Joy Labs Ventures, LLC, doing business as Laneful (“Laneful,” “we,” “us,” or “our”), provides email-delivery infrastructure and related services to business customers. This Privacy Policy (“Policy”) describes how Laneful collects, uses, discloses, and otherwise processes personal information in connection with:
Our Services are designed for use by businesses, not consumers. We may nonetheless process personal information relating to website visitors, prospective and current customer personnel and account administrators, individuals who communicate with us, and other individuals whose information is provided to us. Certain rights described in this Policy, including under U.S. state privacy laws, may apply to those individuals depending on where they live and the circumstances of the processing.
When our business customers use the Services to send email and transmit information about their end users or recipients through the Services, Laneful processes that information on the customer’s behalf as a “service provider” or “processor.” Our processing of that information is governed by the Laneful Data Protection Addendum (the “DPA”) and the customer’s agreement with us. If you are an end user or recipient of a Laneful customer and you have questions about how your information is used, please contact that customer directly; they are the controller of that information. Section 10 of this Policy explains how we handle rights requests in that situation.
The categories of personal information we collect depend on how you interact with us and the Services.
We collect personal information you provide directly, such as when you create an account, request information, enter into a contract, contact customer support, or communicate with us. This may include:
When you visit our Sites or use the Services, we automatically collect certain information about your device and interactions, including:
Customer Data. Our business customers transmit information about their end users, recipients, contacts, and similar individuals through the Services. This information is “Customer Data.” We process Customer Data on the customer’s behalf and in accordance with the DPA. The categories of Customer Data depend on what the customer chooses to transmit through the Services.
Payment information. When you or your organization pays for the Services, payment card or bank information is collected and processed by our payment processor, Stripe, not by Laneful. We receive limited billing metadata from Stripe (such as whether a charge was successful).
Other third-party sources. From time to time we may obtain business contact and lead information about prospective customer personnel from referral partners, event and conference organizers, publicly available sources, and CRM or sales-intelligence enrichment providers. We use this information for sales, marketing, and relationship-management purposes consistent with this Policy.
Laneful does not knowingly collect the following categories of personal information from individuals who interact with the Sites or the Services:
The only category of “sensitive personal information” within the meaning of the California Consumer Privacy Act, as amended (the “CCPA”), that Laneful collects is account log-in credentials, which we collect and use solely to authenticate users and operate and secure the Services.
We use personal information for the following business and commercial purposes:
For Customer Data, Laneful uses the information only to provide the Services to the applicable customer and on the customer’s documented instructions, as set forth in the DPA.
Customer responsibility for Customer Data. Our business customers determine and control the categories of personal information they transmit through the Services as Customer Data and are responsible for ensuring they have all necessary rights, permissions, lawful bases, and notices required to provide that information to Laneful for processing under the DPA.
No AI training on generalized models. Laneful does not use personal information or Customer Data to train generalized artificial intelligence or machine-learning models, except as needed to operate, improve, test, monitor, and evaluate our support, chat, deliverability, abuse-detection, and related safety and security features as described in this Policy.
No sale, sharing, or targeted advertising. Laneful does not sell personal information or share personal information for cross-context behavioral advertising, and does not engage in targeted advertising, as those terms are defined under applicable U.S. state privacy laws. Laneful may, however, send ordinary B2B marketing or product communications to business contacts consistent with applicable law and your communication preferences. See Section 15 for how to opt out of marketing communications.
Service and administrative communications. Regardless of your marketing preferences, we may send you transactional, security, support, account, billing, legal, and other administrative communications relating to your use of the Services or our relationship with you.
Abuse, fraud, and deliverability enforcement. Because Laneful provides email-delivery infrastructure, we process personal information as necessary to detect, investigate, and prevent spam, fraud, abuse, and other harmful or unlawful activity; to enforce our Acceptable Use Policy, Terms of Service, and other agreements; to handle complaints; to enforce sender and recipient suppression and unsubscribe obligations; and to meet deliverability and security requirements imposed by mailbox providers, regulators, and other third parties.
De-identified and aggregated information. We may create and use aggregated, statistical, de-identified, or anonymized information for analytics, benchmarking, product development and improvement, security, abuse detection, research, and other business purposes, and may disclose such information to third parties, provided it does not identify and cannot reasonably be used to identify any individual.
Lawful bases. Where required by applicable law, Laneful processes personal information on one or more of the following lawful bases: performance of a contract with you or your organization or to take steps at your request prior to entering into a contract; compliance with our legal obligations; our legitimate interests in operating, securing, marketing, and improving the Services and our business, where those interests are not overridden by your interests or fundamental rights; your consent, where required; and to protect vital interests or for purposes of public interest where permitted by law.
Account administrators. If you use the Services through an account provisioned by a business customer (for example, your employer), the customer’s account administrators may be able to access, monitor, manage, restrict, export, disclose, or remove information associated with your user account and the customer’s workspace. Your use of the Services in that context is also subject to your organization’s policies.
User-submitted content. You should not submit sensitive personal information, account passwords, payment card details, or other confidential information through chat, support tickets, web forms, surveys, or other input channels unless specifically requested. Information you submit to any public, collaborative, or shared area of the Services may be visible to others.
We and our service providers use cookies, pixels, software development kits, session-replay technology, and similar tracking technologies on our Sites to make the Sites work, to understand how visitors use them, and to secure them. The technologies we currently use include:
We do not use advertising cookies, retargeting pixels, or other adtech tracking for cross-context behavioral advertising.
Your choices. You can control cookies through your browser settings, including by blocking or deleting cookies. Some browsers and browser extensions support Global Privacy Control (“GPC”), a signal that communicates a request to opt out of the sale or sharing of personal information. Because Laneful does not sell personal information or share personal information for cross-context behavioral advertising, there is no additional opt-out to honor, but we will treat a GPC signal as a request to opt out if applicable law requires us to do so.
Laneful discloses personal information only in the categories of circumstances described below.
Service providers. We share personal information with vendors and service providers that perform services on our behalf, including our payment processing provider, our web analytics provider, our session replay provider, our chat provider, and hosting, infrastructure, communications, security, and other operational vendors. The service providers we use to provide the Services to customers are identified as subprocessors at https://joylabs.com/legal/subprocessors.
Affiliates. We may share personal information with our corporate affiliates for the purposes described in this Policy.
Professional advisors. We may disclose personal information to our accountants, auditors, attorneys, and other professional advisors subject to confidentiality obligations.
Legal and compliance. We may disclose personal information to comply with applicable law, legal process (such as subpoenas or court orders), or lawful requests from public authorities; to enforce our agreements, policies, and terms; to protect the rights, property, or safety of Laneful, our customers, or others; or to investigate and defend against legal claims.
Business transfers. If Laneful is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of its assets, personal information may be transferred to the acquiring party or successor, subject to customary confidentiality protections and, where applicable, notice obligations.
With your consent or at your direction. We may disclose personal information in other circumstances with your consent or at your direction.
No sale or sharing for cross-context behavioral advertising. Laneful does not “sell” personal information and does not “share” personal information for cross-context behavioral advertising as those terms are defined under the CCPA and other U.S. state privacy laws. Laneful has not sold or shared personal information for these purposes in the 12 months preceding the Last Updated date above, and does not sell or share personal information of individuals the Company knows are under 16 years of age.
Customer Data. With respect to Customer Data processed on behalf of our business customers, Laneful discloses Customer Data only to subprocessors as permitted under the DPA and as necessary to provide the Services, and at the customer’s direction.
Our Sites and Services may offer chat functionality, including live chat staffed by our personnel and an AI-enabled chatbot operated by us or our chat provider. When you use these chat features, your messages (including any personal information you provide in the conversation), your email address if you share one, and related metadata may be processed and retained to respond to your inquiry, improve our support, and train and evaluate the performance of the chat tools. Please do not include sensitive information, account passwords, or payment card details in chat. Our chat provider processes chat data on our behalf as a service provider.
Laneful is headquartered in the United States and provides the Services to customers located in the United States, Colombia, and Argentina. Personal information we collect may be transferred to, stored in, and processed in the United States and in any other country where Laneful or its service providers operate. Data-protection laws in these jurisdictions may differ from the laws of your country of residence. Where required by applicable law, Laneful implements appropriate safeguards in connection with international transfers of personal information. International transfers of Customer Data are addressed in, and governed by, the DPA. By using the Services or otherwise providing personal information to Laneful, you acknowledge that your information may be transferred to and processed in the United States and other jurisdictions as described in this Policy.
We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to provide and operate the Services; maintain our business records; resolve disputes; comply with our legal, regulatory, tax, and accounting obligations; and enforce our agreements. Even if you request deletion or stop using the Services, we may retain personal information as necessary to: (a) maintain suppression, unsubscribe, bounce, and complaint records required to honor opt-out requests and meet deliverability and anti-spam obligations; (b) detect, investigate, and prevent fraud, abuse, security incidents, and policy violations, and to maintain related logs; (c) comply with applicable law and respond to legal process and regulatory requests, including legal holds; (d) retain residual copies in routine backup and disaster-recovery systems for limited periods until they are overwritten in the ordinary course; (e) establish, exercise, or defend legal claims and enforce our agreements; and (f) maintain de-identified or aggregated information. Retention periods vary based on the type of information, the purpose for which it was collected, and applicable legal requirements. Retention of Customer Data is governed by the DPA and the customer’s documented instructions.
We maintain administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, and destruction. Our safeguards for the Services are described in the Laneful Security Measures available at https://joylabs.com/legal/security-measures, and include TLS 1.2 (or higher) encryption in transit for all API and web endpoints; multi-factor authentication and passkey support; per-API-key IP allowlisting and web-interface IP restrictions; access logging and audit trails; signed webhook payloads delivered over HTTPS; automatic suppression for unsubscribes and hard bounces; vulnerability scanning and periodic third-party penetration testing; and a documented incident-response program.
No method of transmission over the Internet or method of electronic storage is completely secure, and Laneful cannot guarantee the absolute security of personal information. Operating the Services involves a shared-responsibility model: customers are responsible for properly configuring their accounts, safeguarding API keys and credentials, managing their mailing lists, and complying with our Acceptable Use Policy and applicable law. You should also take care to protect your own credentials and promptly notify us of any suspected unauthorized use of your account.
Depending on where you live and subject to applicable law, you may have the rights described below with respect to personal information that Laneful processes about you for its own purposes as a business, controller, or similar regulated entity under applicable law. The availability and scope of these rights vary by jurisdiction; statutory exemptions may apply; we may need to verify your identity before responding; response and appeal timelines are set by applicable law; and certain personal information may be excluded from a response (for example, information subject to legal privilege, security or fraud-prevention exceptions, or our obligations as a service provider or processor for our customers).
How to submit a request. You can submit a privacy rights request by emailing legal@joylabsventures.com or by writing to us at the mailing address in Section 14. To protect your information, we will take reasonable steps to verify your identity before responding, which may include asking you to confirm information we already have about you or to log in to your account.
Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide written, signed permission from you and may require you to verify your identity directly with us or confirm that you have provided the agent with permission.
Customer Data. If you are an end user, recipient, or other individual whose personal information Laneful processes on behalf of a business customer (for example, because you received or interacted with an email delivered through the Services), Laneful is acting as a service provider or processor and the customer is the controller of that information. Please direct your rights requests to the relevant customer. If you contact us directly regarding Customer Data, we will handle the request in accordance with applicable law, our contractual obligations, and the customer’s documented instructions, which may include referring the request to the customer or assisting the customer in responding as required under the DPA.
California Civil Code § 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct-marketing purposes. Laneful does not disclose personal information to third parties for their own direct-marketing purposes.
The Services are not directed to, nor intended for use by, individuals under the age of 18, and we do not knowingly collect personal information from anyone under 18 (including individuals under 13 or under 16). If you are under 18, please do not use the Services or provide personal information to us. If we learn that we have collected personal information from a minor without appropriate consent, we will delete it as required by law. If you are a parent or guardian and believe your child has provided us with personal information, please contact us using the information in Section 14.
We may update this Privacy Policy from time to time. When we make changes, we will post the updated Policy and revise the “Last Updated” date above, and where required by applicable law we will provide additional notice. Your continued use of the Services after the effective date of the updated Policy constitutes your acceptance of the updated Policy to the extent permitted by applicable law.
You may opt out of receiving promotional emails from Laneful at any time by following the unsubscribe link contained in those emails or by contacting us using the information below. Even if you opt out of marketing communications, we may continue to send you transactional, security, support, account, billing, legal, and other non-promotional communications relating to your use of the Services or our relationship with you.
If you have questions or concerns about this Privacy Policy or our privacy practices, or if you would like to submit a privacy rights request, please contact us by email at legal@joylabsventures.com
The table below summarizes the categories of personal information Laneful has collected, the categories of sources, the business or commercial purposes for collection and disclosure, and the categories of third parties to whom the information has been disclosed, each during the 12 months preceding the “Last Updated” date above. This table covers personal information Laneful collects for its own purposes as a business or controller. It does not describe Customer Data that Laneful processes as a service provider or processor on behalf of its business customers; that processing is governed by the DPA.
| Category of Personal Information Collected | Categories of Sources | Business / Commercial Purposes | Categories of Third Parties to Whom Disclosed |
|---|---|---|---|
| Identifiers (real name, email address, phone number, mailing address, IP address, online identifiers such as device/browser information, account log-in credentials). | Directly from you (e.g., when you create an account, contact us, or use the Services); automatically from your device or browser when you visit our websites; from our business customers who transmit recipient information through the Services. | Providing, operating, and securing the Services; account administration; customer support; billing and payment processing; fraud prevention and abuse detection; analytics and improvement of the Services; compliance with legal obligations. | Service providers (the Subprocessors listed at https://joylabs.com/legal/subprocessors); affiliates; government or law-enforcement authorities where legally required; parties to a business transfer; parties to whom disclosure is made with your consent. |
| Signature (collected on contracts only, e.g., order forms and other agreements). | Directly from you or your authorized signatory when executing an agreement. | Entering into and administering contracts; legal compliance and record-keeping. | Affiliates; service providers assisting with contract management; professional advisors; government authorities where legally required. |
| Commercial information (products or services purchased, obtained, or considered). | Directly from you through your account and orders; automatically based on your use of the Services. | Providing and operating the Services; billing; customer service; internal analytics. | Service providers (Stripe for payments; hosting and infrastructure providers); affiliates; parties to a business transfer. |
| Internet or other electronic network activity (device and browser information collected via cookies and similar technologies; session-replay data). | Automatically from your device or browser when you visit our websites or use the Services. | Operating and securing our websites and Services; measuring website performance and engagement; debugging; analytics. | Service providers that provide analytics and session-replay functionality (Google Analytics and Hotjar); hosting and infrastructure providers. |
| Sensitive personal information: account log-in credentials (username in combination with password or other credentials permitting access to an account). | Directly from you when you create or access an account. | Authenticating users, operating and securing the Services, and preventing fraud or abuse. We use this information only for purposes permitted under CCPA/CPRA § 1798.121 and do not use it to infer characteristics about any individual. | Service providers that help us host, secure, and operate the Services, including authentication, hosting, and infrastructure providers listed at https://joylabs.com/legal/subprocessors. |
Categories not collected. During the 12 months preceding the Last Updated date, Laneful did not collect any of the following categories of personal information defined under the CCPA: characteristics of protected classifications, biometric information, precise geolocation, audio/electronic/visual/thermal/olfactory/similar information, professional or employment-related information, non-public education information, or inferences drawn to create a profile about a consumer. The only category of “sensitive personal information” collected is account log-in credentials.
No sale or sharing. Laneful has not sold personal information or shared personal information for cross-context behavioral advertising in the 12 months preceding the Last Updated date.