Privacy Policy
Lube Software Sdn. Bhd.
Last updated:
1. Introduction
This Privacy Policy describes how Lube Software Sdn. Bhd. (Registration No. 202401053113) (“lube,” “we,” “us,” or “our”) collects, uses, discloses, and protects your personal information when you visit our website at https://lube.work (the “Website”), use our software-as-a-service platform, or use our desktop apps and related services (collectively, the “Service”).
We are committed to protecting your privacy and handling your personal information in accordance with applicable data protection laws, including Malaysia's Personal Data Protection Act 2010 (PDPA).
By accessing or using the Service, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.
2. Information We Collect
We collect information in several ways depending on how you interact with the Service.
2.1 Information You Provide Directly
| Data type | Examples | Purpose |
|---|---|---|
| Account information | Email address, name, password | To create and manage your account |
| Organization information | Organization name | To set up your workspace and manage team access |
| Preferences | Language preferences, notification settings | To personalize your experience |
| User content | Files, attachments, images, documents, and other materials you upload | To provide the Service functionality |
| Communications | Emails, support requests, feedback | To respond to your inquiries and improve the Service |
| LLM inputs | Domain information, prompts, and other inputs you provide to AI-powered features | To generate insights and analysis within the Service |
2.2 Information Collected Automatically
When you use the Service, we automatically collect certain information about your device and usage:
| Data type | Examples | Purpose |
|---|---|---|
| Device information | Device type, operating system, browser type and version | To optimize the Service for your device |
| Usage data | Pages visited, features used, clicks, time spent | To understand how users interact with the Service and improve it |
| Log data | IP address, access times, referring URLs | For security, troubleshooting, and analytics |
| Cookie data | Session identifiers, preferences | To maintain your session and remember your settings |
Usage reporting in our desktop apps works differently: it is off unless you turn it on. See section 3.
2.3 Information from Third-Party Services
If you connect third-party services to your lube account, we may receive information from those services:
| Service | Data received | Purpose |
|---|---|---|
| Stripe | Payment status, subscription details, billing information (we do not receive or store your full credit card number) | To process payments and manage subscriptions |
| GitHub | Repository information, profile data, and other data you authorize | To provide integrations and features you enable |
You control which third-party services you connect, and you can disconnect them at any time through your account settings.
3. Usage Reporting in Our Desktop Apps
Our desktop apps can send us reports about how they are used. Lube Paste is the first app to do this, and this section describes how it works there. We will add other apps here as they start sending reports.
3.1 Off Unless You Opt In
Paste asks whether you want to share usage. Nothing is sent until you choose to share, either anonymously or linked to your lube account, and confirm the description shown for that choice. You can change your choice or turn sharing off at any time in Paste's Settings. If we change what a choice covers, Paste asks you again and collects nothing under the new description until you confirm it.
3.2 What Each Choice Covers
These are the descriptions Paste shows when you choose:
| Choice | What we collect |
|---|---|
| Anonymous | Counts and sizes of what you copy and keep, what you open, and whether it worked. Tied to a random ID that resets every year. Never your account or your content. |
| Linked | Counts and sizes of what you copy and keep, what you open, and whether it worked, tied to your lube account so we can understand your usage and help with problems you hit. Never your content. |
3.3 What Paste Sends
- One summary of counts per hour. It covers how many clips you captured of each kind, the total size of images you captured, how many clips you deleted, redacted or pinned, and the size of your history (number of clips and images, total bytes, and how many pinned items, pinboards and snippets you have). It also includes your plan, your platform and the app version.
- App events, such as opening the picker or a search, and whether an action worked.
- An hour in which you did nothing sends no summary.
Paste never sends the content of your clips, under either choice.
3.4 How Reports Are Identified
- Anonymous reports carry a random ID created by the app. It resets every year and is never linked to your account.
- Linked reports carry your lube account ID, plus a random ID for each device so we can tell your devices apart.
- When you change your choice, or sign out or switch accounts while linked, Paste deletes any reports it has not yet sent. Data collected under one choice is never sent under another.
3.5 How Long We Keep It
We keep the individual hourly summaries for about 60 days. Daily totals built from them are kept longer, for up to two years. Reports are stored in our own analytics systems and are not shared with third-party analytics providers.
3.6 Erasing Your Reports
If you chose linked sharing, you can ask us to erase the reports tied to your account by emailing privacy@lube.work. We erase them within 30 days of your request. Turn sharing off in Settings as well, so no new reports are sent.
Anonymous reports are not tied to your account, so we cannot find which ones are yours. Turning sharing off stops new reports and deletes any that have not been sent.
4. How We Use Your Information
We use the information we collect for the following purposes:
4.1 To Provide and Maintain the Service
- Creating and managing your account
- Processing transactions and sending related information
- Providing customer support
- Enabling features and integrations you request
4.2 To Improve and Develop the Service
- Understanding how users interact with the Service
- Identifying and fixing bugs and issues
- Developing new features and functionality
- Conducting research and analysis
4.3 To Communicate with You
- Sending transactional emails (account verification, password resets, billing notifications)
- Sending product updates and announcements
- Sending marketing communications (with your consent, where required)
- Responding to your inquiries and support requests
4.4 To Ensure Security and Prevent Fraud
- Detecting, preventing, and addressing technical issues
- Protecting against unauthorized access, fraud, and abuse
- Enforcing our Terms of Service and other policies
4.5 To Comply with Legal Obligations
- Responding to lawful requests from public authorities
- Complying with applicable laws and regulations
- Protecting our legal rights and interests
5. AI-Powered Features
The Service includes AI-powered features that use large language models (LLMs) provided by OpenAI.
5.1 How AI Features Work
When you use AI-powered features, information you provide, including domain information, prompts, and context, may be sent to OpenAI for processing.
5.2 Data Handling for AI Features
| Aspect | Our practice |
|---|---|
| Training | We do not use your content or inputs to train our own machine learning models |
| Third-party training | OpenAI's data usage is governed by their privacy policy and our data processing agreement with them |
| Retention | AI inputs and outputs are processed in real time and are not stored beyond what is necessary to provide the feature |
5.3 OpenAI
Provider: OpenAI, L.L.C. Privacy Policy: https://openai.com/privacy
6. How We Share Your Information
We do not sell your personal information. We may share your information in the following circumstances:
6.1 Service Providers
We share information with third-party service providers who perform services on our behalf:
| Provider | Service | Data shared |
|---|---|---|
| Amazon Web Services and Google Cloud Platform | Cloud infrastructure and hosting | All data stored in the Service |
| Stripe | Payment processing | Billing information, transaction details |
| Resend | Transactional and marketing emails | Email address, name |
| OpenAI | AI-powered features | LLM inputs and context you provide |
| Google Analytics | Website and product analytics | Usage data, device information |
| Amplitude | Product analytics | Usage data, device information |
| Microsoft Clarity | Session recording and heatmaps | Usage data, interaction data |
| GitHub | Integration services | Data you authorize through the integration |
These providers are contractually obligated to protect your information and may only use it for the purposes we specify.
6.2 Legal Requirements
We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).
6.3 Business Transfers
If lube is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.
6.4 With Your Consent
We may share your information for other purposes with your explicit consent.
7. Data Storage and International Transfers
7.1 Storage Location
Your data is stored on servers located in the United States.
7.2 International Transfers
If you are located outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer. We take appropriate safeguards to ensure that your personal information remains protected in accordance with this Privacy Policy when transferred internationally.
8. Data Retention
We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy.
| Data type | Retention period |
|---|---|
| Account information | For the duration of your account, plus 90 days after deletion request |
| User content | For the duration of your account, plus 90 days after deletion request |
| Billing records | As required by applicable tax and accounting laws (typically 7 years) |
| Analytics data | According to third-party provider defaults (Google Analytics: 14 months; Amplitude: 1 year; Microsoft Clarity: 13 months) |
| Desktop app usage reports | Hourly summaries for about 60 days; daily totals for up to two years. Linked reports are erased within 30 days of a request (see section 3) |
| Backup data | Up to 30 days after the data is deleted from production systems |
| Log data | Up to 90 days for security and troubleshooting purposes |
After the applicable retention period, we will delete or anonymize your information, unless retention is required by law.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Our security measures include:
- Encryption of data in transit using TLS
- Encryption of data at rest
- Access controls and authentication requirements
- Regular security assessments and monitoring
- Employee training on data protection
However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.
If you become aware of any unauthorized access to your account, please contact us immediately at privacy@lube.work.
10. Your Rights and Choices
Depending on your location, you may have certain rights regarding your personal information.
10.1 Access and Portability
You have the right to request access to the personal information we hold about you. You may also request a copy of your data in a portable format.
10.2 Correction
You can update most of your personal information directly through your account settings. If you need assistance correcting information you cannot update yourself, please contact us.
10.3 Deletion
You have the right to request deletion of your personal information. Upon receiving a valid deletion request, we will delete your information within 90 days, except where retention is required by law or for legitimate business purposes. Linked desktop app usage reports are erased within 30 days (see section 3).
10.4 Objection and Restriction
You may have the right to object to certain processing of your information or request that we restrict processing in certain circumstances.
10.5 Withdrawal of Consent
Where we rely on your consent to process your information, you have the right to withdraw that consent at any time. For desktop app usage reporting, turn sharing off in the app's Settings. Withdrawing consent does not affect the lawfulness of processing conducted before withdrawal.
10.6 Communication Preferences
You can opt out of marketing communications at any time by:
- Clicking the “unsubscribe” link in any marketing email
- Updating your notification preferences in your account settings
- Contacting us at privacy@lube.work
Please note that you may still receive transactional emails related to your account and the Service.
10.7 How to Exercise Your Rights
To exercise any of these rights, please contact us at privacy@lube.work. We will respond to your request within a reasonable timeframe and in accordance with applicable law. We may need to verify your identity before processing your request.
11. Children's Privacy
The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13.
If you are a parent or guardian and believe that your child has provided us with personal information, please contact us at privacy@lube.work. If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to delete that information.
12. Third-Party Links and Services
The Service may contain links to third-party websites, services, or applications that are not operated by us. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through the Service.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make changes, we will:
- Update the “Last updated” date at the top of this policy
- Post the updated policy on our website
- For material changes, notify you by email or through the Service
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
14. Privacy Contact
While not legally required under Malaysian law, we have designated a privacy contact to handle data protection matters and respond to inquiries: privacy@lube.work.
15. Additional Information for Specific Jurisdictions
15.1 European Economic Area (EEA) and United Kingdom
If you are located in the EEA or UK, you have additional rights under the General Data Protection Regulation (GDPR) or UK GDPR, including the right to lodge a complaint with your local data protection authority.
We process your personal data on the following legal bases:
- Contract: to perform our contract with you (providing the Service)
- Legitimate interests: for our legitimate business interests (improving the Service, security)
- Consent: where you have given consent (marketing communications, desktop app usage reporting)
- Legal obligation: to comply with applicable laws
15.2 California
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and how we use it, the right to request deletion, and the right to opt out of the “sale” of personal information. We do not sell your personal information as defined by the CCPA.
15.3 Malaysia
If you are located in Malaysia, your personal data is protected under the Personal Data Protection Act 2010 (PDPA). You have the right to access and correct your personal data, and to limit the processing of your personal data for marketing purposes.
16. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:
Lube Software Sdn. Bhd.Registration No. 202401053113
Privacy inquiries: privacy@lube.work
General support: support@lube.work
Website: https://lube.work