Privacy Policy

LabChure is operated by LabGL Co., Ltd. (Chan Hyoung Lee), a company incorporated in the Republic of Korea, business registration number 374-86-02316, mail-order business report number 2026-성남수정-0755 (Seongnam City), with its registered office at B-301, 40 Geumto-ro 80beon-gil, Sujeong-gu, Seongnam-si, Gyeonggi-do, 13453, Republic of Korea (telephone +82-70-7723-8443). For the purposes of data protection law, we are the controller of the personal data described in this policy.

This policy covers three groups of people: (a) visitors to our website (labchure.com), (b) account holders who use the LabChure service, and (c) visitors who view brochures that our customers publish through LabChure (served on labchure.site or on a customer's own domain). Sections 2 (brochure inquiry forms and file download emails) and 3 describe what we collect about brochure visitors.

The content of a published brochure itself is chosen and controlled by the customer who published it. If you have questions about the content of a specific brochure, contact its publisher; if you believe a brochure violates the law or our terms, you can also contact us.

Account data. When you register with an email address we store your email, display name, and a one-way cryptographic hash of your password (PBKDF2) — we never store the password itself. When you sign in with Google, we request only the "openid email profile" scope and store the unique account identifier (subject), email address, display name, and the time the email was verified. We never receive your Google password, and we do not store Google access or refresh tokens, your profile photo, or any other Google account data.

Content you upload. Source files you upload (PDF, Office documents, images, and similar), the text and images extracted from them, and the brochures generated from them. This content is processed to produce your brochures and stored on your behalf. It may include personal data contained in your documents — you are responsible for having the right to upload it (see our Terms of Service).

Billing data. Payments are processed by Polar, our merchant of record. We never receive or store your card number or full payment details. We store your subscription or purchase status, plan, and order identifiers needed to operate your account.

Usage and log data. Standard technical logs needed to operate and secure the service (request logs, timestamps, error diagnostics), your language preference, and — for sign-in and sign-up endpoints — your IP address is used transiently for rate limiting to protect against abuse.

Sign-up record. When you create an account (with email or with Google), we store the following once, with your account: the country derived from the IP address of the sign-up request (a two-letter country code — we don't store the IP address), your device type (desktop, mobile or tablet, derived from your browser's User-Agent, which we don't store), and, when your browser provides them, the first page of our website you opened in that browser tab, the site you came from (domain only), the campaign tags in that page's address (utm_source, utm_medium, utm_campaign) and the template whose sign-up button you used. We use it to understand which pages and channels bring sign-ups. It does not change after you sign up.

AI call records. For each AI operation we record token counts, cost, latency, model used, and a hash of the output for billing and quality control. These records do not contain the text of your documents or of the generated copy.

Transactional email. We send only the following service email related to the use of an account: a verification link when you create an account; a password reset link when you request one (or, if your account signs in with Google, a notice that there is no password to reset); an invitation link when a member invites you to a workspace (including the workspace name and the inviting member's email address); a notice that a brochure generation you started has finished or failed; a notice to the workspace owner seven days before a plan we provided for a pilot ends; a request to approve publishing, sent to the workspace's owners and admins when a member asks to publish a medical brochure (including that member's name, or email address if no name is set, and the brochure name); a notice to the workspace's owners and admins when a custom domain finishes connecting (including the domain and the brochure name); a notice sent when a brochure is opened through a recipient link — the first time, or on every visit if chosen for that link — to the member who created the link, or to the workspace owner if that member has left (including the link's label and company, the device type, the country, and the first page opened; see "Recipient links" in section 3); a notice to the member who requested a library review — or to the workspace owner if that member has left — when we add the brochure to the library or decide not to (including the brochure name and, if not added, the reason; see "Brochure library (optional)" below); a notice to the workspace owner when we take down a brochure, or a photo or video in it (including the brochure name, the reason, and how to appeal); a notice to the account owner when we suspend the account or lift a suspension (including the reason and how to appeal); to someone who reports a page, a confirmation that we received the report (only if they gave an email address, and at most three a day to the same address) and, for a rights infringement report, our decision (see "Reports" below); when a visitor sends an inquiry through a published brochure, a notification to the publisher containing what the visitor entered (see "Brochure inquiry forms" above); and, when a visitor enters their email to download a file from a published brochure, a notification to the publisher with that email address and the file name (at most once in 24 hours for the same email address and brochure; see "File download emails" below). Verification, password reset and invitation links carry a short-lived signed token. We do not send marketing email, so there is nothing to unsubscribe from.

Brochure inquiry forms. When a publisher turns on the inquiry form and a visitor sends an inquiry, we store what the visitor enters — company, name, email, phone and message — with the brochure language, the page address and the time received, and deliver it to the user who published the brochure (the in-app inbox and a notification email). The publisher decides how this information is used; we store and deliver it on the publisher's behalf. We do not store IP addresses with inquiries.

File download emails. When a publisher turns on "Ask visitors for an email to download" for the Downloads section of a brochure and a visitor enters their email to download a file, we store the email address with the name of the file, the brochure language and the time received, and deliver it to the user who published the brochure (the in-app inbox and a notification email). The email is used to give the visitor the file and to let the publisher contact the visitor about these materials. The publisher decides how this information is used; we store and deliver it on the publisher's behalf. We do not store IP addresses with these emails, and we do not send email to the visitor. The same applies when a publisher turns on "Ask for an email first" for visitor PDF downloads and a visitor enters their email to download the brochure as a PDF (the file name is the name of that PDF).

Reports. Anyone can report a published brochure at www.labchure.com/report or through the link at the bottom of every published brochure. We store the address of the page, the reason, what the reporter wrote, the language of the form and the time received — plus the reporter's email address if they give one and, for a rights infringement report, their name, email address, and whether they are the rights holder or acting for them. We don't store an IP address with a report.

AI chat on our website. When you use "Ask AI" on www.labchure.com, we store your questions and the AI's answers, the page you started from, the site language, the time, and a one-way hash of your IP address that changes every day (used only to limit how many questions can be asked in a day — we don't store the IP address). To write each answer, your question and the earlier messages in the same chat are sent, together with our public pages, to the AI providers in section 6 (Anthropic, or Microsoft Azure AI Foundry on the fallback path). If you choose "Email us" in the chat, we store the email address and message you enter — and the chat, if you choose to include it — and send them to our support mailbox so that we can reply; we don't send an automatic email to that address. We use these records to answer you, to find questions our pages don't answer, and to correct wrong answers. Please don't enter personal or sensitive information in the chat.

Brochure library (optional). A published brochure appears as a card at www.labchure.com/library only when a user requests it from the publish window and we approve it. The card shows the brochure's first-screen image, title, subtitle, company name, design, languages, and address — all taken from the brochure as it is already published. We do this so that other users can browse well-made brochures and to promote the service, and we keep a record of who requested it and of our review. You can remove it from the publish window at any time, and it is also removed when you unpublish the brochure or delete the project, workspace, or account. A removed brochure leaves the library list at once; a cached page may show it for a few more minutes.

When someone views a published brochure or clicks a button on it, we record a view or click event so the publisher can see how their brochure performs. We designed this measurement to be minimal and cookie-free:

• No cookies and no third-party scripts are used on published brochures — the page is a self-contained document.
• We do not store the visitor's IP address. It is immediately converted to a SHA-256 hash using a salt that rotates daily, so the same visitor can only be recognized within a single day and never across days.
• We store the browser's User-Agent string (truncated to 400 characters), the referring URL if the browser sends one, a derived device type (desktop / mobile / tablet / bot), the brochure and language viewed, and for clicks the destination URL.
• We determine the visitor's country (a two-letter country code) from the IP address when the request arrives, using an IP-to-country database kept on our own servers. The IP address is not sent to any third party for this and is not stored. We do not collect the visitor's name or precise location (such as city or street address).
• Raw events are automatically deleted after 90 days. Only aggregated daily statistics (view counts per brochure, with no per-visitor data) are kept and shown to the publisher.
• Recipient links (paid plans). A publisher can create a separate link for each person they send a brochure to (the r value at the end of the address). When a brochure is opened through such a link, we record which link was used together with the time it was opened, the brochure language, the page opened, the device type, the country, how long the page was visible, how far it was scrolled, how long each section was in view, how many contact actions (inquiry, email, phone, web address) were clicked, and any inquiry sent from that page, and we show this to the publisher who created the link. The label, company and email attached to a link are entered by the publisher and are not shown to the recipient.
• Recipient links also use no cookies or browser storage, and we do not store the IP address. So that link previews in email and messaging apps and security scanners are not counted as views, a visit counts as opened only after the page has been visible for more than 5 seconds.
• The publisher who created a recipient link decides how its records are used and is responsible for informing the recipient (Terms of Service, section 8); we process and store these records on the publisher's behalf. For pages opened without a recipient link, we also record how long the page was visible, how far it was scrolled, and how long each section was in view; like other raw events, these are deleted after 90 days, after which only aggregated daily statistics without per-visitor data are kept.
• On labchure.com itself (our marketing pages and app) we additionally measure aggregate traffic through Vercel Web Analytics, which is also cookie-free: no analytics cookies are set, no advertising or cross-site identifiers are used, and visitors are counted from a hash derived from the request. We receive only aggregated reports — page paths, referring sites, region, device type — and cannot identify an individual visitor from them.
• Within that measurement we record a few product events that contain no personal data: that a sign-up completed, which content page it came from, and that a checkout was started. They carry no name, e-mail address, or account identifier. Published brochures are not part of this — they carry no third-party script at all.
• Inside the signed-in app (the screens you see after signing in, such as labchure.com/projects) we measure how the app is used with PostHog, hosted in the European Union (Frankfurt, Germany). We send your account identifier and workspace identifier (random IDs, not your name or e-mail address), the steps you take (for example sign-up, upload, generation, publishing and payment), the features you use (recorded only as the address pattern of the request, without IDs or content), the app screens you open (address paths without query strings), and recordings of the app screens. Session recordings mask all text and everything you type in your browser before anything is sent, and images, videos, 3D models and embedded pages are not recorded, so your uploaded materials and brochure content are not captured. PostHog sets no cookies and stores nothing in your browser, and IP addresses are discarded. You can turn this off at any time under “App usage analytics” in your account settings; once it is off, nothing about your account is sent to PostHog, and you can keep using LabChure as before. If you connect from the European Union, the European Economic Area, the United Kingdom or Switzerland, we ask you first and measure nothing until you agree; to decide whether to ask, we look up only the country of your IP address when you open the app and do not store the IP address. Nothing is measured this way on our marketing pages or on published brochures. We use this only to find where people get stuck and which features to improve.

We use the data above to: create, publish, and serve your brochures; authenticate you and keep your account secure; process subscriptions and purchases; show publishers aggregated brochure statistics and, for recipient links, the record of visits through each link; operate, debug, and improve the service; answer questions in the AI chat on our website and reply to messages sent from it; understand which pages and channels bring sign-ups; review and act on reports and let reporters know the outcome; enforce our terms; and comply with legal obligations. We use a reporter's name and email address only to handle the report and tell them the outcome, and we don't share them with the publisher of the reported page unless the law requires it.

Where the EU/UK GDPR or similar laws apply, our legal bases are: performance of our contract with you (providing the service, billing); our legitimate interests (securing and improving the service, measuring published brochures in the minimal form described in section 3, understanding where sign-ups come from (section 2), understanding how the signed-in app is used so we can improve it (section 3) for users outside the EU/EEA, the UK and Switzerland, answering questions in the AI chat on our website (section 2), preventing abuse); your consent where required (for example, signed-in app usage analytics and masked session recordings for users in the EU/EEA, the UK and Switzerland (section 3), or optional sign-in with Google); and compliance with legal obligations.

We do not sell personal data, we do not use your data for third-party advertising, and we do not use automated decision-making that produces legal or similarly significant effects about you.

LabChure's core function is to analyze the documents you upload and generate brochure copy from them. To do this, relevant parts of your content are transmitted to the AI providers listed in section 6: Anthropic and Microsoft Azure AI (text generation and review), Azure OpenAI (embeddings used for search inside your own workspace), and Azure Document Intelligence (text extraction from scanned PDFs), and Google Gemini (reading a public YouTube video you add by link). When you add a web page by link, our server fetches that one page from its address and keeps the fetched copy with your other source materials.

Questions asked in the AI chat on our website are sent to Anthropic, or to Microsoft Azure AI Foundry on the fallback path, only to write the answer (section 2).

Under the terms of these providers' commercial API data policies, content submitted through their APIs is not used to train their models.

Your content is used only to produce output for your own workspace. We do not use one customer's content to generate another customer's brochures, and we do not use your content to train models.

AI-generated output can contain errors or omissions. LabChure provides evidence-grounding and review tools, but you must review generated content before publishing it (see our Terms of Service).

We rely on a small number of service providers (processors) to run LabChure. Each processes data only as needed to deliver its part of the service, under its own data processing terms:

• Microsoft Azure (database and file storage and their backups, and backup copies of published brochures — Republic of Korea: Korea Central region, with backup copies in the Korea South region; also the Azure services listed below) — account data, uploaded content, generated brochures, analytics events.
• Azure Communication Services — delivery of the service email listed in section 2; receives the recipient's email address and the message we send. It also delivers "Email us" messages from the AI chat on our website to our support mailbox.
• Anthropic (United States) — AI text generation and review; receives relevant excerpts of your uploaded content, and questions asked in the AI chat on our website.
• Microsoft Azure AI Foundry / Azure OpenAI (United States, East US region) — fallback AI text generation (including answers in the AI chat on our website), and embeddings for search within your workspace. Claude models on the fallback path are processed by Anthropic.
• Azure AI Document Intelligence (Republic of Korea, Korea Central region) — text extraction from scanned or image-based PDF files.
• Cloudflare (global network) — hosting and delivery of published brochures (labchure.site and custom domains), including R2 object storage.
• Vercel (United States / Republic of Korea / global network) — hosting of the LabChure web application, and cookie-free aggregate website analytics (Vercel Web Analytics).
• PostHog (European Union — Frankfurt, Germany) — product analytics and masked session recordings of the signed-in app (section 3); receives account and workspace identifiers, app usage events, and screen recordings with all text and inputs masked.
• GitHub (United States) — runs the daily backup copy of published brochures; processes the files only while copying and does not store them.
• Polar (United States) — payment processing as merchant of record; handles your payment details under its own privacy policy.
• Google (United States) — optional "Sign in with Google" authentication, and reading of public YouTube videos you add by link (Gemini API — receives the video address and our instructions).
• Pixabay and Pexels (Germany, Canva Germany GmbH) — free stock photo and video search in the editor, used only when you search there; they are not our processors. Our server sends your search words to the provider you choose without any account details, and the preview images in the results load directly from the provider's servers, so the provider receives the connection information your browser sends (such as your IP address) and handles it under its own privacy policy. When you choose an item, our server downloads it from the provider and stores it in your workspace together with its source (provider, item ID, creator's name, and source page).

Our primary data storage (database and uploaded files) and its backups are located in the Republic of Korea (Microsoft Azure, Korea Central region, with backup copies in the Korea South region). To operate the service we transfer personal data to the providers below in other countries. In every case the transfer happens over the network, as needed while the service is used, and each provider commits to recognized transfer safeguards (such as standard contractual clauses) in its data processing terms.

• Anthropic, PBC (privacy@anthropic.com) — stored in the United States; processing may also take place in other locations. Relevant excerpts of your uploaded content and your brief, and questions asked in the AI chat on our website with the earlier messages in that chat — AI text generation and review, and answers in the chat. Deleted within 30 days of receipt as a rule (provider policy).
• Microsoft Corporation (privacy web form https://www.microsoft.com/privacy/privacy-support-requests · One Microsoft Way, Redmond, WA 98052, USA · +1 425 882 8080) — United States (Azure AI Foundry, East US region). Relevant excerpts of your uploaded content, and AI chat questions on the fallback path — embeddings for search within your workspace and the fallback AI text generation path (Claude models on this path are processed by Anthropic). Retained as described in its data processing terms.
• Vercel Inc. (privacy@vercel.com) — United States, Republic of Korea (Seoul region), and its global network. Connection information (such as IP address), web application requests, and brochure content being published — hosting of the web application, rendering of published pages, and cookie-free aggregate analytics. Until the processing agreement ends.
• PostHog, Inc. (privacy@posthog.com) — stored in the European Union (Frankfurt, Germany); PostHog staff and its subprocessors may view the data from other countries, including the United States, under Standard Contractual Clauses or the EU-U.S. Data Privacy Framework. This is processing entrusted to PostHog on our behalf. Legal basis under Korea’s Personal Information Protection Act: Article 28-8(1)(5) for storage in the European Union (the Personal Information Protection Commission has recognized its level of protection as equivalent) and Article 28-8(1)(3) for viewing from other countries (entrusted processing disclosed in this policy). Account and workspace identifiers, app usage events (steps, features used, app screen paths) and recordings of the signed-in app with all text, inputs, images and videos masked — measuring how the app is used so we can improve it. Usage events for 1 year and session recordings for 30 days, then deleted. You can stop this transfer by turning off “App usage analytics” in your account settings; the service works the same without it.
• Cloudflare, Inc. (dpo@cloudflare.com) — Asia-Pacific (storage) and global locations near each visitor (delivery). Published brochure files and visitors' connection information (such as IP address) — storage and delivery of published brochures. Until the brochure is removed or your account is deleted.
• Polar Software, Inc. (privacy@polar.sh) — United States. Email address, payment details collected directly by Polar on its checkout, and subscription status — payment processing as merchant of record. As described in Polar's privacy policy and statutory retention periods.
• Google LLC (googlekrsupport@google.com) — United States. The sign-in request when you choose Sign in with Google — authentication. The address of a public YouTube video you add by link, with our instructions — writing source notes from the video's speech and on-screen text (Gemini API paid service: under Google's terms, inputs and outputs are not used to improve its products and may be kept for a limited period to detect abuse). As described in Google's privacy policy and the Gemini API terms.
• GitHub, Inc. (privacy@github.com) — United States and other locations (GitHub's Azure processing locations: United States, Canada, Chile, Mexico). Published brochure files — running the daily backup copy. Processed only while copying and deleted when the job ends.

These transfers are necessary to provide the service you request, except PostHog app usage analytics, which you can turn off yourself as described above. If you do not wish your data to be transferred as described, contact support@labchure.com — note that AI processing and brochure delivery are core to the service and cannot be provided without these transfers.

We use no advertising cookies and no third-party analytics cookies anywhere — not on our website and not on published brochures. Our website analytics (section 3) is cookie-free by design, which is why you are not shown a cookie consent banner. The complete list of what we set in your browser is:

• NEXT_LOCALE (cookie, 1 year) — remembers your language choice on labchure.com.
• labchure_oauth_state (cookie, 10 minutes, HttpOnly) and labchure_oauth_rt (cookie, 5 minutes, HttpOnly) — short-lived, encrypted cookies used only during Google sign-in to protect the sign-in flow; deleted as soon as it completes.
• Browser local storage — your sign-in tokens (so you stay signed in) and your selected workspace. These stay in your browser and are removed when you sign out.
• PostHog (signed-in app only, section 3) keeps its state in page memory only — it sets no cookies and writes nothing to local or session storage.
• Browser session storage — the first page you opened in the tab, the site you came from (domain only) and the campaign tags in that page's address, kept so they can be sent with your sign-up (section 2). Session storage is cleared when you close the tab.
• Published brochures set no cookies at all.

Account data is kept while your account exists. When you delete an uploaded file in the service, the original file, its parsed text, and images extracted from it are deleted from storage. Our storage keeps a short recovery window: deleted files stay restorable for up to 7 days and are then permanently erased. Published brochures remain online until they are removed (see section 10 and our Terms). Our database is backed up for disaster recovery; backup copies are deleted automatically after at most 5 weeks (7-day point-in-time restore and weekly backups kept for 4 weeks). Published brochures are backed up daily; backup copies of files deleted from the original are erased after at most 8 days. Backup copies are kept only in the Republic of Korea (Korea Central and Korea South regions) and are used only for recovery.

Specific retention periods: raw brochure view, click, and reading-time events — 90 days, then automatically deleted (aggregated daily counts without per-visitor data are retained as statistics); app usage events and session recordings of the signed-in app (PostHog, section 3) — 1 year and 30 days respectively, then automatically deleted; sign-in refresh tokens — at most 14 days, stored only as hashes; AI call records (token counts and costs, no content) — kept for billing and accounting; brochure inquiries and file download emails — deleted together with the publisher's account. To have an inquiry or an email removed, contact the publisher who received it; records of visits through a recipient link — deleted when the publisher deletes the link, and in any case one year after the visit; recipient links (label, company, email) — deleted when the publisher deletes the link, the brochure project, or the account. To have your visit records removed, ask the publisher who sent you the link; the sign-up record — kept while your account exists and deleted with it; reports (including the reporter's name and email address) — automatically deleted three years after we close the report (or, if it is never closed, three years after we received it); the AI chat on our website (questions, answers, the daily IP hash, and "Email us" messages) — automatically deleted 90 days after they are created. The copy of an "Email us" message in our support mailbox is kept with our other customer correspondence and deleted when it is no longer needed to handle the inquiry.

When your account is deleted at your request (section 10), we delete or anonymize your personal data and content, including uploaded files and published brochures, except where we must retain records to meet legal, tax, or accounting obligations (for example, transaction records that must be kept under e-commerce and tax law, retained for the statutory period and then deleted). Payment records are held by Polar as merchant of record under its own policy. Deleting your account also ends any active subscription that day.

Subject to applicable law, you have the right to: access the personal data we hold about you; correct inaccurate data; delete your data and your account; receive a copy of data you provided (portability); restrict or object to certain processing; and withdraw consent where processing is based on consent, without affecting prior processing.

You can edit your display name, password, and language directly in account settings, and delete uploaded files in your workspace at any time. You can also delete your account yourself under Delete account in account settings — enter your password once (your account email for Google accounts) and it is deleted right away.

For everything else — including a copy of your data, any other request, or account deletion if you cannot use account settings — contact us at support@labchure.com. We may need to verify your identity (normally by confirming control of the account email). We respond without undue delay and at the latest within 30 days.

Exercising your rights is free of charge, and we will not discriminate against you for doing so.

Republic of Korea. This policy serves as our privacy notice under the Personal Information Protection Act (PIPA). Sections 2–3 describe the items collected, section 4 the purposes, section 9 the retention periods, and sections 6–7 the entrusted processing and overseas transfers. If a dispute is not resolved with us directly, you may contact the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972) or the KISA Privacy Report Center (privacy.kisa.or.kr, 118).

EEA and United Kingdom. The legal bases in section 4 apply to you. You also have the right to lodge a complaint with your local supervisory authority (or the UK ICO). International transfers are described in section 7.

California. We collect the categories of personal information described in sections 2–3 for the purposes in section 4. We do not sell personal information and do not share it for cross-context behavioral advertising, and we have not done so in the preceding 12 months. You have the rights to know, delete, correct, and to non-discrimination, exercisable as described in section 10 (including through an authorized agent).

We protect data with measures appropriate to a service of our size, including: encryption in transit (TLS) for all connections; encryption at rest provided by our cloud storage providers; one-way hashing of passwords (PBKDF2) and of stored sign-in tokens; workspace-level isolation so one customer's content is not visible to another; least-privilege access to production systems; rate limiting of sign-in endpoints; and analytics that never store raw IP addresses (section 3).

Authorized operators access your content (including the files you upload) and your inquiry and recipient-link records only when needed for customer support, to check a possible breach of our Terms, or to respond to a request under law. Each access is logged with its reason, and we keep these logs for at least one year.

No online service can guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the competent authorities as required by law.

LabChure is a business tool for professional use and is not directed at minors. You must be at least 18 years old — or the age of majority where you live, if that is higher — to use it. We do not knowingly collect personal data from anyone below that age; if you believe a minor has provided us data, contact us and we will delete it.

Privacy officer (Chief Privacy Officer under Korean law): Chan Hyoung Lee, support@labchure.com.

LabGL Co., Ltd. · Representative: Chan Hyoung Lee · Business registration no.: 374-86-02316 · Mail-order business report no.: 2026-성남수정-0755 (Seongnam City) · B-301, 40 Geumto-ro 80beon-gil, Sujeong-gu, Seongnam-si, Gyeonggi-do, 13453, Republic of Korea · Tel: +82-70-7723-8443 · support@labchure.com

We will update this policy when our data practices change, and post the revised version on this page with a new effective date. For material changes we will give prominent notice on our website before the change takes effect.

This version is effective as of October 26, 2026 and replaces the version dated October 20, 2026.