Legal
Privacy Notice
Welcome to read our privacy notice to website visitors and users of our Services (as defined below).
Note that this Privacy Notice applies to personal data where Plenty Labs acts as a Data Controller as further described in this Privacy Notice. When you use our platform to process data on your behalf – such as generating AI creatives based on your prompts and uploaded material – Plenty Labs acts as a Data Processor. Such processing is governed by our Data Processing Addendum.
1. Introduction
1.1 This privacy notice describes how Plenty Labs AB, Org.nr. 559454-1855, Västgötagatan 2, 118 27 Stockholm, Sweden (“Plenty Labs”, “we”, “our”, “us”) collects and uses your personal data when you use our AI-powered creative marketing platform (the “Services”), or otherwise visit our website. It tells you what to expect us to do with your personal data when you interact with us and describes the rights you may have in relation to our use of your data, as well as how to exercise those rights.
1.2 As a data controller, we must ensure that we use your personal data in compliance with applicable privacy and data protection laws (primarily the General Data Protection Regulation (EU) 2016/679, the “GDPR”) and to protect your personal data accordingly.
1.3 We use cookies and similar technologies, e.g. to provide the right functionality and features for our website and Services. To read more about how we use these technologies, what information they allow us to collect and process and for what purposes this is carried out, please read our cookie policy.
1.4 To the extent you carry out activities or access services run by companies other than us, e.g. in relation to content published on other websites, this privacy notice will not apply and these other companies will be responsible for the processing of your personal data.
1.5 We may update this privacy notice from time to time. At the top of the page, you can see the last date when this was made.
2. What personal data do we collect and use?
2.1 In order for Plenty Labs to be able to provide our website and Services, we collect and process your personal data as further explained below.
2.2 The personal data we use is primarily collected directly from you when you interact with us on our website or when you use our Services. When you use our Services, we process (i) information provided by you when you create and manage the account you use, (ii) information provided by you when you directly use our Services, including brand assets, creative materials and other content you upload or make accessible to us, (iii) data automatically generated as you use our Services, such as usage patterns and interaction data, (iv) information you provide when you contact us, for example when communicating with our customer service, (v) information we receive when you use or connect to our Services via a third party utilizing our plugin, an API integration or an MCP connection, and (vi) information we receive from a third party service that you allow us to access, such as ad platforms or social media accounts you connect to our Services.
2.3 To help you better understand what kind of personal data we use, we explain this further below.
| Category of personal data | Description |
|---|---|
| User account data | Information provided at sign-up and when you update or manage the account you use to access the Services, such as your name, email address, hashed password, Google sign-in or other single sign-on identity, two-factor authentication identifier (where enabled), and profile picture (avatar). |
| Subscription data | Information about the plan or subscription associated with your account and its status, including seat allocation and, where your subscription is paid by an enterprise or company, the billing entity associated with your account. |
| Payment data | Information about your subscription payment, including your invoice country and a reference identifier used by our payment provider. Your payment card details and any tax identification number are collected and processed directly by our payment provider and are not received by us. |
| User content data |
|
| Technical device and user traffic data | Technical information generated while you use our Services, such as IP address, browser and device information, session identifiers, and request and error logs, used to authenticate you, keep you signed in, and maintain the security and stability of our Services. |
| Service usage data |
|
| Marketing data |
|
| Contact requests data | Information provided when you communicate with us, for example if you have questions, feedback or conversations with our customer support function, or when you otherwise communicate with us via for example email or website forms. |
3. For what purposes do we use the personal data we collect and what are our legal bases for doing so?
3.1 To help you better understand why we use your personal data and to make sure you know we use it only as necessary in a legitimate way, the purposes for carrying out our processing activities as well as the legal bases we rely on for doing so are explained below.
| Purposes of the processing | Categories of personal data | Legal bases |
|---|---|---|
Functionality purposes: To maintain, operate and improve our website and Services, including to enable the technical functionality that allows you to access and use our Services as well as to troubleshoot, fix errors and bugs, detect and counter errors, intrusions and incidents, and create statistics to understand our visitors better. |
| Legitimate interest (to maintain, improve and protect our website, Services and their functionality) |
User account management purposes: To allow registration and management of user accounts. |
| Performance of the contract we have with you or Legitimate interest (to instead perform our contract with the company you represent) |
Platform functionality purposes: To maintain and enable the technical functionality that allows you to access and use our Services. |
| Performance of the contract we have with you regarding the Services or Legitimate interest (where our legitimate interest is to instead perform our contract with the company you represent) |
Service personalization purposes: To personalize your user experience and provide our Services in a relevant manner, based on analysis of how you interact with our Services, such as which features and tools you use and how frequently you use them. |
| Legitimate interest (to provide our Services in an adequate and relevant manner to you or the company you represent) |
Improvement purposes: To improve and develop our Services and ensure we continue to deliver relevant and effective AI-powered creative tools, based on analysis and insights of how users interact with our Services, the type of business users are active in and their location. |
| Legitimate interest (to improve and develop our Services) or Consent |
Monitoring purposes: To detect, prevent and respond to misuse, fraud, or unlawful or harmful use of our Services. |
| Legitimate interest (to protect our Services, our other users and third parties from misuse, fraud, and unlawful or harmful use) |
Marketing purposes: To market our Services and provide existing or potential users or the company they represent with personalized offers and recommendations via emails or similar means of communication, based on analysis and insights of interactions with our Services and/or third-party services. |
| Legitimate interest (where our legitimate interest is to be able to market our offers and recommendations to you or the company you represent) or Consent You can easily opt out from receiving marketing messages by clicking the unsubscribe link in our emails. |
Customer support purposes: To communicate via our customer support service, e.g. related to technical support, subscriptions or accounts or other enquiries related to our Services. |
| Legitimate interest (to communicate and provide support) |
Customer insights purposes: To show how frequently our Services are used and present insights about customer-specific usage, so our enterprise customers can evaluate the value created for their business. |
| Legitimate interest (to help customers understand the value created by our Services) |
Reconnecting purposes: To reach out to inactive users or customers based on analysis of their previous interactions with our Services. |
| Legitimate interest (to reconnect with and market our offers to potential customers or users) |
Payment processing purposes: To process payments as well as to make available relevant payment methods. |
| Performance of the contract we have with you regarding the Services or Legitimate interest (to instead perform our contract with the company you represent) |
Regulatory reporting purposes: To fulfill requirements relating to payments, taxes and financial reporting. |
| Compliance with our legal obligations (e.g. taxes and bookkeeping) |
Legal enforcement purposes: To enforce legal rights or obligations arising from our agreements or applicable law. |
| Legitimate interest (to establish, exercise or defend legal claims) |
4. For how long do we store your personal data?
4.1 We review our storage of personal data on a regular basis, in order to delete or anonymize data when it is no longer necessary to keep for the purposes it was collected.
4.2 This normally means we store your personal data for as long as you or the company you represent have a customer relationship and/or an open account with us under an active subscription, and then for up to two (2) years thereafter in order to ensure you have the opportunity to reconnect with us and seamlessly return to your user account.
4.3 Your personal data may also be stored for other reasons after your subscription to use our Services has ended, e.g. in order for us to be able to fulfill our remaining contractual or legal obligations or address legal claims related to our relationship with you or the company you represent or work for.
6. International transfers
6.1 In order to carry out activities described in this privacy notice, we will share your personal data with our group companies. This includes transfers to our group companies within the EU/EEA as well as outside the EU/EEA (the USA and South Korea). Transfers of your personal data outside of the EU/EEA also take place in relation to other recipients listed in Section 5 above, e.g. our service providers, partners and social media platforms.
6.2 Before we transfer personal data outside the EU/EEA we have to ensure that the level of protection of your personal data and your rights remain adequate.
This means we must base such transfers on specific mechanisms, most commonly
- adequacy decisions adopted by the European Commission, pursuant to article 45 of the GDPR (information about such decisions is available here); or
- standard contractual clauses adopted by the European Commission, pursuant to article 46 of the GDPR (information about these clauses is available here); and that we otherwise shall
- ensure appropriate contractual, technical, and organisational measures are in place, to ensure that your personal data is afforded a level of protection essentially equivalent to that guaranteed within the EU/EEA.
7. Keeping your personal data secure
7.1 We are committed to protecting your personal data. To help maintain the security of your personal data we have implemented organizational and technical measures to adequately protect it, e.g. policies, instructions, routines against unauthorised access and unnecessary retention as well as safeguards such as firewalls, fraud detection and other systems to detect unauthorized activities aimed at our website or Services. We keep these measures under close review in order to keep our systems and the personal data we process safe.
8. Your rights and how to exercise them
8.1 There are a number of rights that you may be entitled to exercise in relation to us when we process your personal data. Below, you find a summary of what these rights involve and when they may apply. If you want to make a request to exercise your rights, please contact us at privacy@plentylabs.com.
8.2 We kindly ask you to note that there may be limitations to your rights and that we may have to take steps to be able to fulfill them correctly, e.g. to confirm your identity and to ensure we continue to respect the rights of others.
8.3 Your rights and when they may apply:
(a) Right of access. You have the right to know whether we process personal data relating to you and to obtain a copy of the personal data we process about you. You also have the right to supplementary information similar to the information in this privacy notice to understand how we are using your data, e.g. why we are processing it, what categories of personal data it concerns and for how long we store it.
(b) Right to rectification. You have the right to have inaccurate personal data about you corrected and, in some cases, you may even supplement it.
(c) Right to erasure. You have the right to obtain that we erase personal data relating to you when we no longer have a relevant or valid reason to process or store it, such as when you (or the company you represent) quit your subscription with us and end your relationship with us, or if you object to certain processing carried out by us and we cannot adequately justify continued processing.
(d) Right to data portability. You have the right to reuse your personal data. This means you may have the right to receive it from us or have it directly transmitted to someone else for continued use at your choice, where the personal data has been provided or generated directly by you during the course of your relationship with us, e.g. when using the Services, or (where applicable) during activities carried out based on your consent. Please note however that this excludes information or results we have inferred or created. Neither does the right to portability apply to the extent we only process data manually. Your right to portability will further depend on interoperability, what is technically feasible and whether it will adversely affect the rights of others.
(e) Right to object. You have the right to object to our continued processing of your personal data. For example, where our processing is carried out with reference to our or someone else’s legitimate interests, your objection may result in an obligation for us to cease the processing unless we are able to sufficiently justify continued processing.
(f) Right to restriction. Following your request to exercise your rights there may be situations where we must cease our processing activities and restrict them, without erasing your personal data. This might be because you object to such erasure or need the personal data to establish, exercise, or defend legal claims. There may also be situations where we need to verify e.g. the accuracy of the personal data concerned or where we disagree with each other to the extent we need to assess whether we can still process your personal data in spite of your objection. In such cases, you have the alternative to obtain that we restrict the processing of the personal data concerned which means (i) we will only store it or use it in very limited situations (if applicable), such as with your consent or to establish, exercise, or defend legal claims and (ii) you will be informed before we lift any such restriction.
(g) Right to lodge a complaint with a supervisory authority. If you are unhappy with how we process your personal data or our practices around privacy and data protection matters otherwise, you have the right to lodge a complaint to a supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Sw. Integritetsskyddsmyndigheten), but each EU member state has their own supervisory authority that you can reach out to at your convenience. Before you lodge a complaint with the supervisory authority, you are of course always welcome to contact us with any concerns or complaints. The easiest way to do so is to reach out to the contact details in Section 9 below.
9. How to contact us
If you have any concerns regarding our processing of your personal data, you are more than welcome to contact privacy@plentylabs.com.
Plenty Labs AB
Västgötagatan 2, 118 27 Stockholm, Sweden