Privacy Policy

Introduction

This Privacy Policy explains how Defacto Labs (“Defacto”, “we”, “us”, “our”) collects, uses, discloses, and protects personal data in connection with our website, platform, widgets, APIs, verification services, and related tools (collectively, the “Services”).

This Privacy Policy applies to: (a) visitors to our website; (b) business customers who use our Services (“Customers”); (c) authorised users who access a Customer’s account (“Authorised Users”); (d) end users and consumers who interact with widgets, badges, verification pages or other outputs produced through our Services (“End Users”); and (e) individuals who contact us, attend our events, or otherwise interact with us.

This Privacy Policy should be read together with our Terms of Service and, where applicable, our Data Processing Agreement.

Controller and contact

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the UK GDPR, and equivalent data protection laws, Defacto Labs, UAB is the data controller for personal data processed as described in this Privacy Policy, except where we act as a data processor on behalf of a Customer (in which case the Customer is the controller and our Data Processing Agreement applies).

You can contact us about this Privacy Policy or your data at:

Personal data we collect

We collect only what we need to operate, secure, and improve our Services and to run our business.

1. Account and Customer data

When a Customer signs up or when an Authorised User is added to a Customer account, we collect: name, business email, job title, telephone number, company name, company registration details, billing and address information, login credentials, preferences and settings, and any other information provided in account setup or support communications.

2. Content and verification data

We collect content that Customers upload or otherwise make available to the Services, including Certificates of Analysis, lab reports, product information, SKUs, formulations, images, logos, and other product or brand materials. To the extent this content contains personal data (for example, the name of a lab technician or a signatory on a CoA), we also process that personal data. We use automated and AI-assisted tools to extract and structure data from documents submitted to the Services; verification decisions involve human review.

2A. Public verification page data

Where a Customer chooses to publish or display verification outputs through our widgets, badges, public verification pages or related public features, we may display selected information from Customer Content and verification records for transparency purposes. This may include product name, SKU, batch or lot number, sample or report reference, laboratory name, laboratory accreditation information where provided, lab test date, verification date, tests reviewed, claims reviewed, verification status, downloadable CoA or report summary, and similar.

Customers must not submit personal data for public display unless they have the right to do so and the display is necessary for the intended verification purpose. To the extent a CoA or supporting document contains personal data, such as a laboratory signatory, technician name or named expert, Customers are responsible for ensuring they have an appropriate lawful basis or permission for submitting and publishing that information through the Services.

3. Payment data

When a Customer subscribes, we collect billing contact details, VAT/tax identifiers, purchase history, invoices and transaction records. Card and bank details are collected and processed directly by our payment processor (currently Stripe) and are not stored by us.

4. Usage data

When you use our Services, we automatically collect technical and usage information, including IP address, device identifiers, browser type and version, operating system, referring URLs, pages viewed, interactions with widgets, features used, timestamps, approximate location (derived from IP), and performance and diagnostic data.

5. Cookies and similar technologies

We use cookies, pixels, local storage and similar technologies to operate the Services, remember preferences, maintain sessions, secure the Services, measure performance, and perform analytics. Our Cookie Policy (available at defactolabs.com/cookies) describes the cookies we use and how to manage them.

6. Communications

When you contact us, subscribe to a newsletter, respond to a survey, attend an event, or otherwise communicate with us, we collect your name, email address, the content of your communication, and any other information you provide.

7. Marketing and prospect data

We may collect business contact details of potential customers (name, business email, company, role) from public sources, trade shows, opt-ins, lead-generation providers, and referrals, for business-to-business marketing purposes, subject to applicable law.

8. Third-party sources

We may receive personal data from third parties, including: payment processors, identity and company verification providers, lab and industry data partners, analytics and advertising providers, and integrations you connect to the Services (for example, Shopify, WooCommerce, Google, Meta).

9. Shopify and e-commerce platform data

When a Customer installs our Shopify app or connects a Shopify store, we receive merchant account data (store name, store URL, merchant contact details, plan and configuration data) and product catalogue data needed to operate the Services. To measure widget performance and produce aggregated conversion statistics for the Customer, we may access order information such as order totals and whether the related product displayed a Defacto widget. We do not collect, store or use shopper personal details (such as names, email addresses, postal addresses, phone numbers or payment details): order information is processed only to produce aggregated, non-identifying statistics, and no personal data of shoppers is retained. We handle Shopify data in accordance with Shopify’s protected customer data requirements and our Data Processing Agreement, request only the minimum data and API scopes necessary, and do not use Shopify data for advertising, profiling or any unrelated purpose. We retain Shopify data only as long as needed to provide the Services, and we delete or anonymise store data following app uninstallation in line with Shopify’s data deletion requirements (including responding to Shopify GDPR webhooks for data access and erasure requests).

How we use personal data

Each use has a defined legal basis under data protection law.

We use personal data to:

  • provide, operate, secure, personalise, and improve the Services (legal basis: performance of a contract; our legitimate interests);
  • review, structure and display data and other content submitted to the Services (performance of a contract; legitimate interests);
  • process payments, manage billing and collect fees (performance of a contract; legal obligation; legitimate interests);
  • authenticate users, prevent fraud, enforce our Terms, and protect the security, integrity and availability of the Services (legitimate interests; legal obligation);
  • communicate with you about the Services, respond to support and security inquiries, and send administrative notices (performance of a contract; legitimate interests);
  • send you marketing communications about our products, features, case studies, events and industry insights, which you can opt out of at any time (legitimate interests; consent where required by law);
  • understand how the Services are used, develop new features, and produce research and industry insights (legitimate interests);
  • comply with legal, regulatory, tax, accounting and record-keeping obligations, and respond to lawful requests from authorities (legal obligation);
  • establish, exercise and defend legal claims (legitimate interests);
  • operate and develop our business (legitimate interests).

How we share personal data

We don’t sell personal data. We share it with specific categories of recipients for specific purposes.

We share personal data with:

Public verification outputs. Where a Customer enables a public widget, badge or verification page, the selected information displayed in that output may be visible to consumers, website visitors, search engines, AI search services, browser assistants and other public discovery tools, subject to our Terms and technical controls.

  • Service providers and processors who host, store, send, process or analyse data on our behalf - including cloud hosting, payment processing, email delivery, analytics, customer support, security, and communications providers - all under contractual confidentiality and data-protection obligations.
  • Integration partners you or Customers have connected to the Services (for example, Shopify, WooCommerce, Google, Meta), to the extent necessary to operate those integrations.
  • Customers and Authorised Users where personal data relates to their account, content, or verification outputs.
  • End Users, consumers and the public where personal data is included in publicly-displayed verification outputs (for example, a widget, verification page, or badge shown on a Customer’s website).
  • Professional advisers including legal, tax, accounting, audit and insurance advisers, under appropriate duties of confidentiality.
  • Authorities where required by law, court order, or legitimate regulatory or governmental request, or where necessary to protect rights, safety or property.
  • Our affiliates and related companies who operate under equivalent data protection standards.
  • Other recipients with your consent or at your direction.

International data transfers

We may transfer personal data outside the European Economic Area (EEA), the United Kingdom, and Switzerland, including to the United States and other countries. Where we do, we rely on appropriate safeguards recognised under applicable law, including the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement, the EU-U.S. Data Privacy Framework (where applicable), adequacy decisions, or equivalent mechanisms.

Data retention

We keep personal data for as long as necessary for the purposes described in this Privacy Policy, including: (a) while your account is active; (b) as required to provide the Services; (c) to comply with our legal, tax and accounting obligations; (d) to establish, exercise or defend legal claims; and (e) to operate our business consistent with our Terms. Where we no longer need personal data, we delete, anonymise or aggregate it. Content and derived data may be retained and continue to be used as described in our Terms even after your account ends.

Your rights

Subject to applicable law, you have rights over your personal data. We help you exercise them.

Depending on where you are, you may have the right to:

  • access the personal data we hold about you and receive a copy;
  • ask us to correct inaccurate or incomplete data;
  • ask us to delete your personal data in certain circumstances;
  • object to or restrict processing in certain circumstances;
  • receive your personal data in a portable format;
  • withdraw consent at any time where processing is based on consent;
  • opt out of marketing communications;
  • lodge a complaint with a supervisory authority - in Lithuania, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija); in other EU/EEA countries, your local authority; in the UK, the Information Commissioner’s Office.

To exercise these rights, contact us at [privacy@defactolabs.com]. We may ask you to verify your identity before responding. We will respond within the timeframes required by applicable law.

U.S. state privacy rights

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, or another U.S. state with comprehensive privacy legislation, you may have additional rights under those laws, including the right to know, access, delete, correct, limit, and opt out of the sale or sharing of personal information, and the right not to be discriminated against for exercising those rights. We do not sell personal information, and we do not share personal information for cross-context behavioural advertising purposes, as those terms are defined under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). To exercise your rights, contact [privacy@defactolabs.com].

Security

We use administrative, technical and organisational measures designed to protect personal data against loss, misuse, unauthorised access, disclosure, alteration and destruction. No system is ever completely secure; we cannot guarantee absolute security, but we work continuously to improve our safeguards and to respond promptly to any incidents.

Children

Our Services are not directed to individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at [privacy@defactolabs.com] and we will take appropriate steps to delete it.

Processors and sub-processors

When we act as a data processor on behalf of a Customer (for example, where we process personal data that Customer content contains), our Data Processing Agreement applies and describes our obligations, including the sub-processors we engage. A current list of our sub-processors is available on request at [privacy@defactolabs.com].

Aggregated and derived data

We may aggregate, anonymise or de-identify personal data so that it no longer identifies you, and use or share the resulting data without restriction, including to produce research, benchmarks, industry insights and other outputs, and to improve and develop our Services and systems. As described in our Terms, aggregated and derived data is our data.

Corporate matters

In connection with an actual or proposed financing, investment, reorganisation, merger, acquisition, sale of assets, bankruptcy or similar event, we may share personal data with advisers, counterparties and other relevant parties, under appropriate confidentiality protections. If a transaction results in personal data being transferred to another entity, we will notify affected individuals in the manner required by applicable law.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Updates take effect when posted on our website. Your continued use of the Services after an update means you accept the updated Privacy Policy. The “Last updated” date at the top of this document tells you when it was last revised.

Contact

Questions or concerns about this Privacy Policy or your personal data? Contact us at [privacy@defactolabs.com], or write to us at Defacto Labs, UAB, Ežero g. 11, Papiškių k., LT-65400 Varėnos r, Vilnius, Lithuania. Company code: 307341982