Privacy Policy

SDSlab.org ("SDSlab", "we", "us") operates the Sustainable Development Solutions Laboratory — a global AI platform connecting governments, investors, development banks, funds and technology vendors around the UN Sustainable Development Goals. This Privacy Policy explains how we handle personal data in connection with the Platform.

We collect the following categories of data:

• Account data: name, email address, organisation, role (government, investor, company, fund, other), country, phone and website, provided during signup.
• Authentication data: encrypted credentials managed by our authentication provider (Authorizer). We never see or store your password in plain text.
• Subscription and billing data: handled by Paddle as our merchant of record — includes billing name, email, country, VAT / tax ID where applicable and the last four digits of the card. We do not receive or store full card numbers.
• Usage data: pages viewed, countries and SDGs you select, AI briefs you generate, saved items and anonymised performance telemetry.
• Technical data: IP address, browser and device type, language preference, referrer and cookie identifiers.
• Content you submit: projects, solutions, organisations or briefs you create, edit or upload to the Platform.

We use personal data to:

• Operate, maintain and secure the Platform and its databases.
• Create and authenticate your account and associate it with your organisation or country.
• Generate AI intelligence briefs based on the country and SDG you select.
• Process paid subscriptions through Paddle, issue receipts and handle refunds.
• Communicate with you about your account, subscription, service changes, security alerts and legal notices.
• Improve the Platform — analyse usage patterns, debug issues and develop new features.
• Comply with legal obligations, including tax, accounting, sanctions screening and law enforcement requests.

Where EU/UK or similar data protection laws apply, we rely on the following legal bases: performance of the contract we have with you (to provide the Platform and process your subscription), our legitimate interests (to secure and improve the Platform), your consent (for optional cookies or marketing where applicable), and compliance with legal obligations (e.g. tax and accounting).

SDSlab uses Paddle as its merchant of record for all paid subscriptions. When you subscribe, the checkout is hosted by Paddle, and Paddle collects the personal and payment data it needs to process the transaction — including your name, billing address, email, card or wallet details, and any tax identifiers.

Paddle acts as an independent data controller for this payment data, is PCI-DSS compliant, and handles global VAT, GST and sales tax on our behalf. We receive from Paddle only the information required to recognise your subscription: customer ID, subscription status, billing country, and metadata such as plan and last payment date. Paddle's own privacy notice is available at paddle.com.

We do not sell personal data. We share it only with service providers that help us operate the Platform, and only to the extent necessary:

• Authorizer — authentication and user identity (shared database).
• Paddle — checkout, subscription billing, tax compliance and invoicing.
• Railway — hosting and database infrastructure.
• AI model providers (e.g. OpenAI) — processing prompts derived from your Platform inputs to generate intelligence briefs. We do not send account credentials or payment data to AI providers.
• Analytics and error-monitoring tools — to understand usage and fix bugs.
• Professional advisors, auditors and authorities — where required by law or to protect our rights.

SDSlab is a global Platform, and our providers may process data in jurisdictions outside your country of residence, including the United States and the European Union. Where required, such transfers are protected by appropriate safeguards such as Standard Contractual Clauses.

We keep account and profile data for as long as your account is active, plus a limited period afterwards for legal, tax and security reasons. Subscription and invoicing records retained by Paddle on our behalf are kept for the period required by applicable tax and accounting law (typically up to 10 years). Usage and technical logs are kept for a shorter period and then aggregated or deleted.

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, the right to data portability, and the right to withdraw consent. You may also lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at [email protected]. For billing-specific requests (e.g. updating a tax ID on an invoice), you may also use the Paddle customer portal linked in your receipts.

The Platform uses strictly necessary cookies to keep you signed in, remember your language preference and protect against abuse. We may also use limited analytics cookies to understand aggregate usage. Where required by law, we will ask for your consent before setting non-essential cookies.

We apply reasonable technical and organisational measures to protect personal data — including encryption in transit, role-based access controls, and regular updates of our infrastructure. No system is fully secure, however, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law.

The Platform is intended for institutional use by adults (18+). We do not knowingly collect personal data from children.

We may update this Policy from time to time. Material changes will be notified in-product or by email to account holders. The "last updated" date at the top of this page always reflects the most recent revision.

Questions, requests or complaints regarding privacy can be sent to [email protected].