative because we do not target EU residents at scale; if that changes we will appoint one and update this policy.

11International transfers

619Labs is headquartered in the United States. If you access our services from outside the United States, your information will be transferred to, stored, and processed in the United States. Where required, we use Standard Contractual Clauses or other approved transfer mechanisms.

12Children's privacy

Our services are not directed to children under 16, and we do not knowingly collect personal information from children under 16. If we learn we have collected such information, we will delete it. Parents and guardians may contact us at privacy@619labs.com.

13Changes to this policy

We may update this policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we do, we will revise the "Last updated" date at the top, and for material changes we will provide additional notice (such as a banner on our website or an email to client portal account holders).

14Contact us

If you have questions about this policy, want to exercise a privacy right, or wish to file a complaint, please contact our Privacy Team. We aim to respond within five business days.