LabSpace

Privacy Policy

Effective 18 October 2026

LabSpace (www.labspaces.in, the LabSpace phone and desktop apps) is a workspace for research labs. This policy explains what information we keep, why, who can see it, and the choices you have. We wrote it in plain language; if anything is unclear, write to us.

What we collect

• Account details: your name, LabSpace handle, email address, mobile number, and your password (stored only as a secure one-way hash, never in readable form).
• Sign in with Google: if you choose it, Google tells us your name and email address and confirms the email is verified. We do not receive your Google password, contacts, files or anything else from your Google account.
• Your profile: anything you add, such as a photo, cover image, designation, expertise, education, experience and publications.
• Where you work: your institute (picked from a public list of research organisations, ror.org, or one you ask us to add), your country, and, if you give it, your department. We also record the date your account was made.
• Your lab work: what you enter or upload — protocols and notebook entries, inventory and usage logs, procurement forms (C-Forms) and vendors, samples, references and PDFs, sketches, analysis files, posts, comments and messages.
• Vendor details: the suppliers a lab records in its shared procurement (C-Form) book, with the business contact details entered for them (name, phone, email, address, GSTIN) and what the lab bought from them (number of forms, amounts and dates).
• MarketSpace orders: what you order, from which vendor, the delivery address and any note you add.
• Basic technical data: the minimum needed to keep the service working and secure, such as the time and IP address of sign-in attempts (to stop password guessing) and a daily count of whether you used LabSpace (to draw your activity graph).

How we use it

• To run LabSpace for you: sign you in, store and show your work, and send the codes and notices you ask for (for example a sign-up or password-reset code).
• To keep accounts and data secure, and to recover from mistakes (we keep backups).
• To improve LabSpace. We do not sell your information, and we do not show advertising or use advertising or analytics trackers.
• To build MarketSpace: we compile the vendors recorded in labs' shared procurement books into one vendor directory, with each vendor's contact details, how many forms name them, their total purchase value across labs and the first and last purchase dates. We use it to bring suppliers labs already trust onto MarketSpace and to contact those vendors about it. Only labs' shared books are used, never your personal workspace. We do not show one lab's purchases to vendors or to other labs; any figures shared outside LabSpace are totals across labs, with no lab or person named.

Who can see your information

• You see all of your own data.
• Your lab: things you put in a lab's shared space (its inventory, procurement, calendar, equipment bookings, lab posts) are visible to that lab's members. Your personal workspace is yours alone.
• People you share with: anything you choose to share or make public, such as a public post, a shared protocol or your public profile.
• Direct messages are end-to-end encrypted: only the people in the conversation can read them, not us. Each device makes its own key, automatically, when you sign in. One exception: if you write to someone who has no key yet (they have not signed in since chat keys were added), you may send them one first message, which is not encrypted. It is stored as plain text, so the LabSpace administrator could read it, and it is marked "Not encrypted" wherever it is shown. You can unsend it until they open Messages, and it is deleted with either person's account. Everything after it is encrypted.
• Other LabSpace members see your name, designation, photo and institute on your profile. Your department, country, email, mobile number and activity are not shown to them.
• Private profile: if you switch it on (account menu or Settings → Privacy), your public posts, their photos and your activity squares are hidden from everyone but you. Your profile and About stay visible, and your lab posts stay with your lab either way.
• A lab's page shows its name, About and who runs it to any signed-in member; the list of who is in the lab is shown only to the lab's own members.
• The LabSpace administrator can see account details (including institute, department, country and when you were last active), lab membership, posts and the compiled vendor directory, to run, secure and improve the service. Accounts and labs are removed only through the same deletion that archives them first.
• MarketSpace vendors: when you place an order, the vendor receives your name, email, mobile number, the labs you belong to, the delivery address and the items, so they can fulfil and invoice it. The people who run your labs, and the LabSpace administrator, can see orders placed by their lab's members. Vendors never see your lab's data. A vendor may also be shown counts of what is searched for or running low across labs, never with names of people or labs.
• Service providers who host and protect LabSpace for us: Zoho Catalyst (cloud hosting, database and file storage, in India), Cloudflare (network and security), Sentry (error reports, which can include technical details of the request that failed), Google (only if you use Sign in with Google), and our email provider for sending codes. They handle data only to provide their service to us.
• The law: we may disclose information if required by law or to protect people's safety.

Cookies

We use one essential cookie to keep you signed in, and your browser's local storage for preferences such as the light or dark theme. We do not use advertising or tracking cookies.

The Save to LabSpace browser extension

Save to LabSpace is an optional extension for Chrome and Edge. It does something only when you click its button. Then it reads the citation details (DOI, title and PDF link) of the page you are on, downloads that paper's PDF in your browser using your own access, and adds the paper and PDF to your LabSpace library. Your existing LabSpace sign-in is used for that; the extension stores no password, keeps no history, and sends nothing anywhere except to LabSpace, and only for the paper you chose to save. On LabSpace's own pages it marks that it is installed, so we stop offering it. It contains no analytics, advertising or tracking, and we do not sell or share what it handles. Its access to "all sites" is needed only because papers and their PDFs live on many different publishers' sites.

Keeping and deleting your data

We keep your information while your account exists. You can delete your account at any time from Settings → Account. Your account and personal workspace are then removed; records that belong to a lab (for example its procurement forms, vendors and inventory) stay with the lab, with your name taken off. A copy is archived for a short time so a mistaken deletion can be recovered; you can ask us to erase that copy as well. The vendor directory keeps a vendor while any lab's shared book still names them.

Your choices and rights

You can see and correct your information in Settings, download what you uploaded, and delete your account. You can also write to us to ask for a copy of your data, a correction, or deletion, and we will respond within a reasonable time, in line with India's Digital Personal Data Protection Act, 2023 and other laws that apply to you.

Security

Connections are encrypted (HTTPS), passwords are stored as hashes, sign-in attempts are rate-limited, and data is backed up. No online service can be perfectly secure, so please use a strong password and tell us if you notice anything wrong.

Children

LabSpace is meant for researchers and students aged 18 or over, or younger students using it under their institution's supervision.

Changes

If we change this policy we will update the date above, and tell you in the app if the change is significant.

Contact

LabSpace, founded by Sedhuraman Ezhumalai. Email support.labspace@gmail.com.