Privacy policy

1. About this policy

This policy explains how La-bas AB (“we”, “us”) processes personal data in LiqrAI, the web service at https://ai.liqr.se and its mobile app (the “Service”). It covers the people who use the Service, guests invited to meetings in it, people who contact us through the website, and visitors to partner sites whose activity is reported to the Service.

The Service is a business tool for beverage brands and their agencies. Access is by invitation. Use of the Service is also governed by our terms of service.

2. Who is responsible for your data

La-bas AB (org. no. 556801-6157), Sibyllegatan 52B, 114 43 Stockholm, Sweden, is the controller for the personal data we process to run the Service: user accounts, security logs, billing, contact requests and the data partner sites report to us.

Content an organization puts into the Service — uploaded files, comments, meeting recordings and the data the Service fetches from the organization's own connected accounts — is processed on that organization's behalf. For that content the organization is the controller and we are its processor. A data processing agreement is available on request.

3. What we collect and why

• Account and profile. Name, email address, password (stored only as a one-way hash), profile picture, organization and team memberships, roles and preferences. Used to give you access, keep your settings and control what you may see and do.
• Content you add. Files, budgets, plans, comments, tasks, messages in the AI console and generated media. Used to provide the features you use them in.
• Connected advertising accounts. When your organization connects an advertising platform (Meta, TikTok, Google Ads, Snapchat or X), we store the access token you grant and fetch the accounts you have access to, their campaigns, ad sets or ad groups, ads, budgets and performance metrics. Used to show reports and dashboards, attribute spend to projects and — only when you ask for it — create or change campaigns. See section 5.
• Meetings. Name, audio, video and screen share of participants, including guests who join through a link, and recordings when a host starts one. Used to run the meeting and, for recordings, to let the organization watch them afterwards.
• Billing. Company and contact details on budgets and invoices. Used to quote, invoice and keep accounting records.
• Contact requests. Name, email, company and message when you use the contact form. Used to answer you.
• Security and usage logs. IP address, browser or device type, sign-in times, sessions and the actions taken in the Service. Used to keep the Service secure, detect misuse and intrusion attempts, enforce the terms of service, troubleshoot and improve the Service.
• Visitors to partner sites. Partner sites can report when a visitor clicks through to buy a product. Such a report can include the product, time, page, campaign parameters, IP address, browser type and, where the visitor is signed in on the partner site, an identifier, name and email. Used to measure which campaigns lead to purchase intent. The partner site is responsible for informing its visitors.

4. Legal basis

• Contract — to provide the Service to you and your organization.
• Legitimate interest — security logging, misuse prevention, enforcing our terms, improving the Service, answering contact requests and campaign measurement. You may object (section 11).
• Legal obligation — accounting records and responding to lawful requests from authorities.
• Consent — where we ask for it, for example when you grant access to an advertising account. You can withdraw consent at any time.

5. Data from Google and other platforms

When you connect a Google Ads account, the Service requests the Google Ads scope (https://www.googleapis.com/auth/adwords) and uses it to read the Google Ads accounts you have access to, their campaigns, ad groups, ads, budgets and performance reports, and to create, change, pause or resume campaigns when a user in your organization explicitly does so in the Service.

LiqrAI's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• We use Google user data only to provide and improve the user-facing features described above, to the organization that connected the account.
• We do not sell Google user data, use it for advertising, or use it to build user profiles for any other purpose.
• We do not use Google user data to train or improve generalized AI or machine learning models. When you ask the AI console about your campaigns, the relevant figures are sent to the AI provider only to answer that question, under terms that forbid the provider from training on it.
• Our staff do not read Google user data unless you ask us to (for example in a support case), it is needed for security or to comply with law, or the data is aggregated and anonymized.
• You can revoke access at any time by disconnecting the integration in the Service or at myaccount.google.com/permissions. The stored token is then deleted.

We handle data from Meta, TikTok, Snapchat and X on the same terms and in line with each platform's developer policies.

6. Who we share data with

We never sell personal data. We share it only with service providers that process it on our behalf under data processing agreements, and with the platforms you choose to connect:

• Hosting and infrastructure: Vercel (web application, Frankfurt region), Neon (database, Frankfurt region), Hetzner (background processing, EU), Cloudflare (file storage, EU jurisdiction).
• Email delivery: Brevo (EU).
• Video meetings: LiveKit.
• AI features: Anthropic, OpenAI, Google (Gemini), ElevenLabs, Suno, fal and Black Forest Labs — only the content needed for the feature you use.
• Invoicing: Fortnox.
• Advertising platforms you connect: Meta, TikTok, Google, Snapchat and X.
• Authorities, when we are legally required to (section 12).

7. Transfers outside the EU/EEA

We store the Service's data in the EU. Some providers above are based in, or may access data from, the United States. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses with supplementary measures.

8. How long we keep data

• Account data: as long as the account exists. Accounts are deleted on request, and at the latest 12 months after the account was removed or the organization’s agreement ended, unless we must keep data longer.
• Personal data in organization content (for example names in comments, uploaded files and meeting recordings): until the organization deletes it in the Service, and at the latest 12 months after the organization’s agreement ended, when it is deleted or anonymized.
• Data from advertising accounts the organization connects itself: until the organization deletes it or asks us to.
• Campaign data from our own advertising accounts, and sales and ranking figures, which are generally not personal data: kept as part of our business records (terms of service section 9).
• Access tokens for connected platforms: until the integration is disconnected.
• Security and usage logs: 24 months, because misuse, intrusions and breaches of the terms of service often come to light long after they happen. Logs tied to an incident or a suspected breach are kept until the matter is closed.
• Records of your acceptance of the terms of service: as long as the account exists and for ten years after, the period during which contract claims can be made under Swedish law.
• Contact requests: up to 12 months after the conversation ends, unless they lead to an agreement.
• Accounting records: seven years, as required by Swedish law.

9. Security

We use encryption in transit, encrypted storage of access tokens, role-based access control and logging to protect personal data. Access is limited to the people who need it. Files in the asset library are served through links that cannot be guessed, so that they can be used in ads and emails; anyone who has such a link can open the file. No system is completely secure; if a breach affects your personal data, we will notify you and the supervisory authority as the law requires.

10. Cookies and local storage

The Service uses only cookies and browser storage that are necessary for it to work: a session cookie that keeps you signed in, short-lived cookies that protect sign-in with external platforms, and local settings such as table filters. We do not use advertising or third-party analytics cookies.

11. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you,
• have incorrect data corrected and incomplete data completed,
• have data erased when it is no longer needed or processed unlawfully,
• restrict processing while a dispute about it is resolved,
• object to processing based on legitimate interest,
• receive data you have provided in a machine-readable format (data portability),
• withdraw consent at any time.

Email daniel.sparr@la-bas.se to use your rights. We may ask you to verify your identity. Where we process data on behalf of your organization, we forward your request to the organization. Some data may have to be kept to meet legal obligations, such as accounting rules.

12. Requests from authorities

We review every request from an authority for user data to make sure it has a legal basis, challenge requests that are unlawful or disproportionate, disclose only the minimum required, and document each request and our response.

13. Complaints

If you think we process your personal data incorrectly, please contact us first. You may also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, imy.se) or the supervisory authority where you live or work.

14. Changes

We may update this policy. The current version is always available on this page, and we will inform users of significant changes in the Service or by email.

15. Contact

La-bas AB
Sibyllegatan 52B
114 43 Stockholm, Sweden
daniel.sparr@la-bas.se