Privacy policy

SaliencyLab is a pre-spend creative intelligence service operated by Oussama Nakhil (auto-entrepreneur / sole proprietor registered in Morocco). For the purposes of Moroccan Law n° 09-08 and the EU GDPR, Oussama Nakhil is the data controller with respect to personal data processed through saliencylab.com.

Controller address: on file with the Moroccan Commission Nationale de Contrôle de la Protection des Données à Caractère Personnel (CNDP) and available on written request.

General contact: contact@saliencylab.com. Data-protection-specific requests: privacy@saliencylab.com (monitored by the controller directly; no designated Data Protection Officer is currently required under either Moroccan Law 09-08 Article 18 or GDPR Article 37 given the processing scale, but the controller acts in that capacity).

EU / EEA representative under Article 27 GDPR: currently under appointment. Until published here, EU/EEA data subjects may contact the controller directly at privacy@saliencylab.com; no lack of an Article 27 representative will be used to delay a rights request.

UK representative under Article 27 UK GDPR: currently under appointment on the same basis. UK data subjects may contact privacy@saliencylab.com and will receive the same response timeline.

This policy describes the processing of personal data by the saliencylab.com web product, the synthetic user panels branded as BuyerLens, the RoastIQ scoring pipeline, and supporting marketing/content surfaces (blog, landing pages, waitlists).

The policy is drafted to satisfy Moroccan Law 09-08, the EU GDPR, and the UK GDPR concurrently. Where the three frameworks diverge, the more protective rule applies.

We limit processing to what is necessary for the listed purposes.

• Identification data: email address, display name, account language preference, authentication identifiers (Supabase-issued user_id, session tokens).
• Workspace data: workspace name, role within the workspace (owner / admin / editor / viewer), invitations sent.
• Content uploaded for analysis: images up to 50MB and videos up to 100MB per file, associated titles or briefs you add, and derived metadata (dimensions, duration, platform hint, filename).
• Billing data: plan tier, subscription state, invoice history. Full payment-card data is held exclusively by Stripe (PCI DSS Level 1). We never see full card numbers.
• Product telemetry: feature clicks, page views, pipeline timings, error events, captured via PostHog (EU Cloud, Frankfurt) and Sentry. PostHog receives a pseudonymous user id, event name, page path, feature flag state, and product event properties such as project ID, study ID, share token, KPI scores, and verdicts (Scale/Sharpen/Rebuild), operational metadata necessary to understand product usage, never including the contents of uploaded creatives, and no email, name, or other PII. Sentry receives a pseudonymous user id only; auth headers, cookies, email patterns and known PII keys are scrubbed at the SDK boundary before any event is sent.
• Google Analytics 4 (when the user has granted analytics consent via the cookie banner): pseudonymous client id, page URL, referrer, event name, country-level IP after IP anonymization, and, when the user is signed in, the Supabase user_id (a UUID, not the email) passed as the GA4 User-ID. The GA4 User-ID is used for cross-device session stitching only; it is never joined with content the user uploads and never used for advertising. GA4 is loaded by the consent-gated AnalyticsLoader and does not run for users who decline analytics consent.
• Support correspondence: the content of messages you send to contact@saliencylab.com or privacy@saliencylab.com and any attachments.
• No special-category / sensitive data under Article 9 GDPR or Article 13 of Moroccan Law 09-08 (health, religion, ethnic origin, sexual orientation, etc.) is intentionally collected. If you include such data in an uploaded creative, you do so at your own direction; we treat the upload the same way as any other creative and do not derive special-category inferences.

For each processing purpose we rely on at least one legal basis under Article 6(1) GDPR and its UK equivalent.

• Performance of a contract (Article 6(1)(b)): account creation, workspace provisioning, RoastIQ analysis delivery, BuyerLens synthetic panels, billing, customer support. Necessary to perform our agreement with you.
• Legitimate interests (Article 6(1)(f)): product telemetry for reliability and fraud prevention, security monitoring, aggregate benchmark statistics (no customer identifiers), service emails about material changes. The interest is running a reliable and safe service; we balance it against your reasonable expectations and you can object (see §10).
• Consent (Article 6(1)(a)): non-essential cookies and marketing-adjacent email. Captured via the consent banner on first visit and revocable at any time.
• Legal obligation (Article 6(1)(c)): retaining billing records for Moroccan tax law purposes (5 years), responding to lawful requests from supervisory authorities.

Moroccan Law 09-08 requires processing to be based on the consent of the data subject (Article 4) or, in specific cases enumerated in Article 5, on performance of a contract, compliance with legal obligations, vital interests, public task, or the legitimate interest of the controller where it does not override the data subject's fundamental rights.

Our processing purposes map to Article 5(1)(a) contractual necessity (for account and service operations), Article 5(1)(d) legitimate interests (for telemetry and security), and Article 4 explicit consent (for non-essential cookies and marketing).

CNDP registration / prior declaration: SaliencyLab's processing activities are being filed with the CNDP under Article 12 of Law 09-08 as ordinary-processing declarations. The CNDP receipt number will be published on this page once issued. Cross-border transfers (§8) are separately authorized per Article 43.

We use the data described above strictly for the following purposes. We do not sell personal data and we do not share it with advertisers.

• Deliver the core product: RoastIQ creative scoring, BuyerLens synthetic panels, benchmark context, and report export.
• Authenticate sessions and enforce workspace-level access controls.
• Process payments and manage subscriptions through Stripe.
• Send essential service and transactional email (account confirmation, receipts, security notices, breach notifications).
• Detect abuse, debug incidents, prevent fraud, and improve product reliability.
• Build anonymized, aggregated benchmark statistics derived from publicly-available ads (Meta Ad Library, TikTok Creative Center, Google Ads Transparency), no customer identifiers retained in pooled stats.

SaliencyLab's core product applies AI models to creative assets you upload and returns scored outputs. This is algorithmic analysis of content you explicitly submit for that purpose; it does not make legally significant or similarly significant decisions about you as a data subject under Article 22 GDPR or Article 13 of Moroccan Law 09-08.

Models in use: Google Cloud Vertex AI (Gemini 2.5 Flash / Pro) for multimodal analysis, Google Cloud Video Intelligence for shot and speech detection, Google Cloud Speech-to-Text for audio transcription. All Vertex AI requests target the europe-west1 region by default, keeping AI processing of EU customer data inside the EU. Per Google Cloud Vertex AI terms of service, customer data submitted through the API is not used to train or improve foundation models.

Google Video Intelligence and Speech-to-Text are processed at Google's global endpoints. While our project is configured for europe-west1 where Google offers regional control, these specific APIs do not currently expose an EU-only endpoint and may transit Google's global network for processing. Google's Cloud Data Processing Addendum (DPA) governs all data sent to these APIs and includes Standard Contractual Clauses for any cross-border transfer.

SaliencyLab itself does not train any models on customer uploads. Outputs (scores, narrative, heatmaps, benchmarks, decision traces) are generated per request and stored only in your workspace.

You retain the right to request human review of any score and to dispute the result. Send disputes to privacy@saliencylab.com.

We rely on a short list of named sub-processors to operate the service. The current list is published at /legal/sub-processors (service name, purpose, region, data types, transfer mechanism).

Primary data residency: Supabase EU (Frankfurt region). Database, row-level security, object storage, and auth all run inside the EU.

Cross-border transfers from EU/EEA to Morocco: Morocco is not currently on the European Commission's adequacy list. Transfers of EU/EEA personal data to the controller in Morocco (for administration, support, and product operation) are covered by the European Commission Standard Contractual Clauses (SCCs), Commission Implementing Decision (EU) 2021/914, Module 2 (controller-to-processor) and Module 4 (processor-to-controller) as applicable, supplemented by technical and organizational measures described in the DPA.

Cross-border transfers from the United Kingdom use the UK International Data Transfer Addendum (UK Addendum) issued by the ICO under section 119A of the Data Protection Act 2018, layered on top of the EU SCCs.

Transfers to United States sub-processors (Stripe, Resend, Vercel, Sentry) are covered by the SCCs and, where the sub-processor participates, by the EU-U.S. Data Privacy Framework.

Cross-border transfers from Morocco to non-CNDP-adequate jurisdictions are separately authorized by the CNDP under Article 43 of Law 09-08.

Retention is aligned with the purpose of each data class and the minimum period required by applicable law.

• Account and workspace records (active systems): deleted immediately upon a verified deletion request, then permanently removed from active systems within 30 days. Erasure receipts (PII-free counts only, no email, name, IP, or content) are retained for six (6) years to satisfy GDPR accountability obligations under Article 5(2).
• Uploaded creatives and analysis results: retained for the lifetime of the account. You can delete individual items or your entire workspace at any time through in-product settings.
• Benchmark statistics: retained in aggregated, non-identifying form indefinitely for statistical and historical purposes (GDPR Article 89, Law 09-08 Article 9).
• Billing records: retained for five (5) years after the end of the customer relationship to comply with Moroccan commercial law (Code de Commerce) and tax obligations.
• Product telemetry (PostHog): retained 90 days then rotated; aggregate statistics may be retained longer in non-identifying form.
• Security logs (Sentry, gateway access logs): retained 90 days then rotated.
• Support correspondence: retained while the account is active, then purged within 12 months of account closure.
• Backup retention exception: active-system data is deleted immediately upon a verified erasure request. However, point-in-time database backups (PITR, retained up to 30 days) and cross-region cold backups (held in the private "cold-backups" object-storage bucket, retained up to 90 days) may temporarily continue to contain copies of your account data after erasure completes in the active database. These backup tiers are read-only, are never used to serve product features, and are subject to strict access controls. If a backup is ever restored to production, your erasure request is replayed against the restored data set before traffic resumes. After the rotation windows above, residual copies are unrecoverable.

When you confirm "Delete account" in Account Settings, the request runs through a single transactional procedure (the public.erase_user_data SECURITY DEFINER routine) plus a series of propagation calls. The end result, under normal conditions, is complete within a few seconds and removes your data from every active system we control.

• Database (Supabase EU / Frankfurt): rows keyed to your account in roast_records, synthetic_panel_runs, activity_logs, usage_tracking, hugo_sessions, api_keys, profiles, demo_leads, newsletter_subscribers, email_marketing_contacts, email_campaign_sends, referrals, transcription_jobs, edge_function_usage, public_api_jobs, brief_evaluations, analysis_feedback, organization_members, team_workspace_members, team_workspaces (you-owned), report_shares (you-created), and others are hard-deleted. Operational logs (lifecycle_email_events, pipeline_errors, vertex_usage_daily) are anonymized, the user-identifying columns are scrubbed but the non-PII operational state remains so we can run the platform safely.
• Object storage (Supabase EU): user-uploaded creative under the ad-assets, creative-assets, panel-assets, and (legacy) videos buckets, keyed to <your_user_id>/, is recursively deleted across every prefix. Admin-managed assets (media-library, blog-static-pages, og-images) are not touched because they contain no per-user data. The cold-backups bucket is intentionally not swept on erasure; it is covered by the backup-retention exception above.
• Stripe: any active subscription is canceled immediately, then stripe.customers.del is invoked. This anonymizes the customer object while preserving invoice records that we must retain for tax law (5+ years).
• PostHog (EU Cloud): the person profile is deleted via the Persons API; events for that distinct_id are removed by the same call.
• Sentry (EU): events tagged with your user_id auto-expire at the configured 90-day retention window. Email PII was already scrubbed at SDK ingestion (no per-user purge API exists; mass-delete via dashboard is available on request).
• Resend: marketing-audience contact deleted; sent-email events expire at 30-day Resend retention.
• Google Analytics (when active): a User Deletion API request is queued; Google processes asynchronously within 72 hours.
• Auth (Supabase): your auth.users row is deleted last, which fires the remaining ON DELETE CASCADE constraints across the database.
• Audit record: a PII-free receipt of the erasure (counts per table, per-bucket sweep results, per-vendor propagation status) is written to the gdpr_erasure_receipts ledger so that, if a supervisory authority later asks us to attest that user X was erased on date Y, we have a defensible record. The receipt is retained for six (6) years; it explicitly does not contain your email, name, IP, or any content. A database CHECK constraint enforces the no-PII rule at insert time.
• Email channel: a permanent unsubscribe-all row is inserted against your normalized email so any zombie sends queued elsewhere are blocked at send time.

Moroccan Law 09-08 (Articles 7-10), the EU GDPR (Chapter III), and the UK GDPR confer the following rights. Where frameworks differ, the most protective applies.

• Right of access: obtain confirmation whether we process your personal data and a copy of that data.
• Right of rectification: correct inaccurate or incomplete personal data.
• Right of erasure ("right to be forgotten"): have your personal data deleted where legal grounds for processing no longer apply (GDPR Article 17; Law 09-08 Article 10). Erasure runs through Account Settings → Delete account; the procedure hard-deletes account-keyed rows, anonymizes operational logs (lifecycle email events, pipeline errors, aggregate Vertex usage), sweeps user-scoped storage objects, propagates deletion to Stripe (customer object anonymized; invoice records retained per tax law), and signals PostHog to purge the person profile. Sentry person profiles are not auto-deletable via API; we send a manual purge request on receipt.
• Right to restrict processing: limit how we use your data while a dispute is being resolved (GDPR Article 18).
• Right to data portability: receive your personal data in a structured, commonly-used, machine-readable format (GDPR Article 20). Available for data you provided to us (email, uploaded creatives, workspace config, subscription state).
• Right to object: object to processing based on legitimate interests, including profiling where applicable (GDPR Article 21; Law 09-08 Article 9).
• Right to withdraw consent: withdraw any consent you previously gave (GDPR Article 7(3); Law 09-08 Article 4). Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right not to be subject to automated decisions with legal effects (GDPR Article 22; Law 09-08 Article 13), not triggered by our scoring since it produces advisory analysis, not legally binding determinations. You may still request human review.
• Right to lodge a complaint with a supervisory authority: Moroccan data subjects with the CNDP (cndp.ma); EU/EEA data subjects with their national DPA (for example the CNIL in France, AEPD in Spain, Garante in Italy); UK data subjects with the Information Commissioner's Office (ico.org.uk).
• How to exercise: email privacy@saliencylab.com. We respond within 30 days (GDPR Article 12(3)); extensions of up to two additional months are possible for complex requests, with notice. Moroccan Law 09-08 sets a 30-day response target that we match.

We apply technical and organizational measures proportionate to the risk, per Article 32 GDPR and Article 23 of Moroccan Law 09-08.

• TLS 1.3 for data in transit.
• AES-256 for data at rest (Supabase-managed Postgres and Object Storage defaults).
• Signed URLs with short-lived TTL (15 minutes) for creative asset access.
• Row-level security (RLS) policies enforcing workspace isolation at the database layer.
• Role-based access controls inside the product (owner / admin / editor / viewer).
• Least-privilege production access and audit logging for privileged operations.
• Security headers published at /security with links to independent scanners (SSL Labs, Mozilla Observatory, SecurityHeaders.com).

In the event of a personal data breach that is likely to result in a risk to data subjects, we will notify the relevant supervisory authority within 72 hours as required by Article 33 GDPR and notify affected account owners without undue delay under Article 34. Moroccan Law 09-08 Article 23 obligates notification to the CNDP where the breach affects rights of data subjects; we commit to the same 72-hour target.

The DPA at /dpa documents the breach-notification procedure for enterprise customers, including content requirements and escalation paths.

We use a small number of strictly-necessary cookies for authentication, session state, and abuse prevention (including the Cloudflare Turnstile widget on anonymous endpoints). Non-essential cookies (analytics, marketing attribution) are loaded only after affirmative consent via the banner on first visit. Full details, categories, durations, and controls are at /cookies.

The product is not directed to children. We do not knowingly collect personal information from children under the age of 15 in Morocco (the age of digital contracting under Moroccan law), under 16 in the EU/EEA (the default GDPR digital consent age under Article 8), or under 13 in the UK (Data Protection Act 2018).

If you believe a child has provided us personal information, contact privacy@saliencylab.com and we will delete it.

We may update this privacy policy from time to time. Material updates will be reflected on this page with a new "Last updated" date. For substantive changes that affect your rights, account owners will also be notified by email.

This policy is written to comply simultaneously with Moroccan Law 09-08, the EU GDPR, and the UK GDPR. Interpretation is governed by Moroccan law (see /terms §Governing Law), without prejudice to the rights EU/EEA and UK data subjects have under their home jurisdictions.

EU/EEA data subjects: no term in this policy limits rights you have under GDPR Chapter III.

UK data subjects: no term in this policy limits rights you have under UK GDPR or the Data Protection Act 2018.

Moroccan data subjects: all rights under Law 09-08 are preserved and may be exercised directly with the controller (privacy@saliencylab.com) or by complaint to the CNDP (cndp.ma).