Privacy policy

Imzlab Technologies Private Limited (“IMZLab”, “we”) is based at 15-c Small Industrial Estate, Mall Road, Sargodha, Punjab 40100, Pakistan. This policy covers:

• this website, imzlab.com;
• IMZLab Private IoT Cloud at cloud.imzlab.com, and the IMZLab devices that report to it;
• the Package Tracker plugin for Claude, covered in its own section below;
• emails, calls and messages you send us.

When your company is our customer, your company decides who has an account and which devices each person can see. We handle the information in the panel to provide the service to your company.

Hosting. The website is hosted on Vercel. Like any web host, Vercel processes technical information about each request, such as your IP address, browser type and the page requested, to deliver the site and protect it.

Analytics. We use Google Analytics to see which pages are visited and how visitors find us. It uses cookies and collects information such as pages viewed, device and browser type, approximate location derived from your IP address, and the site that referred you. We look at this information in aggregate.

Contact form. When you send the contact form we receive your name, email address, phone number if you give one, the topic you choose and your message. The form is protected by Google reCAPTCHA, which collects information about your device and how you use the page in order to tell people from automated traffic. Your message reaches our inbox through Resend, an email delivery service.

Map. The contact page shows an embedded Google Map, which loads from Google and may set Google’s own cookies.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google’s opt-out browser add-on. See Vercel’s privacy policy, Google’s privacy policy and Resend’s privacy policy.

• Account details: your name, email address, company, role and permissions. We never store your password itself, only an Argon2id hash of it. If you turn on multi-factor authentication, your authenticator secret is stored encrypted and your recovery codes are stored as hashes.
• Company details: company name, location, address, phone number and country, and the sites and devices registered to the company.
• Device data: the readings your devices send, such as temperature, humidity, pressure, CO2, ammonia, level and soil values, together with sensor error flags, timestamps, connection status and device settings.
• Activity: alert rules, incidents and comments, notification history, saved dashboards, export and report files, and an audit trail recording who changed users, devices, alert rules, commands, firmware, exports or deletions, and when.
• Sign-in sessions: the panel sets a cookie that keeps you signed in. Sessions are stored on our server and expire after a period of inactivity and after a maximum lifetime. The panel does not use advertising or analytics cookies.
• Technical information: like any web service, our server processes your IP address and browser information when you use the panel, to deliver pages and to protect sign-in against abuse.

• To provide the service: show live readings, history and dashboards, send alerts, produce exports and reports, and prepare firmware for your devices.
• To keep the service secure: sign you in, keep each company’s data separate, prevent unauthorised access and keep an audit trail.
• To answer enquiries, prepare quotations and give support.
• To understand how the website is used and improve it.
• To meet our legal obligations.

We do not sell personal information, and we do not use the data in the panel for advertising.

IMZLab Private IoT Cloud runs on a virtual private server that we rent from a hosting provider and operate ourselves. Its database, device message broker and sign-in system are self-hosted: we use no managed database and no third-party sign-in provider. The hosting provider operates the underlying machine and storage.

Other services process information on our behalf:

• Alert emails are sent through the email service we configure for the panel, either an SMTP server or Resend. It receives the recipient’s email address and the content of the alert.
• The website uses Vercel for hosting, Google for Analytics, reCAPTCHA and Maps, and Resend to deliver contact-form messages.
• Email you send us is handled by our email provider.
• The Package Tracker plugin for Claude sends tracking numbers only to Apify, which runs our tracking Actors on your own Apify account. No IMZLab server is involved; see the plugin section.

These providers and our server may be located outside your country. We may also disclose information when the law requires it, or when it is needed to protect the safety of people or the security of our service.

• Traffic to this website and the panel is encrypted with HTTPS. Devices connect to the cloud over TLS and check the server’s certificate before sending data.
• Each company’s data is kept separate by server-side permission checks and by database row-level security. Roles control who can view data, export it or send commands to devices.
• Passwords are hashed, sessions can be revoked, and every account can turn on multi-factor authentication.
• Device credentials and email-service secrets are stored encrypted.

No system is completely secure, and we cannot guarantee that information will never be accessed without permission. If we learn of a breach that affects your information, we will tell the affected customers without undue delay.

• Device readings: our retention policy keeps original readings for at least six calendar months. Automatic deletion is currently switched off, so readings are kept for longer than that for now. We will update this policy before switching automatic deletion on.
• Export files expire 24 hours after they are generated.
• Account and company details are kept while the account is active. Audit-trail entries are kept as a record of changes and are not removed when other data is deleted.
• Database checkpoints: before each software release we take an encrypted checkpoint of the database. Information deleted from the panel can remain in these checkpoints until they are replaced.
• Enquiries sent through the website or by email are kept for as long as we need them to respond and for our business records. You can ask us to delete them.

• Update your name and email address, change your password, turn on multi-factor authentication and sign out other sessions under My account in the panel.
• Export your device data as CSV from the panel.
• Ask your company administrator to change your access or remove your account.
• Ask us for a copy of your personal information, or to correct or delete it, by emailing info@imzlab.com with the subject “Privacy request”.

Readings and records that belong to your company are controlled by your company, so requests to delete them must come from your company administrator. We will check that a request comes from you, or from your company administrator, before we act on it.

Package Tracker: DHL, FedEx, UPS, USPS & 17TRACK (plugin id trackbuddy-parcel-tracker) is a plugin that IMZLab publishes in Anthropic’s Claude directory. It is a set of instructions for Claude plus a reference to Apify’s hosted MCP server at mcp.apify.com. IMZLab operates no server for it and receives none of the information below.

• Tracking numbers. When you ask Claude to track a package, Claude sends the tracking numbers you provide to Apify, which starts one of our tracking Actors on your own Apify account. The Actor queries the carrier’s public tracking page (DHL, FedEx, UPS or 17TRACK).
• Results. Tracking results are written to datasets and key-value stores in your Apify account and returned to Claude for display. They can contain delivery addresses, recipient names and scan locations as shown on the carrier’s tracking page.
• Optional inputs. A recipient postal code you choose to provide for DHL destination verification is passed to the DHL Actor for that run only. The Actor does not write it to results or logs. The plugin never asks for carrier API keys.
• Sign-in. You authorise Apify through OAuth in the plugin’s Connectors tab. The plugin never handles your Apify API token.

The plugin does not send data anywhere other than Apify, does not use advertising or analytics, does not read Claude’s memory or chat history, and does not let IMZLab see your conversations, tracking numbers, results or Apify account. Apify processes the data under Apify’s privacy policy, and Claude under Anthropic’s privacy policy.

Retention. Results stay in your Apify account for your Apify plan’s data-retention period, and you can delete them at any time in Apify Console. The plugin itself keeps nothing.

Usage statistics. IMZLab sees aggregate, anonymous usage of its Actors (run counts and billed events) in Apify Console, and aggregate install and run counts in Anthropic’s developer portal. Neither includes tracking numbers or results.

Our website and services, including the Package Tracker plugin, are made for businesses and adults. They are not intended for children, and we do not knowingly collect information from children.

We will publish any change on this page with a new effective date. If a change significantly affects how we handle information in the panel, we will also email company administrators.

For privacy questions or requests, email info@imzlab.com, call +92 346 870 4004, or write to Imzlab Technologies Private Limited, 15-c Small Industrial Estate, Mall Road, Sargodha, Punjab 40100, Pakistan.