Privacy Policy
1. Controller
Metal Contact Ltd., UIC 131204817, VAT No. BG131204817, Bulgaria, Sofia 1680, 39 Pirinski Prohod Str., is the controller for account, commercial, support and security data processed for Corporate Debt Lab. Contact: support@corporatedebtlab.com.
2. Data processed
We process organization and contact details, account identifiers, authentication and security records, subscription and billing information, support communications, portfolio information supplied by authorized users, customer decisions, execution evidence and technical audit records. Passwords are stored as cryptographic hashes, not readable passwords.
3. Purposes and legal bases
Data is processed to create and administer accounts, provide the service, preserve governed decision evidence, secure and support the platform, bill paid subscriptions, comply with legal obligations and establish or defend legal claims. The legal bases are contract performance, legal obligation and legitimate interests in security, support, auditability and service protection. Consent is used only where specifically requested and appropriate.
4. Recipients and processors
Access is limited to authorized Metal Contact Ltd. personnel and contracted service providers needed for hosting, email delivery, payment processing, backup, monitoring and support. Hosting is provided by Hetzner. When card billing is activated, Stripe processes payment information; card details are entered through Stripe rather than stored by Corporate Debt Lab. The assistant-support processing described below may use OpenAI. Information about the service providers relevant to your data, processing locations and applicable transfer safeguards can be requested from support@corporatedebtlab.com. We do not sell personal data.
5. Retention
Deleted customer records have a 30-day recovery period. Closed-account personal data is scheduled for deletion or anonymization after 30 days where no lawful exception applies. Financial and invoice records are retained for 10 years; audit and security records for 6 years; local backups rotate after 35 days. Legal, dispute and incident holds suspend erasure only for affected records.
6. Rights
Subject to applicable law, individuals may request information, access, correction, erasure, restriction, portability or objection. Requests may be sent to support@corporatedebtlab.com. Identity may be verified before action. Individuals may also complain to the Bulgarian Commission for Personal Data Protection or another competent supervisory authority.
7. Security
Controls include role-based access, password hashing, session controls, audit trails, protected backups and controlled retention. No system can guarantee absolute security; suspected incidents should be reported promptly through the support address.
8. International transfers
Information about any processing outside the EEA, the applicable transfer mechanism and how to obtain a copy of relevant safeguards is available on request at support@corporatedebtlab.com.
9. Automated analysis
The platform analyses corporate debt structures and produces governed recommendations. It does not make solely automated decisions that create legal or similarly significant effects for individual persons. Customer users remain responsible for treasury decisions.
10. Changes
Material changes will be versioned and presented before they become effective. The acceptance record must identify the applicable Terms and Privacy versions.
Assistant support workflow · 12 September 2026
Assistant question text, the last conversation turns and owner-approved support replies are retained in the active support database for 30 days to resolve customer requests. Unresolved questions are made available to the owner with a proposed reply. Only an explicit owner approval publishes that reply in the requesting customer account. Approved knowledge and the support conversation may be processed by OpenAI to prepare explanations and proposals within configured limits. Uploaded files are not retained by this workflow. Usage and approval metadata are recorded for accountability. Expired text is removed from the active support database; protected backups follow their separate retention schedule.
First-party audience and usage measurement · 25 September 2026
We measure page visits, visible landing sections, report-link clicks, guided-access enquiries and selected account operations to understand interest in the service and improve it. We also derive an approximate country code locally using the DB-IP country database; visitor IP addresses are not sent to an external geolocation service. Country reflects the network location and may differ from the visitor’s physical location. Measurement records contain country codes, event names, approved page or report identifiers, campaign labels and timestamps. IP addresses and browser user-agent strings are used transiently to derive a keyed daily visitor identifier; neither raw value is stored in this analytics database. Daily identifiers expire across days. Account activity uses a pseudonymous account identifier. We do not record screen sessions, form contents, financial inputs, passwords or authentication tokens in analytics.
These measurement records are retained in the active analytics database for 90 days and are available only to the owner through MFA-protected administration. No analytics tracking cookies or browser storage are used. Do Not Track and Global Privacy Control are respected. A separate preference cookie is used when an administrator explicitly excludes a testing browser. Backups follow the separate retention schedule described above. You may contact support@corporatedebtlab.com about measurement and data rights.