LaikaHub
Effective 18 July 2026 · Pilot 1.0

Privacy Policy

1. Who we are

Babete, Lda. ("Babete, Lda.", "we", "us") operates LaikaHub (laikahub.babete.pt), a workspace for marketing, CRM, and sales. For the personal data described in this Policy, Babete, Lda. acts as the data controller.

You can reach us for any privacy question or request at privacy@babete.pt, or dpo@babete.pt for matters directed to our data protection contact.

2. What data we collect and why

We collect the data needed to run your account and to provide LaikaHub's marketing, CRM, and sales features:

  • Account data — email address, name, and role, to create and secure your account and to identify who performs actions inside a workspace.
  • Authentication data — session identifiers and password/authentication tokens, handled through our authentication provider, to keep you signed in securely.
  • Business data you upload or create — contacts, leads, campaigns, pipeline/deal records, notes, and interaction history you or your organization add to LaikaHub, processed to deliver the CRM and campaign features you use.
  • AI feature inputs and outputs — text you submit to an AI-assisted action (for example, drafting a campaign message) and the resulting draft, processed to generate the requested content.
  • Push notification data — a browser-issued push subscription endpoint, if you opt in to notifications, used only to deliver the notifications you requested.
  • Technical and usage data — IP address, device/browser information, and pages viewed, collected for security logging and, where you consent, website analytics.
  • Cookies — see Section 3.

3. Cookies

We use a strictly necessary session cookie to keep you signed in; this cookie does not require consent because it is essential to providing the service you requested.

Where you consent, we also use analytics cookies delivered through Google Tag Manager to understand aggregate usage of the site. You can withdraw this consent at any time through your cookie preferences; withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

4. How we share data

We do not sell personal data, and we do not share it with third parties for their own marketing purposes. We share personal data only with service providers who process it on our behalf, under contract, to operate LaikaHub:

  • Supabase — database hosting and authentication (EU-based infrastructure: Frankfurt primary, Dublin replica).
  • Cloudflare, Inc. — hosting/edge compute for the application and feature-flag delivery.
  • Google LLC — website analytics via Google Tag Manager, where you have consented to analytics cookies.
  • Lovable and OpenAI, L.L.C. — AI feature requests are routed through Lovable's gateway to an underlying OpenAI model to generate AI-drafted content. We are actively evaluating EU-based alternatives to reduce this dependency and will update this Policy when that transition happens.

5. International transfers

Our core database and authentication infrastructure (Supabase) is hosted in the EU. Where a service provider processes personal data outside the EU/EEA — currently Google, Lovable, and OpenAI, all U.S.-based — the transfer is protected by Standard Contractual Clauses approved by the European Commission (Decision 2021/914) and, where applicable, the provider's EU-U.S. Data Privacy Framework certification. A copy of the relevant safeguards is available on request.

6. AI-generated content and transparency

Some LaikaHub features use AI to draft content for you, such as campaign messages. Content produced this way is always presented to you as an AI-generated draft — it is not sent, published, or acted on automatically. You review, edit, and explicitly approve it before it is used, consistent with the transparency obligations of Article 50 of the EU AI Act.

7. Automated decision-making

LaikaHub does not make decisions producing legal or similarly significant effects about you using solely automated processing. AI drafting features (Section 6) always require your review and explicit action before any output is sent or acted upon.

8. Your rights under the GDPR

Subject to the conditions set out in the GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate or incomplete personal data.
  • Erase your personal data, in certain circumstances.
  • Restrict or object to certain processing.
  • Receive a portable copy of the data you provided to us.
  • Withdraw consent at any time, where processing is based on consent.

9. Right to lodge a complaint

You can raise a request or complaint directly with us at any time using the contact details in Section 1. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), the Portuguese data protection supervisory authority, or with the supervisory authority of your own EU member state.

10. Security measures

We apply technical and organizational measures appropriate to the risk, including encryption in transit (TLS), secure session handling, access controls scoped to each organization's workspace, rate limiting on sensitive actions, and audit logging of key account activity.

11. Data retention and deletion

We retain personal data only for as long as necessary for the purposes described in this Policy, to provide the service to you, or to comply with our legal obligations. When you close your account, your business data is deleted or anonymized within a reasonable period, except where we are required to retain it by law.

12. Children's privacy

LaikaHub is a business tool intended for use by working professionals and is not directed at children. We do not knowingly collect personal data from children.

13. Changes to this Policy

We may update this Policy from time to time. We will update the effective date below and, for material changes, notify active account holders by email.

14. Contact

For any question about this Policy or to exercise your rights, contact us at privacy@babete.pt.