ARBH Labs
Data Protection / Datenschutz (Art. 13 GDPR)

Privacy Policy

We believe your health data and routines belong exclusively to you. Local-first architectures, zero telemetry, and transparent data processing.

1. Controller (Verantwortlicher)

The data controller responsible for the processing of personal data on this website and in relation to ARBH Labs applications in accordance with Art. 4 No. 7 GDPR is:

Aaron Haug
ARBH Labs
Germany
E-Mail: arbhlabs@gmail.com

2. Local-First Application Architecture (Zero Telemetry)

Our Android applications, including LastDose and PulseTrace, are engineered from the ground up on a strict local-first, zero-knowledge architecture:

  • Zero Cloud Sync / Zero Server Database: All medication logs, vital entries, timers, and camera-based PPG pulse/respiration estimates are processed and stored exclusively inside encrypted local SQLite vaults on your Android device.
  • Zero Tracking SDKs: We do not integrate third-party analytics SDKs, advertising trackers, user telemetry tools, or behavior profiling systems (e.g., no Google Analytics, no Firebase Analytics, no Mixpanel, no Facebook SDK).
  • Self-Contained On-Device DSP: PulseTrace processes camera and microphone biosignals 100% on your device hardware without transmitting raw video, audio, or biometric streams to external servers.
  • Encrypted Backups & Peer Sharing: Any backup or sharing action is initiated exclusively by you as an encrypted file export. ARBH Labs possesses no encryption keys and cannot access your local vault data.

3. Website Hosting & Server Log Files

When you visit our website, our hosting and content delivery provider (Cloudflare Pages / Cloudflare, Inc.) automatically collects and processes technical log data transmitted by your browser. This includes:

  • Browser type and version
  • Operating system
  • Referrer URL
  • Host name of the accessing device (IP address)
  • Time and date of the server request

Legal Basis: Processing is carried out pursuant to Art. 6(1)(f) GDPR on the basis of our legitimate interest in the technically error-free delivery, stability, and security of our web infrastructure (e.g. defense against DDoS attacks). Server log files are deleted or anonymized automatically according to industry standard retention periods.

4. Self-Hosted Fonts & Zero External Assets

To protect your privacy and ensure compliance with European data protection regulations, all typography (including Instrument Sans and Newsreader) is hosted locally on our own servers in the /fonts/ directory. No requests or IP addresses are transmitted to Google Fonts or external CDN providers.

5. Payment Processing & Merchant of Record (Lemon Squeezy)

To process payments, license fulfillment, and statutory tax compliance (such as EU VAT / OSS calculation), we use Lemon Squeezy (Lemon Squeezy, LLC, 222 S. Main Street, Suite 500, Salt Lake City, UT 84101, USA) as our Merchant of Record.

When you purchase a license, subscription, or course offer, your transaction and billing data (such as name, email address, payment method details, and billing address) are processed directly by Lemon Squeezy in accordance with their Privacy Policy.

Legal Basis: Processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR), as well as compliance with statutory tax and accounting obligations (Art. 6(1)(c) GDPR).

6. Cookies and Tracking Technologies

Our website does not use tracking cookies, marketing pixels, or third-party profiling mechanisms. Session storage is utilized only when necessary to preserve pending checkout state or local UI preferences. No cookie consent banner is required as no non-essential cookies are set.

7. Your Rights Under the GDPR

As a data subject located in the European Union, you have the following rights under the GDPR regarding your personal data:

  • Right of Access (Art. 15 GDPR): You have the right to request confirmation as to whether personal data concerning you is being processed and to receive information about that data.
  • Right to Rectification (Art. 16 GDPR): You have the right to demand the immediate rectification of incorrect personal data or completion of incomplete personal data.
  • Right to Erasure (Art. 17 GDPR): You have the right to request the deletion of your personal data, provided statutory retention requirements do not apply.
  • Right to Restriction of Processing (Art. 18 GDPR): You have the right to demand restriction of processing of your personal data under certain conditions.
  • Right to Data Portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
  • Right to Object (Art. 21 GDPR): You have the right to object at any time to the processing of your personal data which is based on Art. 6(1)(f) GDPR.
  • Right to Lodge a Complaint (Art. 77 GDPR): You have the right to lodge a complaint with a competent data protection supervisory authority.

To exercise any of these rights, please contact us at: arbhlabs@gmail.com.

8. Updates to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our legal obligations or technical architectures. The current version is always accessible at this URL.

Last updated: September 2026