Privacy policy
This explains what Pebble Labs collects about you, why, and who else touches it. The controller is Pebble Security Labs LLC, 700 Narragansett Park Drive, Suite 100, Pawtucket, RI 02861, United States.
What we collect
From signing in
You sign in with a third-party account, such as Google or GitHub, or with a link we email you. From a third-party account we receive your name, email address and profile picture. We never see its password.
From paying
Card details go to our payment processor and never reach our servers. We store your customer reference with that processor, your plan, whether the subscription is active, and when it renews.
From using the platform
- Which courses you enrolled in and which lessons you completed.
- Answers you submit to lab tasks and flag questions, how many attempts you made, and when you solved them. A correct answer is kept so the page can show it back to you later. Only you and an administrator can see it.
- Lab sessions: which lab, its status, when it was last active, and how much time is left on its session timer.
- Your VPN profile and the certificates issued to you.
- Your acceptance of these agreements: which version, when, and the IP address and browser it came from.
From lab infrastructure
We record how much network traffic a lab has, not its contents, so an idle lab can be suspended. Labs with access to a hosted AI model record usage for metering. We do not receive your prompts or the model's replies.
Why we hold it
To run your account and your labs, which is performance of our contract with you. To take payment and keep records of it, which the law requires. To keep the platform working and to investigate abuse, which is our legitimate interest in running a service that other customers can rely on.
We do not sell personal data, we do not share it with advertisers, and we do not use it to train models.
Who processes it for us
Service providers that host the platform, handle sign-in, send email, take payments and host video process data on our behalf. Our infrastructure runs in the United States, so if you are in the UK or the EEA, your data is transferred there.
How long we keep it
Account and progress data stays while your account is open. Lab machines and their contents are destroyed when a lab is torn down, which happens on request or automatically once a lab has been left long enough. Payment records are kept for as long as tax and accounting law requires, which is longer than your account may last. Ask us to close your account and we delete the rest, other than what we must keep.
Your rights
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, or object to us holding it. Write to privacy@pebblelabs.org and we will respond within 30 days. If you are in the UK or the EEA and you think we have handled this badly, you can complain to your data protection authority.
Deleting your account destroys your lab progress and solved answers, and we cannot restore them. We also cannot delete payment records we are required to keep.
If something goes wrong
If we find that personal data has been exposed or taken, we contain it first, then work out what was reached and whose it was. Where the law requires it we notify the relevant data protection authority within 72 hours of becoming aware, and where the risk to you is serious we write to you directly, telling you what was involved and what to do about it.
Cookies and analytics
Necessary cookies keep you signed in, secure sign-in, and remember your cookie choice. With your consent, analytics cookies (kept up to twelve months) show us how the site is used; nothing is collected until you accept. Cookie settings, at the bottom of every page, lists each cookie and lets you change your choice. We keep a record of your choice to show we asked. Page views and speed are also counted without storing anything on your device.
Children
The service is for adults. Anyone under 18 needs a parent or guardian to accept the user agreement for them and to take responsibility for their use of it. If we learn that an account belongs to a child with no such arrangement, we close it and delete the data.
Changes
If this policy changes in substance, the date at the bottom of this page moves and we ask you to accept the new version the next time you use the product, the same way you accepted this one.
Contact
Privacy questions go to privacy@pebblelabs.org. Anything else goes to hello@pebblelabs.org.