Sosh Labs AI Inc. ("Sosh Labs AI," "Sosh," "Sosh AI," "we," "us," or "our") operates the Sosh Labs AI platform available at soshlabs.ai (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our Service.

We are incorporated in British Columbia, Canada, and our registered address is 159 W 2nd Ave, Vancouver BC V5Y0L8.

By accessing or using the Service, you agree to this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

We collect information in the following ways:

2.1 Information You Provide Directly

• Account Information: When you register, we collect your name, email address, and authentication credentials through our authentication provider.
• Organization Information: Business name, website, industry, timezone, and logo when you create a brand space.
• Brand DNA Questionnaire: Responses to our onboarding questionnaire, including your core brand essence, target client description, delivery mechanisms, brand vibe, content style preferences, and other business-related information you choose to share.
• Content: Posts, captions, scripts, visual blueprints, hashtags, and other content you create or generate through the Service.
• Media Files: Images, videos, and other media you upload to the Service.
• Payment Information: Billing details are collected and processed exclusively by our payment processor, Stripe. We do not store credit card numbers or payment credentials on our servers.
• Communications: When you contact us at privacy@soshlabs.ai or bonjour@soshlabs.ai, we retain the correspondence.

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, interactions with the Service, and error logs.
• Device Information: Browser type, operating system, and device identifiers.
• Cookies and Tracking Technologies: We use cookies and similar technologies as described in Section 7 (Cookies and Tracking).

2.3 Information from Third-Party Services

• Social Media Accounts: When you connect social media accounts (e.g., Instagram, LinkedIn, TikTok), we receive account identifiers, display names, and profile images from our social media integration provider.
• Analytics Data: Engagement metrics, follower counts, and audience demographics from your connected social media accounts.

We use your information for the following purposes:

• Service Delivery: To provide, maintain, and improve the Service, including generating AI-powered content based on your brand information.
• AI Content Generation: Your brand data, prompts, and content context may be sent to third-party AI providers to generate content suggestions, strategies, and recommendations. These providers process data according to their own privacy policies and data processing terms.
• Account Management: To manage your account, process subscriptions, and communicate service-related updates.
• Analytics and Insights: To generate performance analytics and strategic insights for your social media accounts.
• Scheduling and Publishing: To schedule and publish content to your connected social media platforms through our social media integration provider.
• Email Communications: To send transactional emails (account confirmations, payment receipts, subscription updates) and, with your consent, marketing communications.
• Security and Fraud Prevention: To detect, prevent, and address security issues, fraud, and technical problems.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes.
• Service Improvement: To analyze usage patterns and improve our Service using anonymized and aggregated data.
• Customer Reference: To identify your organization as a customer of Sosh Labs AI in our marketing materials, website, and promotional content, subject to your right to opt out as described in our Terms of Use.

Our Service uses artificial intelligence to generate content and provide recommendations. You should be aware of the following:

• Data Sent to AI Providers: Your brand DNA information, content prompts, existing content context, and related metadata may be sent to third-party AI providers for processing. We do not send your payment information, passwords, or authentication credentials to AI providers.
• AI Generation Logs: We maintain logs of AI-generated content, including the prompts submitted and responses received, the AI model used, and performance metadata. These logs are used for service quality, debugging, and to provide you with your content history.
• No AI Training on Your Data: We do not use your content or brand data to train AI models. Our AI providers process your data solely to generate responses to your requests.
• Non-Uniqueness of Output: AI-generated content may be similar to content generated for other users. AI output is not guaranteed to be unique, original, or free from errors.
• Your Ownership: You own the AI-generated content created through your use of the Service, subject to the Terms of Use.

We do not sell your personal information to third parties. We do not share your personal information for third-party advertising or marketing purposes.

We share your information only in the following circumstances:

5.1 Service Providers (Sub-Processors)

We use trusted third-party service providers to operate the Service. These providers process your data only as necessary to perform services on our behalf and are contractually obligated to protect your information:

• Authentication Provider: Manages user accounts, authentication, organization memberships, and team invitations.
• Payment Processor: Processes payments, manages subscriptions, and handles billing. Payment card data is handled exclusively by this provider and never stored on our servers.
• AI Providers: Process content generation requests using your brand data and prompts.
• Social Media Integration Provider: Facilitates connecting, scheduling, and publishing to your social media accounts.
• Cloud Storage Provider: Stores media files you upload to the Service.
• Email Service Provider: Delivers transactional and system emails on our behalf.
• Hosting and Analytics Providers: Host our website and provide aggregated usage analytics.

A complete list of sub-processors, including their purposes and data locations, is available in our Data Processing Agreement.

5.2 Customer Reference

Your organization's name, logo, and a general description of your use of the Service may appear in our public marketing materials (e.g., customer logo displays on our website, customer lists in pitch decks). This use is limited to identifying you as a customer and does not involve sharing your personal data, content, or account details. You may opt out at any time by contacting us at privacy@soshlabs.ai.

5.3 Legal Requirements

We may disclose your information if required to do so by law, in response to valid legal process (such as a court order or subpoena), or to protect the rights, property, or safety of Sosh Labs AI, our users, or the public.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service before your information becomes subject to a different privacy policy.

We retain your personal information for as long as your account is active or as needed to provide you the Service.

• Active Accounts: Your data is retained for the duration of your account's active use.
• Deactivated Accounts: Upon account deactivation or deletion, we will delete your personal information, including AI generation logs, content, and brand data, within 12 months of deactivation.
• Server Logs: Application server logs are retained for 14 days and automatically rotated.
• Legal Obligations: We may retain certain information for longer periods as required by applicable law (e.g., tax, accounting, or regulatory requirements).

To request deletion of your account and data, contact us at privacy@soshlabs.ai.

We use cookies and similar tracking technologies on our website. Cookies are small text files stored on your device that help us provide and improve the Service.

7.1 Types of Cookies We Use

• Essential Cookies: Required for authentication and core functionality. These cannot be disabled as they are necessary for the Service to function.
• Analytics Cookies: Help us understand how visitors interact with our website. We use Google Analytics and Vercel Analytics to collect aggregated usage data.
• Marketing Cookies: Used to deliver relevant information about our Service. We use Meta Pixel and LinkedIn Insight Tag to measure the effectiveness of our outreach.

7.2 Your Cookie Choices

When you first visit our website, we will ask for your consent before placing non-essential cookies (analytics and marketing). You can change your cookie preferences at any time through the cookie settings link in our website footer.

Essential cookies cannot be disabled as they are necessary for the Service to function.

7.3 Do Not Track

We honor Do Not Track ("DNT") browser signals. When DNT is enabled, we will not place non-essential cookies.

Depending on your location, you may have the following rights regarding your personal information:

8.1 Rights Under Canadian Law (PIPEDA)

If you are a Canadian resident, you have the right to:

• Access your personal information held by us
• Request correction of inaccurate personal information
• Withdraw consent for the collection, use, or disclosure of your personal information
• File a complaint with the Office of the Privacy Commissioner of Canada

8.2 Rights Under EU/EEA Law (GDPR)

If you are located in the European Union or European Economic Area, you have the right to:

• Access your personal data
• Rectify inaccurate personal data
• Request erasure of your personal data ("right to be forgotten")
• Restrict processing of your personal data
• Data portability (receive your data in a structured, machine-readable format)
• Object to processing of your personal data
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority

8.3 Rights Under California Law (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information is collected, used, shared, or sold
• Delete personal information held by us
• Opt out of the sale or sharing of personal information (we do not sell or share your personal information)
• Non-discrimination for exercising your privacy rights

To exercise any of these rights, please contact us at privacy@soshlabs.ai. We will respond to your request within the timeframes required by applicable law (typically 30 days for PIPEDA, 30 days for GDPR, and 45 days for CCPA).

Our Service is operated from Canada, with data processing occurring in Canada, the United States, and the European Union.

If you are accessing the Service from outside these regions, please be aware that your information may be transferred to, stored, and processed in countries with data protection laws that may differ from those in your jurisdiction.

For transfers from the EU/EEA, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable (Canada has been granted adequacy status by the European Commission for transfers under PIPEDA)

By using the Service, you consent to the transfer of your information to Canada, the United States, and the European Union as described in this Privacy Policy.

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/SSL)
• Secure authentication with token-based access control
• Webhook signature verification for all third-party integrations
• Role-based access controls within organizations
• Regular security reviews and monitoring
• Strict Content Security Policy headers

While we strive to protect your information, no method of electronic storage or transmission over the internet is completely secure. We cannot guarantee absolute security of your data.

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from anyone under 16 years of age. If we become aware that we have collected personal information from a person under 16, we will take steps to delete that information promptly.

If you are a parent or guardian and believe your child under 16 has provided us with personal information, please contact us at privacy@soshlabs.ai.

We may send you marketing communications about our Service with your prior consent, in compliance with Canada's Anti-Spam Legislation (CASL) and applicable laws.

• You may opt out of marketing emails at any time by clicking the "unsubscribe" link in any marketing email or by contacting us at privacy@soshlabs.ai.
• Opting out of marketing communications does not affect transactional emails related to your account (e.g., payment confirmations, security alerts, service updates).

We may update this Privacy Policy from time to time. When we make changes, we will update the "Effective Date" at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

If you have any questions about this Privacy Policy or our data practices, please contact us:

Sosh Labs AI Inc. 159 W 2nd Ave Vancouver, BC V5Y0L8 Canada

Email: privacy@soshlabs.ai

For general inquiries: bonjour@soshlabs.ai