labplay

Privacy Policy

Last updated: July 4, 2026

1. Who We Are

LabPlay is a video hosting, smart player, and retention analytics platform, available at https://labplay.app.

This Privacy Policy describes how we collect, use, store, share, and protect the personal data of our Users (platform customers) and Viewers (people who watch videos published by our Users), in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018 — LGPD) and other applicable regulations.

2. Data We Collect

2.1 User Data (platform customers)

When you create and use your account, we collect:

  • Full name and email address;
  • Tax ID (CPF or CNPJ), when provided for billing purposes;
  • Payment data, processed directly by our contracted payment platforms (LabConvert for domestic transactions and Paddle for international transactions) — LabPlay does not store credit card data;
  • IP address and access data (authentication logs, login date and time);
  • Platform usage data (uploaded videos, player settings, A/B experiments created, integrations activated);
  • Communications exchanged with support.

2.2 Viewer Data (collected on the User's behalf)

When a video published by a User is played on a third-party site or landing page, the LabPlay player may collect, on behalf of and under the User's instruction, the following Viewer data:

  • IP address (used exclusively for logging and content delivery security purposes);
  • UTM parameters present in the URL of the page where the player is embedded;
  • Playback behavior data: start time, percentage watched, second-by-second retention map, CTA clicks;
  • Lead capture form data, when enabled by the User in the player (Viewer's name and email);
  • Session identifiers for correlating analytics events.

The User is the data controller for Viewers' personal data. LabPlay acts as a data processor in this relationship, processing data according to the instructions and settings defined by the User.

2.3 Automatically collected data

When accessing the Platform, we automatically collect technical data such as IP address, device type, browser, operating system, pages visited, session duration, and performance data, through cookies and similar technologies.

3. Purpose of Processing

We process personal data for the following purposes:

  • Service provision: account creation and management, workspace provisioning, video hosting and delivery, analytics generation, and player features;
  • Billing and charges: subscription management, payment processing, usage limit control, and billing communications;
  • Security and fraud prevention: authentication, monitoring of unauthorized access, HLS token-based anti-download protection;
  • Customer support: handling requests, troubleshooting, and operational communication;
  • Product improvement: aggregated and anonymized usage analysis to improve Platform features;
  • Legal compliance: meeting regulatory, tax, or judicial requirements;
  • Viewer analytics (on the User's behalf): generating retention maps, counting plays and impressions, tracking UTMs, and sending events to pixels configured by the User.

4. Legal Basis (LGPD)

LabPlay's processing of personal data is based on the following legal bases under the LGPD:

  • Contract performance (art. 7, V): processing necessary to provide the services contracted by the User;
  • Legitimate interest (art. 7, IX): fraud prevention, Platform security, and product improvement, when not conflicting with data subjects' rights;
  • Legal obligation compliance (art. 7, II): meeting tax, regulatory, and judicial requirements;
  • Consent (art. 7, I): for sending marketing communications and situations where consent is expressly requested.

For Viewer data processed on the User's behalf, the User, as data controller, is responsible for ensuring the appropriate legal basis for processing, including consent when necessary.

5. Data Sharing

LabPlay does not sell personal data to third parties. We share data in the following situations:

5.1 Service providers and sub-processors

  • Supabase: database and authentication (USA, with contractual safeguards);
  • Bunny.net: video hosting and CDN delivery (European Union);
  • Vercel: web application hosting (USA);
  • Cloudflare: proxy, security, and CDN (USA);
  • Payment platforms: LabConvert (domestic transactions) and Paddle (international transactions), for billing processing.

All sub-processors are contracted with appropriate confidentiality and data protection clauses.

5.2 Integrations configured by the User

When the User enables integrations such as Facebook/Meta Pixel, TikTok Conversions API, or checkout platforms (Hotmart, Kiwify, LabConvert, ClickBank, CartPanda, Payt, and others), Viewer behavior data may be transmitted to these platforms directly from the player or via our event APIs. The User is the controller of these transmissions and must ensure compliance with the policies of each integrated platform.

5.3 Legal obligations

We may disclose personal data to comply with court orders, requests from competent authorities, or to fulfill legal obligations.

6. Cookies and Tracking Technologies

LabPlay uses cookies and similar technologies for the following purposes:

  • Essential cookies: necessary for the Platform to function, authentication, and session security. Cannot be disabled.
  • Preference cookies: store User settings (e.g., language, player preferences).
  • Analytics cookies: collect aggregated Platform usage data to improve our services.

The User can manage or block cookies through their browser settings. Blocking essential cookies may prevent the Platform from working correctly.

Players embedded on third-party sites may use session cookies for analytics control and video progress resumption. The User, when publishing the player on their site, is responsible for informing and obtaining Viewer consent when required by applicable law.

7. Data Retention

We retain personal data for as long as necessary for the purposes described in this Policy, subject to the following criteria:

  • Account data: retained while the account is active and for up to 5 (five) years after closure, to meet legal and tax obligations;
  • Viewer analytics data: retained while the User's account is active;
  • Content (videos): deleted within up to 7 (seven) days after account closure or deletion by the User;
  • Security and access logs: retained for up to 12 (twelve) months;
  • Billing and financial data: retained for the period required by Brazilian tax law (minimum of 5 years).

8. Data Security

LabPlay adopts appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or improper destruction, including:

  • Data encryption in transit via TLS/HTTPS;
  • Anti-download video protection via HLS encryption with session token-based key rotation;
  • Access control via secure authentication (Supabase Auth);
  • Row-Level Security (RLS) in the database, ensuring data isolation between workspaces;
  • Access monitoring and security logs;
  • Access to production data restricted to authorized personnel.

In the event of a security incident that may pose a risk or harm to the data subject, LabPlay will take appropriate measures and notify the National Data Protection Authority (ANPD) and affected data subjects, as required by art. 48 of the LGPD.

9. Data Subject Rights (LGPD)

Under arts. 18 to 20 of the LGPD, the data subject has the following rights, which may be exercised at any time by request to LabPlay:

  • Confirmation and access: confirm the existence of processing and obtain a copy of the personal data processed;
  • Correction: correct incomplete, inaccurate, or outdated data;
  • Anonymization, blocking, or deletion: request the anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data;
  • Portability: receive data in a structured, interoperable format;
  • Deletion: request deletion of data processed based on consent;
  • Information about sharing: obtain information about the entities with which we share data;
  • Withdrawal of consent: withdraw consent given, without affecting the lawfulness of processing carried out prior to withdrawal;
  • Objection: object to processing carried out on other legal bases, in case of LGPD non-compliance.

To exercise any of these rights, the data subject should send a request to [email protected]. We will respond within 15 (fifteen) calendar days, as required by the LGPD.

10. International Data Transfer

To provide the services, LabPlay uses partner infrastructure located outside Brazil (Supabase — USA, Bunny.net — EU, Vercel — USA, Cloudflare — USA). These transfers are carried out with appropriate protection safeguards, through specific contractual clauses and adoption of security standards compatible with the LGPD and equivalent international regulations.

By using the Platform, the User acknowledges that their data may be processed in the countries where our service providers operate.

11. Viewer Data: User Responsibility

LabPlay acts as a data processor with respect to Viewers' personal data collected through embedded players. The User is the controller of this data and is responsible for:

  • Informing Viewers about data collection, through a privacy notice on their site;
  • Obtaining Viewer consent when required by law, especially for enabling third-party tracking pixels (Facebook, TikTok, etc.);
  • Ensuring that the collection and use of Viewer data complies with the LGPD and other applicable regulations;
  • Responding to Viewer requests regarding their rights as data subjects.

LabPlay provides the User with the technical tools necessary for this management, but has no direct relationship with Viewers for purposes of fulfilling controller obligations.

12. Minors

The Platform is not intended for individuals under 18 (eighteen) years of age. LabPlay does not intentionally collect personal data from minors. If we become aware that data from minors was collected without appropriate consent, we will take appropriate measures to immediately delete that data.

13. Changes to This Policy

This Policy may be updated periodically to reflect changes in our services, legislation, or privacy practices. Material changes will be communicated to the User by email or notice on the Platform, at least 15 (fifteen) days in advance. Continued use of the Platform after the changes take effect constitutes acceptance of the new Policy.

14. Data Protection Officer (DPO) and Contact

In accordance with art. 41 of the LGPD, LabPlay designates the following communication channel for matters related to this Policy and the processing of personal data:

Email: [email protected]

For general questions about the platform, the User can contact support at [email protected].