Privacy Policy
Effective Date: 14 Jul 2026 · Version: 2026-07-14
1. Data Controller / Contact
Loquen Lab LLC is the data controller for processing described herein.
Privacy inquiries: [email protected]
Legal / compliance: [email protected]
2. Categories of Data Collected
We may process the following categories (depending on your interactions):
| Category | Examples | Required? |
|---|---|---|
| Account Identifiers | Internal user ID, username, auth provider ID | Yes (core usage) |
| Contact | Email (if provided by identity provider) | Conditional |
| Technical / Usage | IP address, timestamps, user agent, logs, feature flags, error traces | Yes (security & diagnostics) |
| Billing | Subscription plan, payment status, transaction metadata (no full payment card PAN stored) | Conditional (if using paid plan) |
| Ad Platform Data | Campaign metrics, ad performance data, spend data from connected accounts (Google Ads, Meta, Reddit, etc.) | Conditional (if connecting ad accounts) |
| Chat Messages | Conversations with AI assistant, including prompts and AI responses | Conditional |
| AI Prompt / Output | Text you submit to AI features + generated responses (may undergo transient logging) | Conditional |
| Support / Feedback | Tickets, emails, form submissions, session notes | Conditional |
Sensitive categories (e.g., government IDs, health data) are neither required nor intentionally collected. Do not submit them.
3. Sources of Data
- Direct input (account setup, profile edits, chat conversations, campaign configuration).
- Authentication provider (OIDC / OAuth claims via Clerk).
- Automatic collection (logs, metrics, security tooling).
- Connected ad platforms (Google Ads, Meta Ads, Reddit Ads, etc. via Connectors).
- Voluntary user messages or feedback.
- Payment / billing processors (transaction tokens, status from Stripe).
- AI feature interactions (prompts, completions) processed via integrated model providers (OpenRouter).
4. Purposes of Processing
| Purpose | Legal Basis |
|---|---|
| Provide core Platform features | Contract necessity |
| Account & session security | Legitimate interest / Contract |
| Billing & subscriptions | Contract necessity |
| Abuse, fraud & moderation controls | Legitimate interest |
| Analytics & performance tuning (aggregate) | Legitimate interest (minimal / pseudonymized) |
| Legal compliance & enforcement | Legal obligation / Legitimate interest |
| AI analysis & recommendations | Contract necessity / Legitimate interest |
| User communications & support | Contract necessity / Legitimate interest |
| Marketing (if opted-in) | Consent |
5. Legal Bases (Summary — EEA / Similar Regimes)
Where required by data protection laws we rely on: performance of contract, legitimate interest (balanced test maintained), legal obligation, or consent (for optional communications). We avoid relying on consent when another lawful basis is more appropriate.
6. Data Minimization & Retention
We keep personal data only for as long as needed:
| Data Type | Retention | Notes |
|---|---|---|
| Account & profile | Life of account + short grace (≤90 days) | Basic identifiers |
| Logs (standard) | 30–180 days | Security, diagnostics, aggregated thereafter |
| Chat messages | Until deleted by user or retention policy | May be retained anonymized |
| Billing records | 7–10 years (jurisdictional accounting) | Required for audit |
| AI prompts/output logs | ≤30 days (service improvement / abuse) | May be aggregated earlier |
| Ad platform data | Life of Connector + ≤90 days | Cached campaign metrics |
| Backups | Rolling cycles (e.g., 30–60 days) | Encrypted at rest |
Upon expiry we delete or irreversibly anonymize.
7. Security Measures
Controls include: transport encryption (TLS), role-based access, least privilege, audit logging, anomaly detection, secret management, routine patching, segregated environments, encryption at rest for key data stores. No system is perfectly secure; report suspected issues to [email protected].
8. Data Sharing & Disclosures
We do NOT sell personal data. We may share with:
- Infrastructure & hosting providers (cloud, CDN).
- Payment processors (Stripe — processing subscription payments).
- AI model providers (OpenRouter — processing AI prompts and generating responses).
- Analytics / monitoring (aggregated telemetry — Sentry, PostHog).
- Authentication provider (Clerk — identity verification).
- Moderation / security tooling (threat detection).
- Professional advisors (legal, accounting).
- Authorities when legally required or to protect rights, safety, or comply with law.
Third parties are bound by contractual obligations (data processing agreements) where required.
9. International Transfers
Where data moves outside your jurisdiction we implement appropriate safeguards (e.g., Standard Contractual Clauses, transfer risk assessments). Additional measures (encryption / pseudonymization) may be applied.
10. AI & Automated Processing
AI features may analyze prompts and produce campaign recommendations, ad copy, and analyses. We do not use your private campaign data to publicly train models without consent. Limited human review may occur for abuse detection or quality evaluation under confidentiality obligations. No solely automated decision produces legal or similarly significant effects without recourse.
11. Cookies & Similar Technologies
We primarily rely on essential session tokens and minimal local storage for preference or anti-abuse markers. Non-essential marketing / tracking cookies are not currently deployed. If adopted, a separate consent banner will describe categories and preferences.
12. Your Rights (Subject to Jurisdiction)
Rights may include: access, rectification, erasure, restriction, objection, portability, withdrawal of consent (prospective), complaint to supervisory authority, opt-out of certain processing.
Exercise via [email protected] (we may need to verify identity). Responses typically within 30 days.
13. Children
The Platform is not directed to children under 16 (or lower age defined locally). We do not knowingly collect such data. If you believe a child provided information, contact us for removal.
14. Third-Party Links / Integrations
External links or plugins (including ad platform Connectors) operate under their own policies; review them separately. We disclaim responsibility for third-party practices.
15. Data Breach Procedure
We maintain incident response playbooks. In the event of a breach impacting personal data, we will notify affected users and/or authorities in accordance with applicable law (content: nature, categories, mitigation steps, contact).
16. Aggregated & Anonymized Data
We may aggregate or anonymize data for statistical insights (performance metrics, adoption trends). Such information no longer constitutes personal data.
17. Automated Communications
Transactional or security emails (e.g., password reset, policy acceptance, moderation) are mandatory. Optional marketing requires prior consent and includes an opt-out mechanism.
18. California / Regional Addenda
If required (e.g., CCPA / CPRA), additional disclosures (categories sold/shared = none, right to limit use of sensitive information = not applicable presently) may be published as an Addendum.
19. Changes to this Policy
Revisions will carry a new “Effective Date”. Material changes may trigger re-acceptance. Maintain awareness by checking periodically.
20. Contact
Loquen Lab LLC
418 Broadway STE N, Albany
Albany County, New York 12207 USA
Privacy & data rights: [email protected]
Security: [email protected]
Legal notices: [email protected]
By continuing to use the Platform you acknowledge you have read and understood this Privacy Policy.