Privacy policy

Who the controller is

• Controller: Codelabs Studio, S.L.
• Tax ID (CIF): B88708797
• Address: Pasaje Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), Spain
• Registry details: Companies Registry of Málaga (Registro Mercantil de Málaga), sheet MA-198508, entry 1
• Privacy email: show the privacy email
• General contact: show the contact email

What data we process

• Waitlist: your email address, the language you signed up in and the page you signed up from.
• Account: name, email address and password. The password is stored by our identity service as a hash; we never see it in plain text.
• Workspace and projects: the names, websites and settings you enter, the people you give access to and their role.
• Connected social accounts: the identifiers and names of the pages, accounts, organisations and channels you authorise, and the access tokens each platform gives you. Per-platform details are in Platform data.
• Content: the text, images and videos you schedule or publish, and the log of each post (date, destination, result and link).
• Reviews and campaigns: the address of your profiles on review sites, their rating and number of reviews (aggregate public figures, never individual reviews or who wrote them), and the details of your ad accounts that you enter by hand (status, budget, spend, objective).
• Reference posts: the public metadata of third-party posts that you or your tools save in order to study their techniques (network, link, the author's public handle, public engagement figures, a short summary of the hook and call to action, and the techniques used). We do not store the images, videos or full text of those posts.
• Your own Apple Ads account (if you connect it): the private key we generate for you (stored encrypted; the dashboard only ever shows the public one), the client, team and key identifiers, the ad account you choose, and the campaigns and spend we read from it.
• Meta Ads and Meta insights (if you connect them): the data of your Meta Ads accounts and campaigns (campaigns, budget and spend) and, from your Pages and Instagram accounts, the reach, engagement and clicks of posts and campaigns. The access token is stored encrypted.
• Google Ads (if you connect it): the data of your Google Ads accounts (accessible accounts, campaigns, spend and metrics). We request Google's adwords scope, and the access tokens are stored encrypted.
• Plausible per project (if you set it up): the site you register in your Plausible, your Stats API key (encrypted) and the visit and conversion figures grouped by UTM (source, medium, campaign and content). These are aggregate figures; we do not store data about individual visitors.
• Competitors' public ads: if you use competitor analysis, we read from the Meta Ad Library data that Meta publishes (text, dates, platforms and reach of third-party ads). It is public business data; we do not link it to individuals.
• Creatives: the brief you send us to request an image or a video (product, description, angle, style, format, channel, aspect ratio and language) and the piece that is generated.
• Use of the service: activity figures for your account (sign-ins, days of use and projects created) and, if you accept analytics, how you navigate the dashboard.
• Reason for leaving: whatever you choose to tell us when you cancel or close your account. It is optional.
• Technical data: IP address, browser, and access and error logs, needed to keep the service secure.

We do not request special categories of data and do not need them to provide the service.

What we use it for and on what legal basis

We do not sell your data, we do not advertise with it and we do not use it to train artificial intelligence models. We do not make automated decisions with legal effects about you.

How we analyse the use of LaunchSuite

We want to understand what fails and what we do not explain well. To do so we analyse how the service is used: the activity figures of your account, the questions put to the website's help assistant, voice conversations with that assistant and the opinions you send us. The projects, campaigns, posts and contacts of your launches are not part of this analysis: from them we only use activity figures (for example, how many projects you have), never their content.

• Heatmaps and session recording: only in the dashboard and only with your consent in the cookie banner, which you can withdraw at any time. In a recording, the page text and whatever you type are masked; images on screen may be visible.
• Personal emails: we use those figures to decide whether to write to you, for example to offer help if you have not created your first project after three days, or to ask you one question if you cancel. If you close your account we do not write to you. This is based on our legitimate interest (art. 6.1.f GDPR) and you can object by writing to show the privacy email, with no need to give reasons and without losing the service.
• No automated decisions: that analysis only serves for a person to get in touch with you. No automated decision producing legal effects on you or similarly affecting you is taken with it: it does not change your price, your plan or your access.
• Controller: Codelabs Studio, S.L., PASAJE Federico García Lorca, 6, 3º E, 29130 Alhaurín de la Torre (Málaga), Spain.

How long we keep it

• Waitlist: until you unsubscribe or, at most, 24 months after you signed up.
• Account, projects and content: while your account is active. If you close it, we delete them within 30 days at most.
• Social access tokens: while the connection is active. They are deleted as soon as you disconnect the account, revoke the permission on the platform or ask us to delete your data.
• Apple Ads account: while the connection exists. When you disconnect it from the dashboard we delete the whole record (encrypted private key, public key, client, team and key identifiers, and the chosen account). It cannot be disconnected while Apple campaigns created from the platform exist. If you close your account, it is deleted with the workspace after 30 days.
• Meta Ads and Meta insights: the token, while the connection is active: it is deleted when you disconnect and the destinations are deactivated. The figures already read (campaigns, spend, reach, engagement and clicks) are kept while the project exists and are deleted with it or when you request deletion.
• Google Ads: the tokens, while the connection is active. When you disconnect we revoke them with Google and delete them. It cannot be disconnected while Google Ads campaigns created from the platform are active. The figures already read (campaigns, spend and metrics) are kept while the project exists and are deleted with it or when you request deletion.
• Plausible: the site and the key, while you keep it configured. When you remove it in the project settings we delete the site, the key and the UTM figures we stored; if you close your account, they are deleted with the project after 30 days.
• Meta Ad Library data: while the project exists, deleted with it.
• Creatives: the brief and the generated piece, while the project exists.
• Reason for leaving: deleted with your account; if you only cancel, kept for as long as your account exists.
• Security logs: up to 90 days.
• Deletion requests: we keep the request code and status (without the deleted data) for 12 months, to be able to show it was handled.
• Billing data: for the periods required by law (up to 6 years under the Spanish Commercial Code).

Who we share it with

Only with providers we need to run the service, under a data processing agreement where applicable, and with the platforms you choose to connect:

• Hetzner Online GmbH: dedicated server in Germany (European Union) hosting the application and the database.
• Email: our own mail server (Mailcow) on our infrastructure, for service emails.
• Cloudflare, Inc.: DNS and content delivery network, which protects and speeds up access to the website.
• Meta, LinkedIn, Google (YouTube) and TikTok: when you connect your accounts, we send them what you schedule for publishing. Each platform processes that data as a controller under its own policy.
• Apple, Meta, Google Ads and Plausible: when you connect your Apple Ads, Meta Ads or Google Ads account, or your Plausible, we make read requests to their APIs with your credentials to bring in campaigns, spend and results. With Google Ads we also create campaigns paused, and pause or activate them only when the owner approves. Apple, Meta and Google process that data as controllers under their own policies; Plausible processes it according to your own account's settings. For competitors' public ads we query the Meta Ad Library, which contains public data.
• Data received from Google APIs (Google Ads and YouTube): the use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We only use that data to provide the features you connect, we do not sell it or use it for advertising or to train models.
• PostHog (hosted in the European Union): only if you accept analytics in the cookie banner. It acts as a processor and receives an internal identifier of your account, never your email, together with how you navigate the dashboard.
• AvatarSuite (Codelabs Studio S.L.): a product of the same company, acting as a processor. It only receives the brief of the creative you request and returns the generated piece.
• Zernio: only if you choose that gateway to publish to a network. It acts as a processor: we send it the content and destination of the post. Each workspace has its own profile in Zernio and an access key limited to that profile, which we store encrypted: the accounts you connect stay in your profile and we only publish to an account after checking that it belongs to your workspace.

We do not disclose data to third parties unless required by law.

Transfers outside the European Economic Area

Our servers are in the European Union. Some providers (such as Cloudflare, or Zernio if you choose it) or the platforms you connect may process data outside the European Economic Area. In those cases the transfer relies on a European Commission adequacy decision (such as the EU-US Data Privacy Framework) or on standard contractual clauses.

Language model providers and international transfers. The chat assistant on this site runs on AgenteUno. Chat messages are processed by Cerebras Systems Inc. (United States) as a processor. Cerebras Systems Inc. is not on the EU-US Data Privacy Framework (DPF) list: the transfer to this provider relies on the standard contractual clauses (Commission Implementing Decision (EU) 2021/914) incorporated into its data processing agreement (DPA).

How we protect it

• All traffic is encrypted with HTTPS.
• Social access tokens, the Apple Ads private key and the Plausible Stats API key are stored encrypted with AES-256-GCM; the key is not in the database.
• Each workspace is isolated: nobody from another workspace can see your projects or accounts.
• Access to the servers is restricted and goes through a private network.

Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by emailing show the privacy email. Where processing is based on your consent, you can withdraw it at any time without affecting prior processing. We reply within one month at most.

To delete the data we obtained from a social network, follow the data deletion instructions.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

Minors

LaunchSuite is a professional tool for people aged 18 and over. We do not knowingly collect data from minors.

Changes to this policy

If we change anything significant, we will publish it here with a new date and, if you have an account, tell you by email before it applies.