Privacy Policy

Last updated: November 2026

Who we are

NO LABEL is operated by Berta Amelinaite, an individual sole proprietor, who is the data controller for the personal data described here and decides why and how it is processed.

What we collect and why

• Account details (email, name, sign-in credentials): to create and secure your account.
• Brand information from the analysis wizard (brand name, website, competitors, goals): to produce reports.
• Workspace content (images, captions, briefs, calendars, client details, comments): to provide the workspace.
• Usage data (plan, storage, AI credits used): to run the service and enforce plan allowances.
• Technical data (IP address, browser information, server logs): for security and troubleshooting.
• Email address: to send account and service messages.

Legal basis

• Contract: providing the service you signed up for.
• Legitimate interests: security, fraud prevention and improving the product.
• Legal obligation: tax and accounting records.
• Consent: where we ask for it, which you can withdraw at any time.

Who we share data with

• Lovable: managed application hosting, account services, database, file storage, email delivery and routing of research and AI requests. This includes account details, workspace content, service messages and technical service data.
• Cloudflare: application delivery infrastructure, which processes web requests and associated network and technical information.
• OpenAI, reached through Lovable's AI gateway: processes prompts, relevant brand or workspace information and any images included in an AI request to generate analyses and content. Do not include information you are not authorised to share.
• Firecrawl, reached through Lovable's connector service: processes website URLs, research search queries and public page content for research. Public websites may themselves contain personal information.
• Google: receives network and browser request information when your browser loads the site's fonts. If you choose Google sign-in, Google also processes that sign-in under its own privacy terms.
• Social platforms you choose to connect: receive connection details and content when you authorise the relevant action. For example, TikTok receives content submitted for publishing; connecting an account does not itself publish content.
• Paddle, our Merchant of Record: sale of our products, subscription management, payments, tax compliance and invoicing. Paddle collects your payment details directly; we never see your card number.
• Professional advisers (legal, accounting) where needed, and authorities where required by law.

We do not sell your data or use your workspace content to train our own AI models. Provider processing and retention are governed by the applicable service terms; requesting that an AI response is not stored is not a guarantee of zero retention by every provider.

Data locations and international transfers

Service providers may process information outside your country, including in the United States. A database hosting region does not establish the location of all application, email, AI or research processing. We do not currently make a country-specific residency or zero-retention promise. Applicable international transfer arrangements and provider agreements must be confirmed before accepting customer data where such arrangements are required by law.

Retention and deletion

Cancellation stops future recurring billing; access continues according to your paid subscription period. Our workspace retention policy is 30 days after subscription termination, meaning the end of that paid period, not the date you request cancellation. You may request earlier deletion. After those 30 days, workspace content is to be deleted manually, except information that must be retained to meet legal obligations. There is no automatic 30-day deletion function. Request handling and deletion require manual action.

Account closure and requests for a copy of your data are also handled manually. Use the Your data section of your account profile to submit a request; the buttons submit requests, not an immediate export or deletion. Deletion requests also appear in Agency Settings. Confirmation records a timestamp and marks the account pending deletion. We aim to review requests within 30 days; this is a review target, not an automatic deletion deadline. We send an account confirmation where email delivery is available, and show notification and billing status in Settings. An administrator reviews shared ownership and client content before completing removal manually. Billing, security and request-handling records may need different retention periods where required by law; workspace deletion does not itself erase records retained independently by Paddle.

Security

The configured customer-file and avatar storage buckets are private. Database row-level access rules restrict ordinary customer access according to agency membership and invited-client permissions. Authorised presentation shares and temporary file links provide limited access to the content explicitly shared; authorised platform support may also access data for support purposes. Private storage does not mean that an authorised recipient cannot view a shared file.

The service is configured to use HTTPS endpoints. Production transport, backup availability and recovery must be verified separately before launch; we do not promise a tested recovery time or backups of uploaded files.

Cookies and local storage

The app stores sign-in and preference data in your browser so you stay signed in and settings are remembered. These include account-session storage, interface preferences such as sidebar state, and your selected calendar holiday markets. Our product records also include account-linked usage events. Clearing browser storage removes local preferences and may sign you out. Paddle checkout and optional connected sign-in services may use their own cookies or storage under their respective privacy notices; the complete checkout cookie inventory has not yet been verified.

Your rights

Depending on where you live, you can request access to, correction, deletion, restriction or portability of your personal data, object to processing, and withdraw consent. We aim to respond within one month. You can also complain to your local data-protection authority.

Contact

Berta Amelinaite (sole proprietor), operating NO LABEL
For manual data-copy and deletion requests, use Your data in your account profile.