Privacy notice
How Lab Forge handles personal information, written as the notice required by PIPL Art. 17. It describes what the product actually does today. It is a product notice, not legal advice. Items marked “To be confirmed by the operator” are not yet settled and are not guessed.
Who we are
The personal information handler for Lab Forge is CoreAI (Shenzhen) Holdings Co., Ltd..
To be confirmed by the operator: registered address and unified social credit code of the handler.
What we collect
- Account: your login name, the email address if you give one, and the time, IP address and approximate location of your most recent sign-in.
- API keys: Lab Forge API keys are stored only as a one-way hash plus a short display prefix. Provider keys you add are stored encrypted. Neither secret is shown back or included in an export.
- Job content: the files you upload, the translations produced, glossaries and translation memories you attach.
- Billing: quotes, checkout orders, and 发票 requests (invoice title, tax ID and contact email).
- Security records: an audit log of sign-ins and account actions, with IP address and browser user-agent.
Sensitive personal information
Legal, identity and official documents you upload for translation may contain sensitive personal information (PIPL Art. 28). The upload form asks for your separate consent with its own checkbox, which is not bundled with the account terms or a price quote.
Why we use it
To run the translation and review jobs you ask for, deliver the results, share them only through links you create, bill you and issue 发票, and keep the service secure.
To be confirmed by the operator: a statement on sale of personal information, advertising use, and whether uploaded content is ever used to train or improve models (and the opt-out if so). This is a commitment only the operator can make.
Recipients and cross-border transfer
To produce a translation, the content a job needs is sent to the model operators configured for that job. The upload consent states that these may include operators outside mainland China. Lab Forge production is hosted on a server in Hong Kong. Share links you create let anyone holding the link view that one task or project until it expires or you revoke it; new links expire after 30 days by default.
To be confirmed by the operator: the named list of recipients (operator, country or region, contact) and the PIPL Art. 38 legal basis for export (standard contract filing, certification, or security assessment).
How long we keep it
When you close your account, your sign-in is disabled immediately and your email and sign-in IP are erased. Records needed for bookkeeping and security — orders, 发票 requests and the audit log — are kept for the statutory period. Network logs have a statutory minimum of six months (Cybersecurity Law Art. 21).
The account-data retention period is shown in Settings once it is configured. This page does not invent a day count.
To be confirmed by the operator: retention periods for account data, uploaded files and translations, the audit log, and accounting vouchers.
Your rights
You can use these directly when signed in, in Settings → Your data:
- Export (PIPL Art. 45): download a machine-readable copy of your account, API-key metadata, orders and 发票 requests. Projects, tasks and uploaded files are not part of this export.
- Close account (PIPL Art. 47): revokes your API keys, deletes stored provider keys, signs out every session and disables the login. You confirm by typing your login name.
For access, correction, or withdrawing consent in other ways, contact us below.
Contact
To be confirmed by the operator: the privacy contact required by PIPL Art. 17 and 52 (not configured), and the response time for requests.