Legal
Privacy notice
Last updated 27 October 2026
This notice explains how we handle personal data when you visit this website or contact us through it. It covers the website only. When we build and run agents for a client, that data is handled under the client contract and its data processing agreement.
1. Who is responsible
Spear Labs is operated by SPEAR Sàrl, 95, avenue Grande-Duchesse Charlotte, L-3441 Dudelange, Luxembourg, registered with the RCS Luxembourg under B250943. SPEAR Sàrl is the controller of the personal data described here. For any privacy question, write to contact@spear.lu.
2. What we collect
- When you contact us through the form or by email: your name, company, work email and anything you tell us about the process you want to automate.
- When you browse the site: the technical data your browser sends with every request, such as your IP address, browser type, the page requested and the time. Our hosting provider needs this to deliver the site and protect it from abuse.
Please don't include sensitive data, such as health information, in the form.
3. Why we use it
| Purpose | Legal basis (GDPR) |
|---|---|
| Replying to your request and preparing a bootcamp or proposal | Steps taken at your request before a contract (Art. 6(1)(b)) and our legitimate interest in answering business enquiries (Art. 6(1)(f)) |
| Following up on the conversation you started with us | Legitimate interest (Art. 6(1)(f)). You can object at any time. |
| Running the website and keeping it secure | Legitimate interest (Art. 6(1)(f)) |
| Keeping records the law requires, if you become a client | Legal obligation (Art. 6(1)(c)) |
We don't add you to a newsletter or mailing list, and we don't make automated decisions about you.
4. Who receives it
Only our team, and the service providers who run the website and our email for us. They act on our instructions under a data processing agreement. We never sell or rent personal data, and we never use it to train AI models.
5. Transfers outside the EU
The website is hosted by Vercel Inc. in the United States. Vercel is certified under the EU-U.S. Data Privacy Framework, which the European Commission recognises as offering adequate protection. Any other transfer outside the European Economic Area relies on an adequacy decision or on the European Commission's standard contractual clauses.
6. How long we keep it
- Enquiries: up to 3 years after our last contact. If you become a client, the terms of the contract apply instead.
- Technical logs: kept by our hosting provider for a short period, for security.
- Accounting records: 10 years, as Luxembourg law requires.
7. Cookies
This website doesn't use cookies for analytics, advertising or tracking, and it doesn't load third-party trackers. At most, it uses technical storage that is strictly necessary to display the site and keep it secure, which Luxembourg law allows without consent. That's why there is no cookie banner. If we ever add cookies that need your consent, we will ask first and update this notice.
8. Your rights
You can ask to access, correct or delete your data, to restrict or object to how we use it, and to receive it in a portable format. Write to contact@spear.lu and we will reply within one month.
You can also complain to the Luxembourg data protection authority: Commission nationale pour la protection des données (CNPD), 15, boulevard du Jazz, L-4370 Belvaux, cnpd.public.lu.
9. Changes
We may update this notice when the website or the law changes. The date at the top shows the current version.