1. Controller
The controller is SIA "AI Lab Space", reg. no. 40203582557, registered address: Vecozolu iela 14, Ķekava, Ķekava Municipality, LV-2123, Latvia, e-mail: info@ai-labspace.eu, phone: +371 27 708 853. Please send any questions about data processing to this e-mail address.
2. Data we process
- Contact form and communication data: name, company, e-mail, phone and message content that you submit yourself.
- Business data: contact person details, contracts, invoices and correspondence if we enter into an agreement.
- Technical data: IP address, browser type, time of visit and server logs required for the operation and security of the website.
- Cookie data: only to the extent you have consented (see the Cookie Policy).
- Platform account data in the publishing app: see section 3.
3. Publishing app and platform data (TikTok, YouTube, Google)
"AI-Lab Space Publisher" is a desktop app that our team uses to prepare and publish AI-Lab Space content (videos and posts) to the company's social media accounts. The app runs only on our computer. Platform accounts are connected by the account owner through the platform's official sign-in screen (OAuth).
Principles for all platforms:
- Publishing only after human approval. The app never posts automatically. A person reviews every post (video preview and caption) and approves it with a separate button.
- Tokens stay local. Access tokens are stored only on the computer running the app, encrypted with the operating system key store. They are never sent to our servers or to third parties, except to the platform that issued them.
- No sale of data. We do not sell platform data, share it with advertisers, or use it for profiling or advertising.
- Minimal data. We request only the permissions needed for the described function.
TikTok (Login Kit, Content Posting API):
user.info.basic: the account display name and avatar, shown on the posting screen so the user sees which TikTok account the video will be posted to.video.publish: posting an approved video and caption to the account owner's profile, with the privacy level and interaction settings chosen by the user. AI-generated content is labelled as AI-generated.- We do not receive or store follower lists, messages, viewing history or other users' data from TikTok.
YouTube (YouTube Data API):
youtube.upload: uploading an approved video, title and description to the company channel.youtube.readonly: the channel name and the status of the uploaded video, used to show the result and the link.- By using the YouTube features you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms). The Google Privacy Policy (https://policies.google.com/privacy) also applies. You can revoke access in your Google account security settings (https://myaccount.google.com/permissions).
Google Calendar and Gmail (company accounts only):
- Calendar: reading events to find free time, and creating or changing events only after human approval.
- Gmail (read-only): metadata of incoming messages (sender domain, subject, short excerpt) to set priorities. Verification codes, passwords and links with tokens are masked before processing and are not stored. The app never sends, deletes or modifies e-mails.
- AI-Lab Space Publisher's use of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
AI service providers in the app. To draft post texts and prioritise e-mails, the app sends the necessary content to AI model providers (Anthropic). To create video subtitles, the video audio is sent to a speech recognition service (OpenAI). Under these providers' API terms the data is not used to train their models. Platform access tokens are never sent to AI services.
Retention and deletion. Tokens are kept until the account is disconnected. Entries in the publishing log (date, channel, link to the post) are kept for up to 24 months. To disconnect an account:
- in the app (Integrations > Disconnect), which deletes the token immediately;
- on the platform: TikTok (Settings and privacy > Security > Apps and services) or Google (https://myaccount.google.com/permissions);
- by writing to info@ai-labspace.eu. We complete such requests within 30 days and also delete the related log entries, unless we are legally required to keep them.
Content that has already been published is deleted by the account owner on the respective platform.
4. Purposes and legal basis
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Replying to enquiries, preparing offers | Pre-contractual steps (Art. 6(1)(b)) and legitimate interests (f) |
| Performance of contracts and services | Performance of a contract (b) |
| Accounting and tax obligations | Legal obligation (c) |
| Website operation, security and abuse prevention | Legitimate interests (f) |
| Publishing company content to connected platform accounts | Consent of the account owner when connecting the account (a) and legitimate interests (f) |
| Visitor analytics and marketing | Your consent (a), which you can withdraw at any time |
5. Retention periods
- Enquiries that did not lead to cooperation: up to 24 months after the last contact.
- Contracts, invoices and related correspondence: for the period required by the Accounting Law and other legislation.
- Server logs: no longer than 90 days, unless needed to investigate a security incident.
- Platform tokens and the publishing log: see section 3.
- Cookies: see the Cookie Policy.
6. Recipients
We do not sell data. Data may be received by service providers (processors) acting on our behalf under data processing agreements:
- the website hosting provider;
- e-mail and form delivery providers;
- AI model providers (see section 3);
- analytics providers, only with your consent;
- our accounting service provider;
- public authorities where required by law.
When content is published, it is transferred to the respective platform (TikTok, YouTube, LinkedIn, Facebook, Instagram, X) under that platform's terms.
7. Transfers outside the EEA
Some service providers may be located outside the European Economic Area, for example in the USA. In such cases data is transferred on the basis of a European Commission adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses (GDPR Article 46).
8. Your rights
You have the right to request access to your data, its rectification or erasure, restriction of processing and data portability, and to object to processing based on legitimate interests. You can withdraw consent at any time without affecting the lawfulness of earlier processing. We respond to requests within one month.
If you believe your rights have been infringed, you can lodge a complaint with the Data State Inspectorate of Latvia (www.dvi.gov.lv).
9. Automated decision-making
There is no automated decision-making or profiling that produces legal effects for you. A person approves every post.
10. Security
We use encrypted connections (HTTPS), access control, encrypted token storage, and service providers with appropriate security measures.
11. Changes
We may update this policy. The current version, with its effective date, is always available at ai-labspace.eu/en/privacy.