Privacy Policy

Who is responsible

The data controller is Side Labs SAS, 36 avenue Sadi Carnot, 33110 Le Bouscat, France (RCS Bordeaux 107 613 606). For anything related to your personal data, write to [email protected].

What we collect

Account data. Your email address, your language preference and your role in your workspace. We do not ask for your name or a password: you sign in with a one-time link or code sent to your email address.

Billing data. When you subscribe, our payment provider collects, on its own checkout pages, your name, billing address, VAT number where applicable and payment card details. Card details never reach our servers. We only keep the identifiers it gives us, your plan, the status and the dates of your subscription.

Customer data. What you configure in Hawkscan: your brand and its website, your competitors, the prompts you monitor, their categories and the country they are run from. This is business information, not personal data, and you should not include personal data about individuals in it. Your prompts are submitted to the AI platforms exactly as you wrote them, through a data collection provider, with nothing that identifies you or your workspace; the website you enter when creating a project is sent to an AI provider to suggest services, competitors and prompts.

Results. The answers returned by the AI platforms to your prompts, the web pages they cite (we store the text of those pages to analyze them) and the metrics we derive. Because AI answers and public web pages sometimes name people, results may incidentally contain personal data about third parties, such as a company founder mentioned in an answer. That data comes from public sources, we do not use it for any other purpose than showing you the results, and we do not combine it with other data.

Technical data. When you use the site or the application, our servers record the usual technical information: IP address, browser type, pages requested, date and time, and error reports. We also use your IP address to limit the number of sign-in codes and newsletter confirmation emails that can be requested in a short period.

Audience statistics. We measure how our website and application are used with a cookieless analytics tool that we host ourselves in France: it records the pages viewed, the referring site, the approximate location (country, region and city), the browser, the operating system, the type of device, the screen size, the language, the campaign parameters present in the link you followed and a few actions, with no identifier attached, such as completing sign-in or onboarding, starting a trial or a subscription and the plan chosen, or the dashboard filters used. Your IP address and browser signature are only used to compute an anonymous identifier that tells one visitor from another during the current month; they are not stored, the identifier changes every month and it cannot be traced back to you.

Communications. The emails you send us and our replies.

Newsletter. If you subscribe to our blog newsletter, your email address and the date of your confirmation.

Cookies. We only use cookies that are strictly necessary: to keep you signed in, to remember your language, and to check that a form is submitted by a person and not a robot. Our audience measurement sets no cookie and stores nothing on your device. We do not use advertising cookies and we do not track you across other sites, which is why we do not show a cookie banner.

Of everything above, only your email address and, when you subscribe, your billing details are necessary to provide the service: without them we cannot open an account or process a subscription. Nothing else is required.

Why we use it and on what legal basis

We only process personal data for the purposes listed below, each of them resting on one of the legal bases provided by the GDPR: the contract between us, a legal obligation, our legitimate interest, or your consent.

We do not sell personal data, we do not use it for advertising, we do not profile you, and we make no decision about you by automated means that would have legal or similarly significant effects. We do not train our own AI models on your data.

Who processes data on our behalf

We rely on service providers to run Hawkscan. Each one processes personal data only on our instructions and under a contract that binds it to confidentiality and security obligations. The table below lists them by category, with the country where each one operates and the safeguard that covers any transfer of data outside the European Union.

The list of our providers by name is available on request at [email protected], for example when you need it for a data processing agreement.

We may also disclose personal data when the law requires it (a court order, a request from a competent authority), to establish or defend our legal rights, or to a buyer or successor if Side Labs is sold or merged, in which case this policy continues to apply to your data.

Where your data is stored and transferred

Your account, customer data and results are stored in the United States, where our hosting and database providers run their servers. Some of our providers are headquartered in the United States, in Singapore or in Israel, and may also access data from there to operate their service. Every transfer outside the European Economic Area relies on a safeguard recognized by the GDPR: an adequacy decision of the European Commission (Israel, or the EU-US Data Privacy Framework for certified US companies) or the Standard Contractual Clauses, together with the safeguards described in this policy. You can obtain a copy of the applicable clauses by writing to [email protected].

How long we keep it

We keep personal data only as long as the purpose it serves requires, or as long as the law obliges us to.

When a retention period ends, we delete the data or anonymize it beyond recovery.

How we protect it

Data is encrypted in transit (TLS) and at rest by our hosting providers. Access to your workspace is isolated at the database level: every query is restricted to your own organization. There is no password to steal, since sign-in relies on one-time codes sent to your mailbox, and payment card data never touches our systems. Access to production systems is limited to the people who need it. Error reports are stripped of email addresses, IP addresses and other identifiers before they leave our servers. If a breach were to affect your personal data, we would notify the competent authority and, where required, you, within the deadlines set by the GDPR.

Your rights

You have the right to access the personal data we hold about you, to have it corrected or deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw a consent you have given (for the newsletter, the unsubscribe link in each email does this immediately). You may also define instructions on what happens to your data after your death, as French law provides.

To exercise a right, write to [email protected] from the email address of your account, or tell us how we can verify that the request comes from you. We answer within one month; a complex request may take up to two more months, and we will tell you if that is the case. Requests are free of charge.

If you believe we are not handling your data lawfully, you can lodge a complaint with the French supervisory authority, the CNIL (Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, 75007 Paris, www.cnil.fr), or with the authority of the EU country where you live. If you are outside the European Union, the law of your country may grant you similar rights; we honour requests from all our users in the same way, wherever they are.

Changes to this policy

We will update this policy when our practices or the law change. The date at the top tells you when it was last revised. If a change materially affects how we use your personal data, we will notify you by email before it takes effect.

Contact

Side Labs SAS
36 avenue Sadi Carnot, 33110 Le Bouscat, France
RCS Bordeaux: 107 613 606
VAT number: FR95107613606
[email protected]