Skip to content
Covariance Labs

Privacy policy

What we store, why, who handles it, how long we keep it, and what you can do about it.

Version 2026-10-21

1. Who is responsible

Covariance Labs is a product of Squircle OÜ, the “controller” of your personal data: we decide why and how it is used. Contact us about anything on this page at squircleai@gmail.com.

Squircle OÜ

  • Registry code: 17168117
  • Address: Ahtri tn 12 15551 Tallinn EE
  • VAT number: EE102966246

2. What we collect, why, and on what legal basis

  • Account: your email address (and, if you sign in with Google, the name and address Google shares). Used to create your account, sign you in and send service messages. Basis: performing our contract with you.
  • Your experiments: names, factors, run sheets and results you enter. Used to provide the service. Basis: contract. Only your account can read them (enforced by the database).
  • Your plan and usage: your plan, how many experiments you have stored, and your monthly count of AI designs, to apply the plan limits. Basis: contract.
  • Payments: if you subscribe, our payment provider Stripe collects your card details and billing details; we never see or store your card number. We store only Stripe's customer and subscription identifiers, your plan, renewal date, and a record of when you accepted the Terms at checkout and which version. Basis: contract, and our legal obligation to keep accounting records.
  • AI step: the text you type to describe an experiment is sent to our AI provider to propose factors (section 5). Basis: contract.
  • Security and abuse prevention: network (IP) addresses and request counts are used briefly to stop abuse and enforce rate limits, and our host and providers keep technical logs. Basis: our legitimate interest in keeping the service secure.
  • Emails we send you: sign-in links, a welcome after you subscribe, and notices about your plan ending. These are service messages, not marketing; we send no marketing email. Basis: contract.

3. The free design generator and guides

The guides, glossary and free design generator need no account. The generator runs entirely in your browser: what you enter is not sent to us.

4. Who else handles your data

We use these service providers (“processors”), who may only use your data to provide their service to us:

  • Supabase: database and sign-in. Region: Ireland (European Union).
  • Anthropic: the AI step (section 5).
  • Stripe: payments, invoices and receipts. Stripe also acts on its own account as a controller for payment-fraud and regulatory purposes.
  • Resend: delivery of our emails, including sign-in links.
  • Google: only if you choose “Continue with Google”.
  • Hosting provider: serving the site (Vercel).

We do not sell your data, and we do not use advertising or cross-site tracking.

5. The AI step, and transfers outside the EU

When you describe an experiment in plain English, that text is sent to Anthropic's API, which returns suggested factors and ranges. We do not send your experiments, results or email address with it. The suggestion is only a starting point that you review and edit; nothing is decided about you by automated means. Avoid putting confidential information in that text; the rest of the app works without the AI step.

Some of our providers are based in, or process data in, the United States. Where personal data is transferred outside the European Economic Area we rely on an adequacy mechanism or safeguard: the EU-US Data Privacy Framework (Stripe is certified under it) and/or the EU Standard Contractual Clauses in our agreements with each provider.

6. How long we keep it

  • Account, experiments, plan and usage: until you delete them or your account. Deleting your account removes them from our database straight away.
  • Payment and invoice records: Stripe and we must keep these for accounting and tax law, typically for several years . After you delete your account they are kept only for that purpose.
  • Technical logs and rate-limit data: kept briefly and not linked to your account in our database.
  • Backups: deleted data leaves backups on the provider's normal cycle .

7. Your rights

Under the GDPR you have the right to:

  • Access your data and get a copy, and data portability: use Download my data under Account and usage for a machine-readable file.
  • Erasure (“be forgotten”): use Delete my account in the same place. It cancels any paid plan, deletes your experiments and account, and cannot be undone.
  • Rectification: correct anything that is wrong. You can edit experiments yourself; to change your sign-in email, contact us.
  • Restriction of processing, and objection to processing based on our legitimate interests.
  • Withdraw consent at any time where we rely on it (for example, by not using Google sign-in).
  • Complain to a data protection authority. For us this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), or the authority in the country where you live or work.

To use a right the self-service tools do not cover, write to squircleai@gmail.com from your account email. We answer within one month. We may ask you to confirm who you are first.

8. Cookies and local storage

We use only what the service needs, so no cookie banner is needed:

  • Sign-in cookies from our authentication provider, to keep you signed in.
  • A short-lived cookie (about 30 minutes) that remembers which page you were going to when you signed in.
  • Local settings in your browser (for example whether the sidebar is collapsed, and an unfinished experiment draft). They stay on your device.

Stripe's payment page and Google's sign-in page set their own cookies under their own policies. We do not use analytics, advertising or tracking cookies.

9. Security

Data is encrypted in transit; each account's data is isolated by database access rules that are tested; payment details never reach our servers; and access to our systems is limited to what is needed. No system is perfectly secure. If a breach affects your rights we will tell you and the authority as the law requires.

10. Children

Covariance Labs is made for professionals and students and is not directed at children. If you believe a child has an account, contact us and we will delete it.

11. Changes

We will update this page when our practices change and show the version date above. For significant changes we may also tell account holders by email.

12. Contact

Questions, requests and complaints: squircleai@gmail.com.