Privacy policy

1. Data Controller

The data controller is Branding Lab, a French SARL registered with the Paris Trade and Companies Register under number 894 714 401, with its registered office at 66 avenue des Champs-Élysées, 75008 Paris. For privacy questions or requests, contact hello@siobuilder.com.

2. Personal Data We Process

Depending on your use of SIOBuilder, we may process:

• account and authentication data, including name, email, identifier, sessions, IP address and browser or device information;
• profile, role, subscription and usage entitlement data;
• billing and payment information, including plan, payment status, transaction identifier and invoices;
• projects and content, including HTML, CSS, text, briefs, messages, imported Sections, settings and Results;
• usage data, including features used, generation activity, Section consumption, errors and timestamps;
• support requests and related correspondence;
• technical and security logs;
• cookies and local browser storage described in our Cookie Policy.

Please do not submit passwords, API keys, sensitive data or third-party personal data without a valid legal basis.

Only with your consent: page views and actions, campaign parameters (UTM), ad click identifiers (gclid, gbraid, wbraid, oppref), technical browser and account identifiers, sign-up and purchase events. Measurement services also receive technical browser information, including its IP address and type. Your name, email, briefs and HTML content are not intentionally included in these events.

3. Purposes and Legal Bases

4. Artificial Intelligence Processing

To perform the requested generation or conversion, relevant content, instructions and settings may be transmitted to one or more technical artificial intelligence model service providers. Data is limited to what is required for the feature but may include page content, code, text or briefs supplied by the User.

Where a Professional Customer uploads personal data for its own purposes, that Customer may act as controller and Branding Lab as processor. The applicable data processing agreement must then govern the parties’ respective obligations.

5. Recipients and Service Providers

Personal data may be accessed, only as necessary, by:

• authorised Branding Lab personnel;
• Vercel for infrastructure and hosting;
• Neon for database services;
• Better Auth for authentication and session-management functions, with account records stored in the SIOBuilder database;
• Resend for transactional email delivery;
• technical artificial intelligence model providers;
• Mollie for card payment processing once payments are enabled;
• professional advisers, auditors or authorities where legally required.

We do not sell personal data.

• PostHog Inc., configured in its Europe region, for audience measurement and forwarding conversions to Google Ads after consent;
• Google Ireland Limited and Google LLC for Google Tag Manager and Google Ads conversion measurement;
• OpenAI Ireland Limited for ChatGPT Ads conversion tools for EEA and Swiss data.

Google and OpenAI also process some data as independent controllers under their advertising measurement terms. These tools are only activated after your consent.

6. International Transfers

Some providers or subprocessors may be located outside the European Economic Area or allow access from a third country. Depending on the country, transfers may rely on an adequacy decision, the European Commission’s Standard Contractual Clauses with necessary supplementary safeguards, or another mechanism permitted under Articles 44 to 49 GDPR. SIOBuilder does not guarantee that all data is processed exclusively in the European Union. Information about safeguards may be requested at hello@siobuilder.com, subject to security and commercial confidentiality.

PostHog is configured in its Europe region. The OpenAI Ad Tools DPA provides for EEA and Swiss data to be processed by OpenAI Ireland Limited and a valid mechanism for onward transfers. Applicable safeguards are described in the agreement: OpenAI Ad Tools DPA

7. Retention Periods

Deleted data is removed from active systems and later from backups according to the applicable rotation cycle, unless legal retention is required.

8. Chrome Extension

The SIOBuilder extension stores the interface language preference locally in Chrome. It operates in the Systeme.io editor to detect the open page and create blocks requested by the User. It no longer uses a licence key, serial number or device identifier to authorise its operation. Uninstalling the extension or clearing its storage removes the local preference.

9. Security

Branding Lab implements appropriate technical and organisational measures, including access controls, secure sessions, encrypted communications, secrets management, security logging and appropriate backups. Users should use a unique password and never place secrets or API keys in a project.

10. Your Rights

Subject to the GDPR, you may request access, correction, deletion, restriction, objection to processing based on legitimate interests, portability, withdrawal of consent and post-mortem instructions allowed under French law. Contact hello@siobuilder.com. We normally respond within one month, extendable by two months for complex or numerous requests after notice in the first month. Proportionate identity verification may be requested.

You may also complain to the French data protection authority, the CNIL. SIOBuilder’s automated systems generate or convert content at your request but do not make decisions producing legal or similarly significant effects within Article 22 GDPR.

You can withdraw consent at any time through Cookie settings. New server events stop as soon as our servers receive the withdrawal stored in your browser for your account. You may also exercise your rights directly with the advertising providers.

11. Changes to This Policy

This Policy may be updated to reflect changes to the service, providers or law. Users will be informed by an appropriate method where a change is material. The date at the top identifies the applicable version.

Order confirmation archive

Paid order confirmations, accepted terms and delivery evidence are retained separately from projects and generations. They document the purchase and support the rights of both parties. Our policy provides for restricted-access archiving until ten years after the later of contract performance ending or the close of the financial year of payment. This is an archiving policy, not a statement that an identical legal obligation applies to every order. An ongoing subscription is not assigned an assumed end date.

Closing an account does not automatically delete these records. Retention is reviewed once the relevant dates are established; a dispute may justify a documented suspension of deletion. Abandoned acceptances with no payment or financial operation in progress are reviewed for deletion from thirty days after expiry. To request a copy after account closure or exercise your rights, contact hello@siobuilder.com; identity verification may be required. Invoice retention periods remain separate.

Chat support

Support chat uses Tchao and loads when you open it. Tchao receives the messages and attachments you choose to send, your email if provided, a conversation identifier and technical browser information. This information is used to answer your request and restore the conversation. SIOBuilder does not automatically send your account identity, briefs or project HTML. Avoid sharing passwords, payment details or confidential content in chat.

Tchao may capture the chat document and track its activity. Chat is embedded in a dedicated document separate from project screens. Chat opens and closes may also be measured through PostHog, only with your analytics consent, without message contents. Send access or deletion requests to hello@siobuilder.com.

Tchao privacy policy