Privacy information
Privacy at AutoLab.
This notice explains how AutoLab processes information while providing its live B2B data-cleaning service. Last updated: 31 August 2026.
1. Controller
The controller is Pablo David Medail Escobio, trading as QbraXO, based in Benidorm, Alicante, Spain.
Privacy contact: autolab@qbraxo.com. AutoLab is intended to operate at autolab.qbraxo.com.
2. AutoLab Live service
AutoLab accepts paid B2B orders. Payment is processed by Stripe before a customer uploads a CSV. The service cleans, classifies and prioritises business-company data and returns a CSV, report and audit manifest.
We do not use advertising cookies, tracking pixels or cross-site profiling. We use Cloudflare Web Analytics in privacy-first mode to measure aggregate page views and visits. Basic hosting security logs may be created by the hosting layer.
3. Data the paid service is designed to process
- Verified work email, one-time access-link status and a salted email lookup key for the customer workspace; no password is collected.
- Order and business contact details supplied by the customer.
- Payment identifiers and payment status; not full card details.
- Business-company CSV rows submitted for an accepted order.
- Generated CSV, report and audit manifest.
- Security, operational and audit events.
- Suppression records needed to honour objections and prevent contact.
Uploaded files must contain business-company data only. Customers must not submit personal, confidential or sensitive data.
4. Purposes and legal bases
- Order delivery: steps requested before a contract and performance of a B2B service contract.
- Payments and accounting: performance of the contract and compliance with legal obligations.
- Security and fraud prevention: legitimate interests in protecting AutoLab, its customers and the service.
- Passwordless customer access: steps requested before a contract and legitimate interests in preventing lost access, unauthorised access and support incidents.
- Suppression: compliance with objections and legitimate interests in preventing unwanted contact.
This notice does not claim a legal basis for cold-email acquisition. That channel remains disabled while the applicable Spanish and UK rules are resolved.
5. Processors and transfers
The service uses dedicated AutoLab resources at Cloudflare for hosting, processing, storage, queues and privacy-first aggregate analytics, Stripe for checkout and payment processing, and Resend for passwordless transactional access and service messages. The portal uses a dedicated sending subdomain, separate from the QbraXO support mailbox.
Providers receive only the information necessary for their function and must provide appropriate contractual and security safeguards. Where a provider processes information outside the EEA or UK, AutoLab uses a lawful transfer mechanism and applicable safeguards.
6. Retention
- Uploaded and generated files: deleted 24 hours after delivery.
- One-time access links: expire after 15 minutes and are removed once used or expired; browser sessions expire after 24 hours.
- Operational/security logs: retained only for the short period needed to investigate incidents and operate the service.
- Order, payment and accounting records: retained for the period required by applicable tax, accounting and commercial law.
- Suppression records: retained only as long as needed to honour an objection and prevent renewed contact.
This schedule is reviewed when the service, legal obligations or providers change.
7. Explainable processing
AutoLab applies deterministic rules to business-company records to normalise, deduplicate, classify and prioritise them. It does not make a legal or similarly significant decision about a person. The output is decision support, not a prediction or guarantee of sales.
8. Your rights
Where applicable, you may request access, rectification, erasure, restriction, objection or portability by emailing autolab@qbraxo.com. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) or, where UK data protection law applies, the Information Commissioner's Office (ICO).
9. Changes
This notice is reviewed whenever the service, processors, retention schedule or lawful bases materially change.