Privacy policy | RAW Labs

RAW Labs SA ("we", "our", or "us") respects your privacy and is committed to protecting your personal data. This policy explains what information we collect when you visit our website, how we use it, and the choices you have.

1. Information we collect

Information you provide

When you contact us by email or through our contact form, we collect:

Your name and email address
Company name and job title, if provided
The content of your message
The type of request and the page and button used to open the form
The agent you selected and its kind, when you enquire from an agent's details

We store contact form submissions in PostHog and keep a prospect record in Notion so our team can respond to and follow up on your enquiry. The prospect record includes your submitted contact details, a message preview, request category and source, and our sales follow-up notes. Submitting the form alone does not subscribe you to marketing emails. These contact records are separate from website analytics: we do not connect your browsing identifier to your name, email or message.

When you request Cloud early access, we store your email address, signup time, the page and button used, and your request to receive a Cloud launch email in PostHog, with a corresponding prospect record in Notion for follow-up. Joining early access does not require newsletter consent or enable website analytics. You can withdraw your request or ask us to delete it by emailing hello@raw-labs.com.

On the contact and Cloud early-access forms, you can separately choose to receive RAW Labs news and product updates. This unchecked option is voluntary and does not affect how we handle your enquiry or early-access request. We record the choice, the notice shown and its version, the form source and the time of your request. Before adding a new subscriber to newsletter campaigns, we ask them to confirm through an email link and record that confirmation separately. Confirmation links expire after 48 hours. Marketing emails include an unsubscribe link; an existing unsubscribe or delivery block is not cleared by submitting a form.

The article signup in our footer and blog posts asks for new engineering articles by email. Its separate, unchecked option requests product updates and occasional offers. We record and confirm these choices separately; subscribing to articles does not subscribe you to offers or to Cloud launch emails. Our dedicated subscribe page offers one signup for engineering articles, product updates, and occasional offers, with all three described before you subscribe. The same confirmation and unsubscribe controls described above apply.

The release email signup on our releases page asks for an email when a beta, release candidate or stable version of Enterprise OpenClaw ships, and for security fixes. We record your email address, the notice shown and its version, the page and the time of your request in PostHog, separately from article, offer and Cloud choices: subscribing to release emails does not subscribe you to anything else. The same confirmation and unsubscribe controls described above apply.

Form security

When enabled, Cloudflare Turnstile helps prevent automated spam. It processes technical information about your browser and network when a form's security check loads. When the check is disabled, the form does not load Turnstile or send information to Cloudflare. Our hosting provider, Vercel, processes website requests, contact submissions and early-access requests to deliver the site and operate the forms.

Basic page-request counts

We count ordinary requests for public pages reaching our hosting provider, including before you choose and after you reject optional browser tracking. Our server sends PostHog only the public page path and UTC day, with technical labels and a new random event identifier for each count. It does not send your IP address, country, browser or device details, referrer, query string, cookie preference, or form details. These counts do not use analytics cookies, fingerprinting, additional browser tracking requests, or an identifier that recognizes you across requests. They are not linked to our browsing or contact records.

PostHog stores separate count events and calculates totals from them; these are not daily totals aggregated before transfer. The provider also receives our server connection and ingestion metadata. The counts can include automated requests and miss pages served entirely from your browser's cache, so they are not a count of individual people. Ordinary hosting and security processing remains separate from these counts.

Limited page measurement in Switzerland

Where enabled, we use our hosting provider's country estimate to apply limited page measurement to visitors in Switzerland before a choice is made. Elsewhere, or when the country is unknown, browser measurement waits for acceptance. The notice on the page tells you when limited measurement applies and lets you stop it with Reject.

Limited measurement records page visits and departures, available visit duration and scroll measurements, referring domains, broad browser and device categories, and Switzerland as the country. Temporary identifiers remain in the open page's memory; we do not store them in analytics cookies, local storage or session storage. They can connect page navigation within that open document. These event records are pseudonymous, not anonymous totals or a reliable count of returning people. PostHog receives network requests; additional IP-based location enrichment is disabled in this mode. We exclude campaign tags, click tracking, form events, heatmaps, recordings and fingerprinting.

Reject, withdrawal, or a browser privacy signal stops this measurement too. An expired or earlier saved choice does not enable it. Accept starts a fresh measurement identity without linking the earlier visits to it. Retention for these event records is described below.

Optional website analytics

Browser measurement requests are forwarded through our website's hosting provider, Vercel, to PostHog's EU service. This helps reduce requests lost to domain-based blocking. Your cookie choices and browser privacy signals still control whether browser measurement runs. We remove website cookies, authorization headers and the request's referrer header before forwarding these requests.

With your permission, we use website analytics to understand how visitors find and use our site, and to improve it. We collect page visits, time and scroll depth, clicks, heatmap positions, browser and device information, page-performance measurements, referring domains, and campaign tags. We do not send JavaScript errors or console logs to our analytics provider. Our analytics provider processes your network address to estimate your country, region or city; we do not request your device's precise location.

A random first-party identifier recognizes a returning browser and connects consenting visits to contact-form conversion events. We count a successful conversion only after our server confirms receipt. Analytics events contain no form answers and are not linked to the name, email or message stored in our separate contact records. Browser identifiers are pseudonymous, not a guarantee of anonymity or an exact count of people.

We exclude URL query strings and fragments from recorded URLs. Separately, we allow limited campaign tags (source, medium, campaign, content, term and campaign ID) to measure which campaigns lead to visits and inquiries. Advertising click identifiers are excluded. Campaign links must not contain personal information in their tags. We do not run advertising pixels, create remarketing audiences or send these events to advertising platforms through this website integration.

Optional session recordings

As part of optional website analytics, we record page layout and styling, mouse movements, clicks and scrolling so we can investigate usability problems. Public website text, such as headings, navigation and marketing copy, may be visible. Input values and other text are masked before transmission. Forms, embedded frames and canvases are blocked. We exclude console logs and network request or response bodies and headers. Recordings begin only after you accept optional analytics.

Before a choice, after rejection, or after withdrawal

Detailed browser analytics and recordings stay off unless you accept. The limited Swiss measurement described above may run before a choice. Reject stops browser measurement, including that limited mode. The basic unlinked server page-request counts described above may continue. We do not replace rejected tracking with cookieless fingerprinting. Ordinary hosting and security processing still occurs to deliver the website, and contact details you voluntarily submit are processed so we can respond. Blocking optional tracking does not block the site or form.

2. Purposes and legal bases

We use your consent for optional analytics, campaign measurement and recordings. You can withdraw it at any time; withdrawal does not affect processing that was lawful before withdrawal. For the limited Swiss measurement described above, we rely on our interest in understanding and improving the website, provide notice, and honor objections. We process inquiries to respond to your request, including steps before entering a contract where applicable. We use your permission to send the Cloud launch email you request and, if you opt in separately and confirm, RAW Labs news and product updates; you can withdraw either permission at any time. We rely on our legitimate interests in operating and securing the website for necessary hosting and abuse prevention. We use basic page-request counts to understand demand for public pages without recognizing visitors. Any personal data processed to produce those statistics requires an applicable legal basis, such as our legitimate interests in understanding site usage, subject to your rights. Server-side processing alone does not make analytics exempt from privacy law.

3. Cookies and your choices

Accept permits optional website analytics, including masked session recordings. Reject stops browser measurement; basic unlinked server page-request counts may continue. Before acceptance, limited Swiss browser measurement may also apply as described above. Use in this policy or the footer to change your choices.

We remember your preference in your browser for 180 days, equally for acceptance and rejection. We ask again when the preference expires or its scope changes. If storage is unavailable, your choice applies only to the current document. We also honor browser Global Privacy Control and Do Not Track signals by keeping optional browser collection off.

After acceptance, a first-party measurement cookie with a 180-day lifetime and temporary session markers associate activity with a browser. Rejecting stops browser collection and clears this site's measurement identifiers. A consent flag may remain to remember the opt-out. Withdrawing consent stops future browser collection; to request deletion of previously collected data, contact us.

4. Data sharing

We use contracted service providers for the following purposes:

PostHog — website measurement and inquiry storage - our analytics and interaction-recording provider processes basic page-request counts, limited Swiss measurement and optional browsing data described above. Our provider for storing inquiries holds contact messages and the details you submit so our team can respond.
Notion — prospect records and sales follow-up - stores contact and Cloud early-access details, request categories, sources and dates, message previews, and our follow-up notes. We do not send browsing activity or newsletter-only signups to this prospect database.
Cloudflare - Turnstile spam prevention and security checks for our forms, only when enabled.
Vercel - website hosting and server-side processing of contact and early-access submissions, and forwarding browser measurement requests to PostHog.

Font files are served from our website; your browser does not contact Google to load them.

We do not sell your personal information. Website analytics is hosted in the European Union. Our providers and their subprocessors may also process data in other countries, including the United States. Where required, transfers rely on applicable adequacy decisions or contractual safeguards such as Standard Contractual Clauses. Contact us for information about the safeguards applicable to your data.

5. Data retention

Messages and contact details you send us - retained for as long as needed to respond and follow up, subject to our providers' retention settings. You can contact us to request deletion. This covers inquiry records in PostHog and prospect records in Notion.
Cloud early-access requests - kept until we have fulfilled your launch notification request or you withdraw it, subject to our providers' retention settings.
Newsletter requests - kept while you wish to receive the newsletter. We keep the minimum record needed to honor an unsubscribe and document your choices.
Website analytics, including page-request counts and limited Swiss measurement - PostHog's current plan makes events available for queries for seven years. This is not an automatic deletion deadline: event records can remain stored beyond that window until we explicitly delete them. We do not currently apply a scheduled deletion deadline to browsing events or page-request counts. You can request deletion by contacting us; unlinked counts do not identify which requests belonged to you. Session recordings have a 30-day retention setting; deletion can take a short time after that period expires. We may keep statistics that no longer identify a browser for longer.

6. Your rights (GDPR)

Depending on the law that applies to you, including the GDPR and Swiss data protection law, you may have the right to:

Access the personal data we hold about you
Correct inaccurate or incomplete data
Request deletion of your data
Object to processing
Receive your data in a portable format
Withdraw consent at any time
Complain to your local data protection authority or the Swiss FDPIC

To exercise any of these rights, please contact us.

7. Data security

We use appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction.

8. Children's privacy

Our website is not directed at children under 16. We don't knowingly collect personal information from anyone under that age.

9. Changes to this policy

We may update this policy from time to time. When we do, we'll post the updated version on this page and refresh the "Last updated" date above.

10. Contact us

Questions about this policy or our data practices? Email us at hello@raw-labs.com.

RAW Labs SA
Switzerland