Privacy Policy

1. Who this covers

MBA Lab ("we," "our," or "us") publishes a free directory of US business schools, a resource library, a set of free planning tools, and a small project-management hub for MBA teams. Most people who visit never create an account, and this policy covers them too — not just account holders.

It explains what we collect, why we collect it, who else sees it, and what you can ask us to do about it. If something here is unclear, ask us; the contact details are in section 12.

2. Who is responsible for your data

MBA Lab is operated from the United States and is the controller of the personal data described in this policy. You can reach us at privacy@mbalab.net, which is a monitored address — please use it rather than any no-reply address you may have received mail from.

3. What we collect

3.1 If you browse without an account

You can read the directory, the resource library, and use every free tool without telling us who you are. We do not ask for your name or email, and the tools save your drafts in your own browser — that content never reaches our servers and we cannot see it. The one exception is the syllabus parser demo on our home page. To show you what the parser finds, the text you paste there is sent to our server, read once to pull out the dates and weights, and returned to your browser. We do not store it, we do not log it, and we do not use it for anything else — but unlike the tools above, it does leave your browser, so treat it as you would any text you send to a website.

Our hosting provider processes standard web-request data, including your IP address, browser and device type, the pages you request, and the time of the request.

3.2 If you create an account

• Email address. This is the only personal detail we require. We use it to sign you in and to send you service email.
• Content you create. Teams, projects, tasks, deliverables, and any text you enter in the hub.
• Journal entries. Anything you write in your reflection journal, including the mood and tags you add to a day. These are private to your account: they are never shown to your teammates, never included in any email we send, and never sent to an AI provider.
• Team membership. Who belongs to which team, and invitations you send or accept.
• Sign-in records. When you last signed in, so we can keep your session working.

We sign you in with a one-time code or a magic link sent to your email address. We never ask you to create a password, so we never store one.

3.3 Cookies and similar storage

These are the cookies MBA Lab actually sets. Nothing else is set by us.

The free tools also save your drafts to your browser's local storage so you do not lose work. That is storage on your device for something you asked us to do. It never leaves your browser, and we never receive it.

3.4 Analytics

We use Google Analytics 4 to understand which pages and tools people find useful. It is the only non-essential thing this site stores, and you choose whether to allow it.

We do not run advertising. We have not linked this site to a Google Ads account, we do not enable Google Signals, and we keep Google's advertising features switched off. That is why there is no advertising section on this page and no "Do Not Sell or Share" link — there is nothing being sold or shared for advertising.

We deliberately do not send Google your email address, your account identity, or anything you type into a search box or a tool. Analytics data is not linked to your account, which also means we cannot look it up by name — see section 9.

If your browser sends a Global Privacy Control signal, we treat that as a request to turn analytics off and honour it automatically.

4. Why we are allowed to use it

• To run your account and the hub — because we need to, in order to provide the service you signed up for.
• To keep the site secure and working — because we have a legitimate interest in preventing abuse and fixing faults.
• For analytics — only with your consent, which you can withdraw at any time.
• For the daily digest email — only if you opt in, and you can opt out in your settings at any time.

5. Who else sees it

We do not sell, trade, or rent your personal information. We share it only with the providers we need to run the service:

• Microsoft Azure — hosting and data storage (United States).
• Mailgun — sends our email, including your sign-in codes and magic links. Because sign-in happens by email, Mailgun necessarily handles the messages that let you into your account.
• Google LLC — Google Analytics, only if you allow analytics cookies.

Each is bound by a data-processing agreement and may use the data only as we instruct.

We may also disclose information where the law requires it, to protect our rights or someone's safety, or to prevent fraud or abuse. If MBA Lab is ever sold or merged, your information could transfer as part of that transaction, and we will say so here before it takes effect.

6. Categories of personal information (California)

In the past 12 months we have collected the following statutory categories, and disclosed them for a business purpose to the providers listed in section 5:

• Identifiers — email address, IP address, and a Google Analytics cookie identifier if you allow analytics.
• Internet or other electronic network activity — pages requested and interactions with the site.
• Geolocation data — approximate location inferred from your IP address. We do not collect precise location.
• Commercial information — none. We do not sell anything.
• Sensitive personal information — none. We do not collect it.

We have not sold or shared personal information for cross-context behavioural advertising, and we do not use or disclose sensitive personal information for purposes requiring a right to limit.

7. Where your data goes

We are based in the United States and our providers process data there. If you are in the European Economic Area, the United Kingdom, or Switzerland, transfers rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework — not on your consent.

8. How long we keep it

• Account data — while your account exists, then deleted or anonymised, unless we must keep it to meet a legal obligation.
• Content you create in the hub — until you or your team deletes it, or your account is closed.
• Journal entries — until you delete them, or your account is closed. Only you can delete them, and you can download all of them at any time from the journal page.
• Analytics data — 14 months, after which Google deletes it automatically.
• Your cookie choice — 6 months, after which we ask again.
• Server logs — retained by our hosting provider on its standard schedule.

9. Your rights

Depending on where you live, you can ask us to:

• Access the personal information we hold about you, or get a copy in a portable format.
• Correct anything inaccurate or incomplete.
• Delete your personal information.
• Restrict or object to how we use it.
• Withdraw consent at any time, where we relied on it. Withdrawing is as easy as giving it — use the cookie preferences link in the footer and does not affect what we did beforehand.

We will respond within one month if the GDPR applies to you, and within 45 days under US state privacy laws. If a request is complex we may extend that once, and we will tell you why before the original deadline passes.

We will not discriminate against you for exercising these rights. Your access to MBA Lab and the price you pay — nothing — will not change.

If we refuse a request, we will tell you why, and you may appeal by replying to that decision. We will respond to an appeal within 45 days. You can also complain to your data protection authority: in the EEA, your national supervisory authority; in the UK, the Information Commissioner's Office; in the US, your state Attorney General.

One honest limitation: analytics data is not linked to your account identity, so we genuinely cannot find "your" analytics records by email. That is a consequence of collecting as little as possible. You can stop analytics collection entirely from the cookie preferences link in the footer, which also deletes the analytics cookies already on your device.

10. How we protect it

• Everything is served over HTTPS.
• Data you send us is encrypted in transit, and everything we store is encrypted at rest on disk.
• Sign-in is by one-time code or magic link, so there is no password to steal.
• Session cookies are HTTP-only and secure.
• Rate limiting, security headers, and anti-forgery protection on forms.

No service can promise perfect security, and we will not pretend otherwise. If a breach affects your personal data, we will notify you and the relevant authority as the law requires.

11. Children

Our directory, resource library, and tools are open to everyone, and we do not age-gate them. The hub — the part with accounts — is meant for graduate students and is not directed at children under 18. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has given us personal information, contact us and we will delete it.

12. Changes, and how to reach us

If we change this policy we will update the date at the top. For minor changes, continuing to use MBA Lab is enough. If we materially change what we collect or why — particularly anything relying on your consent — we will ask you again rather than assume silence means yes.

Questions, requests, or complaints: privacy@mbalab.net.