Privacy Policy

Effective date: 18 October 2026

This Privacy Policy explains how Siklab Core ("we", "us", "our"), the operator of LASDK and the website at lasdk.siklabcore.com (the "Service"), collects, uses, and shares personal information, and the rights you have over it.

1. Who is responsible

Siklab Core is the controller of the personal information described here. Contact: lasdk@siklabcore.com.

2. What we collect

• Account data — your email address and a securely hashed password when you register. We never store your password in plain text.
• License & team data — your order/license identifier, organization and team name, seat count, edition, and the email addresses of teammates you add as contributors to a license.
• Purchase data — LASDK is not on sale today, so we hold no purchase data. When paid plans open, we will receive order confirmation details from our payment provider (see §5). We do not collect or store your payment card details.
• Communications — messages you send us (e.g. support requests) and the email address they come from.
• Closed-beta applications — your reply email and the four answers in the application form. We email these to Siklab using Resend so we can review the application and respond. The website does not save the answers in its database. To limit repeated submissions, Cloudflare temporarily stores a one-minute hash of the submitting network address.
• Trial records — when you start the 24-hour trial (lasdk trial), the software sends our server a public key generated on your machine, a signature proving it holds the matching private key, and, if you were given one, an invitation code (which links the trial to the email address and organization on that invitation). We keep the key's fingerprint and the trial's start and end time, so that each device gets one trial, and a count of trial starts per network address per day, to limit abuse.
• Licence activation and devices — when you run lasdk activate or lasdk device, the software sends your licence token and your machine's public key, and we keep the device fingerprint and an optional label you choose.
• Problem reports — only when you run lasdk report --send and confirm in your own terminal. The report is a short, fixed list of fields that the command shows you in full before sending (for example the LASDK version, an error code and log lines you choose, after a secret scan), signed with your device key. It never contains your source code, diffs, prompts or provider transcripts. It becomes an issue in our private GitHub repository; the raw report is kept for 30 days.
• Technical & log data — standard request logs generated by our hosting provider (IP address, user agent, timestamps) used for security, abuse prevention, and reliability.
• Cookies — a strictly necessary session cookie to keep you logged in (see our Cookie Notice).

3. What we do NOT collect

• We do not receive or store your payment card numbers — checkout and payment are handled entirely by our Merchant of Record (§5).
• The LASDK software runs locally on your own machine and does not transmit your source code, prompts, or usage data to us. Any telemetry the software produces stays on your disk unless you choose to share it.
• It does contact lasdk.siklabcore.com in these cases only, and each request carries your network (IP) address, as any internet request does: starting a trial, activating a licence or managing devices (see §2); sending a problem report you confirmed (see §2); and checking for a newer version, which lasdk doctor does at most once a day and lasdk update does when you run it. The version check sends no account, licence or device identifier; set LASDK_NO_UPDATE_CHECK=1 to turn it off.

4. How we use your information

• To create and operate your account and deliver the licenses you buy.
• To let you manage your team and seats.
• To send transactional email (license delivery, security, account, and billing notices).
• To provide support and respond to your requests.
• To secure the Service, prevent abuse and fraud, and debug problems.
• To comply with legal obligations and enforce our Terms.

We do not sell your personal information, and we do not use it for third-party advertising.

5. Payment processing (Merchant of Record)

LASDK is not on sale today, and no payment is taken. When paid plans open, payments will be processed by Paddle, which will act as the Merchant of Record and the seller of record for your purchase. Paddle will collect your payment and billing details directly, handle applicable sales tax/VAT, and send us only the order information needed to issue your license. Your payment data is governed by Paddle's own privacy policy: https://www.paddle.com/legal/privacy.

6. Service providers (sub-processors)

We share limited personal information with providers who process it on our behalf, under contract, only to run the Service:

Provider	Purpose	Data
Paddle	Checkout, payment, Merchant of Record (when paid plans open; nothing is sold today)	Purchase/billing details
Cloudflare	Hosting (Workers) + data storage (KV, D1) + CDN/security	Account, license, trial, device and log data
GitHub	Hosts the documentation site and receives problem reports as issues in a private repository	Problem report fields; standard request logs on the docs site
Resend	Transactional email delivery, including beta applications	Your email address + message and application answers

7. International transfers

We are based in the Philippines and our providers may process data in other countries (e.g. the United States and the EU). Where required, transfers rely on appropriate safeguards (such as the providers' standard contractual clauses).

8. Retention

We keep account and license data for as long as your account or license is active and as needed to provide the Service, resolve disputes, and meet legal, tax, and accounting obligations. We delete or anonymize personal information when it is no longer needed; this is done by hand today, not by an automatic job. Trial records are kept so that one device gets one trial. Raw problem reports are deleted automatically after 30 days. You can ask us to delete your information at any time (see §9).

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, export (portability), restrict, or object to our processing of your personal information, and to withdraw consent. To exercise any right, email lasdk@siklabcore.com. We will respond within the period required by applicable law.

• Philippines (RA 10173): you have rights to be informed, to access, to object, to erasure/blocking, to damages, to data portability, and to lodge a complaint with the National Privacy Commission.
• EU/UK (GDPR): the rights above, plus the right to complain to your local supervisory authority.
• California (CCPA/CPRA): the right to know, delete, correct, and opt out of "sale"/"sharing" (we do neither).

10. Security

We use industry-standard measures — hashed passwords, encrypted transport (HTTPS), access controls, and a reputable hosting provider — to protect your information. No method is perfectly secure, but we work to protect it and will notify you and the relevant authority of a breach as required by law.

11. Children

The Service is not directed to children under 18, and we do not knowingly collect their data.

12. Changes

We may update this policy. We will post the new version here with a new effective date and, for material changes, take reasonable steps to notify you.

13. Contact

Questions or requests: lasdk@siklabcore.com. Siklab Core, Philippines.