Privacy Policy

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?

In Short: We process your information only when we have a lawful basis to do so — for example, when it’s needed to provide our Services, when you’ve given consent (such as connecting a marketing account), when we must comply with law, or when it’s necessary for our legitimate business interests.

---

If you are located in the EU or UK

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the legal bases on which we rely to process your personal information. Depending on the context, we may rely on one or more of the following:

1. Consent

We rely on your consent when you:

• Connect or authorise a third-party marketing, analytics, or e-commerce account (e.g., Google Analytics, Google Ads, Shopify, Facebook, LinkedIn) to the So What Labs Platform.

• Allow us to access and analyse data from those external accounts.

• Opt in to receive marketing communications or AI-powered recommendations.

You may withdraw your consent at any time from within your account settings or by contacting us. Withdrawal will not affect processing already carried out.

2. Performance of a Contract

We process your information where it is necessary to perform our contractual obligations to you — for example:

• To create and maintain your So What Labs account;

• To deliver analytics, dashboards, and insights from your connected data sources;

• To provide customer support and billing.

3. Legitimate Interests

We may process personal data when it is necessary for our legitimate business interests and those interests do not override your fundamental rights and freedoms. These include:

• Operating, maintaining, and improving the multi-app So What Labs Platform;

• Performing aggregated or anonymised analytics to improve our user-facing features and services.

• Securing our infrastructure (including BigQuery-based systems) and preventing fraud or abuse;

• Understanding how users interact with our apps to improve user experience;

• Communicating relevant product updates and offers.

Whenever we rely on legitimate interests, we perform a balancing test to ensure your privacy rights are not disproportionately affected.

4. Legal Obligations

We may process personal data where it is necessary to comply with legal or regulatory duties — for example, responding to lawful requests from public authorities, maintaining financial records, or fulfilling tax, accounting, or audit requirements.

5. Vital Interests

We may process information when necessary to protect your vital interests or those of another person, such as in emergencies involving potential threats to life or safety.

---

If you are located in Canada

We process your personal information under express or implied consent, depending on the situation. You may withdraw consent at any time.

In exceptional cases, applicable law may allow processing without consent, including (for example):

• Where collection is clearly in the individual’s interests and consent cannot be obtained in time;

• For investigations, fraud detection, or security incidents;

• For business-transaction due-diligence, subject to legal safeguards;

• To comply with court orders, subpoenas, or legal proceedings; or

• Where the information is publicly available and permitted by regulation.

6. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

In Short: We share personal information only when it’s necessary to operate our Services, comply with the law, or complete a business transaction — and always under appropriate safeguards.

We may share your personal information in the following situations:

a. Service Providers and Sub-Processors

We work with a limited number of trusted third-party providers who perform services on our behalf, such as data hosting, analytics, payment processing, customer support, and AI-powered language interpretation.
These providers are bound by contractual obligations to keep your data secure, use it only for the agreed purposes, and comply with applicable privacy laws.
Our current key subprocessors include:

b. Third-Party Integrations Authorised by You

When you connect external accounts (such as Google Analytics, Google Ads, Shopify, Facebook, or LinkedIn) to your So What Labs account, we access data from those platforms only with your explicit consent and through their official APIs.
We do not share your connected-account data back to those providers or with any unauthorised third party.

c. Business Transfers

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or part of So What Labs Ltd by another entity.
If such a change occurs, we will ensure your personal data continues to be protected in line with this Privacy Policy.

d. Legal Requirements and Protection of Rights

We may disclose information if required by law, regulation, or court order, or when necessary to:

• Respond to lawful requests by public authorities;

• Enforce our agreements or policies;

• Protect the rights, property, or safety of So What Labs, our users, or others.

e. Aggregated or Anonymised Data

We may share aggregated or anonymised analytics for research or benchmarking. This information cannot reasonably be used to identify you.

---

7. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: Yes — we use cookies and similar technologies to operate our Services, analyse usage, and enhance user experience.

We and our partners may use cookies and similar tracking technologies (such as web beacons, pixels, and local storage) to collect or store information when you interact with the So What Labs Platform.
These technologies help us to:

• Maintain and secure your login session;

• Measure traffic and usage across different So What Labs apps;

• Understand performance and improve our Services; and

• Provide personalised experiences where you have consented.

You can learn more about the categories of cookies we use and how to manage or refuse them in our Cookie Notice.

8. HOW DO WE HANDLE YOUR SOCIAL LOGINS?

In Short: If you choose to register or log in using a social-media account, we receive limited profile information to verify your identity and create your So What Labs account.

Our Platform allows you to register or sign in using third-party social-media credentials (for example, Facebook, Google, or LinkedIn).
When you do so, the social-media provider will share certain information with us so that we can authenticate your login. The exact data depends on the provider and your privacy settings, but may include your name, email address, profile picture, and other public-profile fields you authorise.

We use this information only for:

• creating or linking your So What Labs account;

• verifying your identity and allowing secure access to our Services; and

• personalising your user profile where appropriate.

We do not post on your behalf or access your social-media contacts, activity, or messages.
We recommend reviewing your social-media provider’s privacy notice to understand how they collect, use, and share your information, and to adjust your privacy settings as you prefer.

---

9. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information only for as long as necessary to deliver our Services, comply with legal requirements, or resolve disputes — and we delete it within 30 days after your account is closed or a connected service is disconnected.

Data from connected third-party marketing/ecommerce accounts (including Google API-based properties) will be deleted or anonymised within 30 days after the user disconnects the account or deletes their So What Labs account.
This includes both the information you provide directly and the data imported from connected marketing or e-commerce accounts (for example, Google Analytics, Google Ads, Shopify, Facebook, LinkedIn).

Specific retention practices

• Account Data: Retained for the duration of your account. When you delete or close your account, all associated personal information is permanently deleted or anonymised within 30 days, unless a longer period is required by law (for example, for tax, billing, or fraud-prevention purposes).

• Connected-Account Data: Retained only while the integration remains active. If you disconnect a linked account, all data imported from that service is deleted or anonymised within 30 days of disconnection.

• Analytics and BigQuery Storage: Data stored in Google BigQuery is encrypted in transit and at rest, periodically reviewed, and purged or anonymised once it is no longer needed for analytics, reporting, or AI-driven insights.

• Backups: Archived copies are automatically purged after their backup-retention cycle ends. During this period, they are isolated from all active systems and not used for any processing.

After the 30-day post-deletion period, all remaining personal and connected-account data are permanently removed from our active systems and backup archives.
If immediate deletion is not technically feasible, the data is securely isolated and retained solely for legal or compliance purposes until deletion becomes possible.

10. HOW DO WE KEEP YOUR INFORMATION SAFE?

In Short: We protect your information using a combination of administrative, technical, and physical safeguards, including encryption and secure cloud infrastructure.

We maintain appropriate and reasonable organisational and technical security measures to protect any personal information we process.
These measures include:

• Encryption in transit and at rest for all customer data stored in Google Cloud BigQuery and other systems;

• Multi-factor authentication (MFA) and least-privilege access controls for all internal systems;

• Regular security reviews, logging, and monitoring of access to cloud environments;

• Data isolation between customer accounts; and

• Secure development and deployment practices consistent with modern cloud-security standards.

All third-party service providers (including Google Cloud Platform, Stripe, and OpenAI) are required to implement comparable security safeguards and comply with applicable privacy regulations.

Despite our efforts, no electronic transmission or storage technology can be guaranteed to be 100% secure.
While we continually work to strengthen our protections, we cannot guarantee that unauthorised third parties will never defeat our security measures.
You should access the So What Labs Platform only through secure networks and take appropriate precautions to protect your account credentials.

---

11. DO WE COLLECT INFORMATION FROM MINORS?

In Short: No. Our Services are intended for users aged 18 and older.

We do not knowingly collect personal data from, or market to, children under 18 years of age.
By using the So What Labs Platform, you represent that you are at least 18 years old or are the parent or legal guardian of a minor who is permitted to use the Services under your supervision.

If we become aware that we have collected personal information from a user under 18 without verifiable parental consent, we will deactivate the account and delete the data promptly.
If you believe a child under 18 has provided information to us, please contact us at support@sowhatlabs.com so we can take appropriate action.