Privacy Policy

Lifecycle operates lifecycle.lol, named desks such as lifecycle.lol/yourcompany, portal.lifecycle.lol, and licensed On-prem software (together, the "Services"). Contact: privacy@lifecycle.lol.

Your organization controls the employee and device data it puts in its desk. For Cloud desks we process that data on its behalf (see the Data Processing Addendum). For account, billing, and security data we are the controller.

Sign-in identity. When you sign in with Microsoft we receive your name, email, user principal name, and tenant id (scopes openid, profile, email). On-prem desks can instead sign you in with Active Directory or Windows single sign-on; that happens on your server.

Directory data from Microsoft Graph. If your admin connects Microsoft 365, the desk reads users (display name, given name, surname, email, user principal name, job title, company, department, office, mobile and business phone, on-prem distinguished name), groups (name and email), and your organization name and domains. Admins grant these application permissions in Entra; we request nothing broader.

Devices from Intune. With Intune connected, the desk looks up managed devices by serial number to fill device names and, when IT retires a device, sends wipe or retire commands.

Desk records. Onboard, change, and offboard tickets (names, titles, departments, managers, start and last-day dates, notes), inventory (asset tags, serial numbers, models, assignments, warranty dates, costs), finance cost fields, instructions, and activity history.

Shipping and the employee portal. Recipient name, shipping address, phone, and email for labels and address requests; tracking numbers; label files; and the answers employees submit through portal links.

Retirement and resale. Device photos taken for a listing, listing drafts, list and sale prices, eBay listing ids, and an employee discount code. Photos stay in Lifecycle; they are not uploaded to eBay.

Billing and licensing. Billing email and name, plan, instance name, payment status, and license keys. Stripe or PayPal hold your card or wallet details; we never see full card numbers. On-prem installs send a license heartbeat about hourly with the instance name, node id, hostname, app version, and a hash of the license key.

Logs. Request metadata (IP address, user agent, timestamps) and diagnostic events with a correlation id. Logs redact passwords, tokens, and secrets.

Cookies. Only what sign-in and sessions need. No advertising or analytics cookies.

Cloud desks (*.lifecycle.lol) run on Vercel with a managed Postgres database in the United States. All desk data above is stored there.

On-prem desks store all desk data in a local database on your server. Microsoft is used for identity only. The only things that reach Lifecycle are sign-in to lifecycle.lol if you use it, billing, and the license heartbeat. If you choose to link a node for cloud sync, create-instance and portal requests are also shared with the hosted database.

• Run the desk features your organization turns on
• Sign people in and enforce desk roles and instance membership
• Process subscriptions, trials, and license heartbeats
• Send the mail your desk triggers (portal links, reminders, invites) through your own mailbox or SMTP server
• Secure the Services and investigate abuse or incidents
• Comply with law and enforce our Terms

We do not sell personal information or use it for advertising.

The providers that host, bill, and operate the Services are listed on our Subprocessors page, together with the integrations your admin can turn on (shipping carriers, eBay, Dell warranty, Google Workspace, ImmyBot). We also share information with your organization's desk administrators, professional advisers under confidentiality, a successor in a merger or acquisition, and authorities when the law requires it.

• Desk data: kept while the desk exists. It is not deleted automatically when a subscription ends; see Leaving Lifecycle below.
• On-prem backups: hourly export folders on your server, keeping the newest 48 hourly and one per day for 30 days by default. You control this.
• On-prem logs: rotated on your server (about 5 MB per file, three old files kept).
• Cloud logs: kept for our hosting provider's log retention window, then discarded.
• Billing records: kept as long as tax and accounting law requires.

Admins can export everything at any time from Settings → Backups. If a payment fails, a trial ends, or you cancel, the desk becomes read-only: you can still sign in, view, and export, but not change records. We never lock you out of your data over billing.

To delete a Cloud desk, an instance administrator emails privacy@lifecycle.lol. We remove it from the production database within [30 days]; provider backups age out on their own schedule. On-prem data is on your server and you delete it yourself.

Depending on where you live, you may ask to access, correct, delete, or port your personal information, or object to certain processing. If the data sits in your employer's desk, we will usually route the request to that organization's administrator. Email privacy@lifecycle.lol. We will not discriminate against you for exercising these rights.

TLS in transit, per-instance data separation, role-based access, secrets kept out of URLs, and redacted logs. No system is perfectly secure. On-prem customers are responsible for their servers, backups, and updates.

Cloud data is hosted in the United States. Where the law requires a transfer mechanism, we use Standard Contractual Clauses or an equivalent. Some subprocessors operate global networks; see the Subprocessors page.

The Services are for organizations and are not directed to children under 16. We do not knowingly collect their information.

See our Accessibility Statement for our WCAG 2.2 Level AA target and how to report barriers.

We will update the date above when this policy changes and announce material changes in the Services or by email.

Privacy: privacy@lifecycle.lol. Legal: legal@lifecycle.lol. Billing: billing@lifecycle.lol.