Effective June 10, 2026 · LabCMD, LLC, 147 Kennicott Rd, Chehalis, WA 98532 · [email protected]
Account data: your name, work email, company, and password (stored as a salted hash — we never see it).
Connected mailbox content: with your Microsoft 365 administrator's explicit consent, Customs reads messages in the specific mailboxes you choose in order to analyze them. We store the metadata and verdict for each analyzed message (sender, subject, verdict, reasons, timestamps). Message bodies are processed to produce the verdict and are not retained beyond what the verdict record shows.
Billing: payments are processed by Stripe; we never see your card number. Site basics: the free domain-check stores the domain checked and the requesting IP for abuse prevention.
We do not sell your data, use it to train shared models, or read mailboxes beyond the ones you connected. Analysis runs to give you a verdict — nothing else.
Microsoft Azure (email APIs & sending), Stripe (payments), Cloudflare (network/DNS). Each receives only what its function requires.
Verdict records are kept while your account is active so your team can review history. Deleting your account erases your stored messages, verdicts, settings, and team records. You can request deletion or a data export any time at [email protected] — we complete requests within 30 days.
Depending on where you live (including California), you may have rights to access, correct, delete, or port your personal information, and to non-discrimination for exercising them. Email us and we'll honor them.
Data in transit is encrypted (TLS); production access is limited to LabCMD operators; backups are encrypted at rest. If a breach affects your data we will notify you without undue delay.
We'll announce material changes by email before they take effect.