Privacy Policy

1. Introduction

Libero Labs, Inc. ("Libero Labs," "we," "us," or "our") provides Limen, a data contracts and integrity middleware platform, along with our website located at liberolabs.ai (collectively, the "Services"). This Privacy Policy describes how we collect, use, disclose, and protect personal information when you visit our website, communicate with us, or use the Services.

This Policy does not apply to data our customers process through the Limen platform ("Customer Data"). Limen is deployed inside the customer's own environment, and Customer Data does not leave it: in the ordinary operation of the Services, Libero Labs does not receive, store, or have access to Customer Data. Our obligations with respect to Customer Data, including any access granted to us for support purposes, are governed by our customer agreements. If you have questions about how a Libero Labs customer handles your information, please contact that customer directly.

2. Information We Collect

Information you provide to us

• Contact information, such as name, email address, company name, job title, and phone number, when you request a demo, contact us, or correspond with us.
• Business communications, such as the contents of emails, support requests, and sales conversations.

Information collected automatically when you visit our website

• Aggregate usage data, such as pages visited and referring pages, collected through Cloudflare Web Analytics as described in Section 8.
• Connection data, such as IP address and browser type, processed by our hosting and content delivery providers in the ordinary course of serving the site.

Information we do not collect

Libero Labs does not operate a hosted or multi-tenant version of Limen and does not provide user accounts. Limen is installed and run by the customer within the customer's own environment. The software sends no usage data, telemetry, analytics, error reports, license checks, or update checks to Libero Labs. Records that Limen generates in operation, including authentication events and user activity, are written only to destinations the customer configures and are not transmitted to us.

3. How We Use Information

We use personal information to:

• Provide, operate, maintain, and secure the Services.
• Respond to inquiries, provide customer support, and correspond with you about the Services.
• Send transactional and administrative notices, including security notices.
• Analyze aggregate website usage in order to improve the site.
• Detect, investigate, and prevent security incidents, fraud, and abuse.
• Comply with legal obligations and enforce our agreements.

Where required by applicable law (such as the EU or UK GDPR), we rely on legal bases including performance of a contract, our legitimate interests, your consent, and compliance with legal obligations.

4. How We Share Information

We do not sell personal information. We share personal information only as follows:

• Service providers and subprocessors that perform services on our behalf. Our current service providers and subprocessors for the personal information covered by this Policy are GitLab (source control and website hosting), Cloudflare (website analytics), Formspree (contact form handling), Google (Workspace email and collaboration, and reCAPTCHA spam prevention on our contact form), Slack (team communication), and Drata (compliance management).
• Professional advisors, such as lawyers, auditors, and accountants, where necessary.
• Legal and safety purposes, when we believe disclosure is required by law or appropriate to protect the rights, property, or safety of Libero Labs, our customers, or others.
• Business transfers, in connection with a merger, acquisition, financing, or sale of assets, subject to confidentiality protections.
• With your direction or consent.

Changes to our subprocessors. Adding a new subprocessor, or replacing one, is a change to this Policy, and it takes effect when the new or replacement subprocessor begins processing personal information. We will update the list above with a new effective date before the change takes effect, so that every change to the list is published. Where the change affects personal information we process for a customer, we will also notify that customer directly, at the contact address we hold for it under its agreement with us, at least thirty (30) days beforehand. That customer may object by writing to info@liberolabs.ai within the notice period, stating the reason. We will work with that customer in good faith to address the objection, including by considering an alternative provider or an arrangement that excludes its information from the new subprocessor. If we cannot address the objection, the customer may terminate the affected Services before the change takes effect. Because Limen is installed and operated in the customer's own environment, no subprocessor processes Customer Data in the ordinary operation of the Services, as described in Section 1; the personal information this Section concerns is the information described in Section 2.

5. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, including maintaining business records, complying with legal obligations, resolving disputes, and enforcing agreements. Retention periods vary based on the type of information and the context in which it was collected. When personal information is no longer needed, we delete or de-identify it in accordance with our data retention procedures.

6. Security

We maintain a written information security program with administrative and technical safeguards designed to protect personal information, including access controls, multi-factor authentication, encryption of data in transit and at rest, personnel security training, and vulnerability management. Libero Labs operates no data center or company facility; personnel work remotely on devices governed by our asset management and access control policies. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

7. Your Rights and Choices

Depending on your location, you may have rights regarding your personal information, which may include the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate personal information.
• Request deletion of your personal information.
• Object to or request restriction of certain processing.
• Receive a copy of your personal information in a portable format.
• Ask us to stop sending you communications at any time by contacting us.
• Withdraw consent where processing is based on consent.

To exercise these rights, contact us using the information in Section 12. We will respond in accordance with applicable law and may need to verify your identity before fulfilling your request. You also have the right to lodge a complaint with a data protection authority if applicable in your jurisdiction. We do not discriminate against individuals for exercising their privacy rights.

8. Cookies and Tracking Technologies

We do not set cookies for analytics, advertising, or preference tracking. We use Cloudflare Web Analytics to understand aggregate site usage; it uses no cookies or browser storage and does not track visitors across sites.

Two third-party services used on specific pages do interact with your browser directly. Our contact form uses Google reCAPTCHA to prevent automated submissions; Google sets its own cookie and collects device and interaction data, governed by Google’s Privacy Policy and Terms of Service. Submissions from that form are transmitted to and stored by Formspree, our form-handling provider, and are also delivered to us by email.

We use no advertising, marketing, or cross-site tracking technologies.

9. International Data Transfers

We are based in the United States and may process information in the United States and other countries where we or our service providers operate. Where required, we use appropriate safeguards for cross-border transfers, such as standard contractual clauses.

10. Children's Privacy

The Services are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us and we will delete it.

11. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by posting the updated Policy with a new effective date and, where appropriate, providing additional notice. Your continued use of the Services after changes take effect constitutes acceptance of the updated Policy. A change in our subprocessors is subject instead to the advance notice and objection process in Section 4, and continued use of the Services during that notice period is not acceptance of the change.

12. Contact Us

If you have questions about this Policy or our privacy practices, contact us at:

To report a security vulnerability or suspected incident, email security@liberolabs.ai. We acknowledge reports of this kind within five business days. Please include the details of your report in the body of your message; we do not open unsolicited attachments.