Last updated September 2026
The short version. Ebor Labs holds very little information about anyone. This website sets no cookies and runs no analytics. If you email, that email is held in a mailbox.
Most of the personal data Ebor Labs touches belongs to its clients' candidates, and Ebor Labs handles it on their instructions rather than for its own purposes. If you sat an assessment, the organisation that trained you is the one to ask first.
Ebor Labs is a sole trader business operated by Mohammad Ibrahim, registered in England, building assessment, certification and data-readiness software.
| Business | Ebor Labs |
|---|---|
| Address | To be confirmed |
| Contact | ibrahim@eborlabs.com |
| ICO registration | To be confirmed |
Data protection law distinguishes between deciding what happens to personal data and simply handling it for somebody else. Ebor Labs does both, in different contexts, and the distinction changes who you should contact.
If you email an enquiry, ask for a quote, or become a client contact, Ebor Labs is the controller of that information. In practice this is your name, your email address, your employer, and whatever you chose to write.
It is held because there is a legitimate interest in answering you and in keeping a record of business correspondence. It is not sold, not shared for marketing, and not used to profile anyone.
When a training provider or employer uses the assessment platform, they decide what is collected and why. They are the controller. Ebor Labs provides and maintains the platform on their instructions, which makes it a processor.
If you sat an assessment and want to see, correct or delete your record, contact the organisation that ran your training. They can do it directly. Ebor Labs will help them, but will not act on their data without them.
That last point is deliberately narrow. Where a candidate is granted extra time, the platform records that it was authorised. It does not record why, and it is designed so that a diagnosis or medical detail cannot be stored against a person.
Ebor Labs uses a small number of suppliers to run the platform. These are its sub-processors, and they are named here because a client's compliance team will reasonably want to know.
| Supplier | What it does | Where |
|---|---|---|
| Supabase | Database — every candidate record | London, United Kingdom |
| Netlify | Hosting and the application programming interface | Content delivery network |
| Resend | Certificates, invitations, verification codes, reminders | Ireland |
| Cloudflare | Domain name service and registrar | Content delivery network |
| Microsoft 365 | Business mailbox | United Kingdom and European Union |
Candidate records are held in the United Kingdom. Email in transit passes through Ireland. Where a candidate signs in with a Microsoft or Google account, that provider confirms their email address to the platform and nothing further is shared.
The data-readiness tools at einvoicecheck.eborlabs.com run entirely inside your own browser. Files you open there are never sent anywhere, are not uploaded, and are not visible to Ebor Labs. Closing the tab ends it. This is a property of how the tools are built, not a policy that could change quietly.
If you submit an enquiry form on that site, the details you type are sent to Ebor Labs. That is a separate act from using the tools.
Nothing on the platform is deleted without two people approving it, and every deletion is recorded.
This website sets no cookies, loads no tracking pixels, and runs no analytics. Nobody is counting your visit.
The assessment platform sets one item in your browser to keep you signed in during a session. It is necessary for the platform to work, expires, and is not used to track anyone across other websites.
Web fonts on this page are served by Google Fonts, which means your browser requests a font file from Google and Google's servers see the request.
Under UK data protection law you may ask to see the personal data held about you, to have it corrected, to have it deleted where there is no legal reason to keep it, to restrict or object to how it is used, and to receive it in a portable form.
For anything Ebor Labs decides, write to ibrahim@eborlabs.com and you will get an answer within one month. For anything on a client's platform, ask the organisation that trained you — they hold the decision.
If you are unhappy with the response, you can complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113. You are welcome to raise it here first, but you do not have to.
Many candidates are in the United Arab Emirates while the platform is run from the United Kingdom. Records are held in London, which means UK data protection law applies to how they are kept. Clients in the UAE remain subject to their own local requirements, and the written agreement between Ebor Labs and each client sets out who is responsible for what.
If this notice changes in a way that affects you, the date at the top changes with it. Clients are told directly rather than being expected to check.
