Piik Labs AB · Version 2.0.7

Privacy Policy

Effective: 9 November 2026
Last updated: 9 November 2026

Applies to the Buzzmark application and the website at buzzmark.ai.

Earlier versions: 2.0.6 (PDF) (opens in a new tab), 2.0.5 (PDF) (opens in a new tab), 2.0.4 (PDF) (opens in a new tab), 2.0.3 (PDF) (opens in a new tab), 2.0.2 (PDF) (opens in a new tab), 2.0.1 (PDF) (opens in a new tab), 2.0.0 (PDF) (opens in a new tab), 1.0.1 (PDF) (opens in a new tab)

1. Who we are

This Privacy Policy applies to Piik Labs AB, a company registered in Sweden with organisation number 559577-8506 (the “Company”, “we”, “us”, “our”).

We operate the Buzzmark application (the “App”), and the website at buzzmark.ai (the “Website”) (together, the “Services”).

For the personal data described in this Policy, Piik Labs AB is the data controller under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and the Swedish Data Protection Act (lag (2018:218) med kompletterande bestämmelser till EU:s dataskyddsförordning). Section 5 explains the one case where we act for you instead: personal data about other people that you put into the Services.

1.1Scope: which product this policy covers

Buzzmark is a Piik Labs brand. Piik Labs AB operates other products and services under separate brands. This Privacy Policy applies only to Buzzmark and buzzmark.ai. Other Piik Labs products are governed by their own separate privacy policies, and the processing described here does not extend to them.

1.2Contact

Data controller: Piik Labs AB
Organisation number: 559577-8506
VAT number: SE559577850601
Registered address: Box 691, 414 52 Göteborg, Sweden
Privacy enquiries: privacy@buzzmark.ai
Legal and compliance: legal@buzzmark.ai
Supervisory authority: Integritetsskyddsmyndigheten (IMY), imy.se · imy@imy.se

Data Protection Officer. We have not designated a Data Protection Officer under Article 37 GDPR, as we are not required to do so. All privacy matters are handled directly by the Company and should be directed to privacy@buzzmark.ai.

2. Scope of this policy

This Policy applies to all personal data we collect when you visit the Website, create an account, use the App, connect a social media account or an AI app to it, buy a subscription, or contact us. It does not apply to third-party websites or services linked from the Services, including the social media platforms you connect, which process your data under their own policies (see section 7.2).

3. Personal data we collect

We collect personal data in four ways: data you provide, data from the social media accounts you connect, data generated automatically when you use the Services, and data from other sources. We also generate content for you, described in section 3.5.

3.1Data you provide

Account and profile data

Email address, which is also how you sign in (with a one-time code sent to it)
Name, company name and account type
Profile photo and phone number (optional)
A separate address for notification emails (optional)
Preferences such as time zone, clock format, the first day of your week and which notifications you want
When you agreed to each kind of automated action on your accounts, and whether you allow AI to read your LinkedIn posts

Brand data

Your website address
Your brand profile: voice, audience, colours, fonts, example posts, words to avoid, calls to action and hashtags
Products you add, and their photos

Content

Posts, drafts and scheduled posts, including the text, images, videos and documents you add to them
Instructions and notes you give to Buzz, our AI writer, and screenshots you share with it
Your posting schedule and the settings you choose for each post and platform

Your team

The email address and role of each teammate you invite, and who invited them
Comments you and your teammates write on posts, and who wrote them
A record of who did what with each post, and when

Payment data

Your plan, billing period, subscription status and payment history
Billing name and address, and your business VAT number if you give one

Payments are processed by Stripe. We do not receive or store your card details.

Communications

Messages you send us through the Help center, the contact form or by email

3.2Data from the social media accounts you connect

When you connect a social media account, we receive the following from the platform through our publishing provider:

The account's name, username, profile picture and identifier
Posts on that account, including ones you publish outside Buzzmark, and their metrics, such as views, likes, comments, shares and saves
Follower counts and how they change over time
Comments on your posts, including the commenter's name, username, profile picture and words, when you open them in the App

The access tokens that let us post to your accounts are held by our publishing provider (section 7.1), not by us.

3.3Data collected automatically

Technical data: IP address, browser type and version, operating system, the pages you request and the time of each request.
Service logs: our hosting and backend providers record the requests the Services handle, including your IP address, to diagnose faults and investigate misuse.
Usage records: how much of your plan's allowance you have used, and one record per AI request with the feature, the model, the amount used and whether it succeeded. These records never contain what you wrote or what the AI wrote back.
Security records: to limit sign-in attempts, we keep a one-way hash of your email address and of the network your request came from, never the address or the IP address itself.
Country: derived from your IP address to show prices in your currency. It is not stored.
Time zone: read from your browser to schedule posts and notifications at the right local time.
Website visits: the pages you visit on buzzmark.ai, the site that sent you, your approximate location and your browser and device type, to measure visits to the website.

3.4Data from other sources

Your website: the public pages of the website you give us, to learn your brand.
Public web pages and search results: about the competitors, topics and news you ask us to research.
Stripe: confirmation of your payment and subscription status.
A teammate who invites you: your email address and role.

Public pages can contain personal data, such as the name of a person quoted in a news article. We use it only to give you the research you asked for.

3.5Content we generate for you

Buzz writes posts, ideas, rewrites and research summaries, and makes pictures, from the data in sections 3.1 to 3.4. What it makes is stored in your account, together with the instructions it was made from, until you delete it. Pictures made with AI are marked “Made with AI” in the App and carry provenance metadata from the model provider.

4. How and why we use your data

We only process your personal data where we have a valid legal basis under the GDPR. The table below sets out our processing purposes, the data involved, and the legal basis for each.

Purpose	Data used	Legal basis (GDPR)
Create and manage your account, and sign you in	Account and profile data, security records	Art. 6(1)(b): contract
Learn your brand and write, rewrite and make content for you	Brand data, content, data from your website, connected account data	Art. 6(1)(b): contract
Publish and schedule posts to the accounts you connect	Content, connected account data, time zone	Art. 6(1)(b): contract
Show you how your posts perform, and let you read and answer comments	Connected account data	Art. 6(1)(b): contract
Let your team work on your account together	Your team data, account and profile data	Art. 6(1)(b): contract
Keep a record of the automated actions you agreed to, and whether you allow AI to read your LinkedIn posts	Account and profile data	Art. 6(1)(f): legitimate interest, showing the platforms we act with your agreement
Research competitors, topics and news you ask about	Public web pages and search results, brand data	Art. 6(1)(b): contract
Let the AI apps you connect act on your account	Whatever the app's requests read or create	Art. 6(1)(b): contract
Process payments, manage subscriptions and apply VAT	Payment data, country	Art. 6(1)(b): contract Art. 6(1)(c): legal obligation
Count your plan's allowances and keep AI use within fair limits	Usage records	Art. 6(1)(b): contract Art. 6(1)(f): legitimate interest
Understand how the Services are used, and plan and price them	Usage records, anonymised once an account is deleted	Art. 6(1)(f): legitimate interest
Send service emails: sign-in codes, post outcomes, summaries and security notices	Email address, content, connected account data	Art. 6(1)(b): contract
Send news about Buzzmark	Email address	Art. 6(1)(a): consent
Answer questions and support requests	Communications and account data	Art. 6(1)(b): contract, or steps you ask for before one; Art. 6(1)(f): legitimate interest for other questions
Measure visits to the website	Website visit statistics	Art. 6(1)(f): legitimate interest
Show prices in your currency	Country	Art. 6(1)(f): legitimate interest
Keep the Services secure and prevent fraud and abuse	Technical data, service logs, security records, usage records	Art. 6(1)(f): legitimate interest
Keep accounting records and comply with other legal obligations	Payment data, and other data as required	Art. 6(1)(c): legal obligation
Establish, exercise or defend legal claims	Relevant data as required	Art. 6(1)(f): legitimate interest

Where we rely on legitimate interest, our interest is in running a reliable, secure service that charges correctly. You can object to it at any time (section 10).

5. Other people’s data in your content

Your content can contain personal data about other people: a customer in a photo, a colleague you mention, the people who comment on your posts. For that data, you are the controller and we process it on your behalf, only to provide the Services to you. The terms of that processing are in section 12 of our Terms and Conditions.

You are responsible for having a lawful basis to share that data with us and to publish it. If you are one of those people and have a question about your data, contact the business that published it. If you contact us, we will pass your request on to them.

6. AI features

Buzz is an artificial intelligence system, not a person. To write and make content, we send the data the task needs to our AI providers (section 7.1): the instruction, the relevant post or draft, your brand profile and, for pictures, the product photo used as a reference.

Our AI providers process this data as our processors and do not use it to train their models.
We never send your LinkedIn posts' metrics, or anything we derive from them, to our AI providers or to an AI app you connect. We send the text of your own LinkedIn posts to our AI providers only if you allow it.
What Buzz makes is not reviewed by a person before it reaches you. It can be wrong, and you decide whether to use it.
We do not use AI to make decisions about you that have legal or similarly significant effects.

8. International data transfers

Piik Labs AB is based in Sweden, and our database, file storage and server functions are in the EU. Some of our service providers are established or process data outside the European Economic Area (EEA), including in the United States.

When we transfer personal data outside the EEA, we ensure appropriate safeguards are in place, including:

Standard Contractual Clauses approved by the European Commission;
Transfers to countries covered by an EU adequacy decision, including certification under the EU-U.S. Data Privacy Framework where applicable;
Supplementary technical and organisational measures where required.

You may request a copy of the applicable safeguards by contacting privacy@buzzmark.ai.

9. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by law. When you delete your account, it closes at once, and 30 days later we delete or anonymise your personal data, except where the law requires us to keep it. Signing in during those 30 days cancels the deletion.

Data category	Retention period
Account and profile data	Until account deletion
Brand profiles, products and their photos	Until you delete them or your account
Posts, drafts, files and content we generate for you	Until you delete them or your account
Data about a connected social media account	Until account deletion. Disconnecting an account stops new data, and keeps its post history for your reports.
Comments on your posts	Not retained. Shown while you read them.
Your team data	Until you delete it, or the organization's account is deleted
A teammate who leaves or is removed	Their name, email address and photo are erased. What they wrote stays with the organization.
Your agreement to automated actions and to AI reading your LinkedIn posts	Until account deletion
Research results	Until account deletion
Usage records	Until account deletion. After that, kept without anything that identifies you, for statistics and planning.
Security records for sign-in	24 hours
Sign-in codes	Expire after 10 minutes
Service logs	Up to 30 days
Website visit statistics	24 hours, then kept only as totals
Payment and billing records	7 years (Swedish Bookkeeping Act, bokföringslagen)
Support communications	24 months after the matter is closed
Legal hold data	As required by applicable law

Posts you have published stay on the platforms after you delete them in Buzzmark or delete your account. To remove them there, delete them on the platform.

10. Your rights under the GDPR

As a data subject in the EU/EEA, you have the following rights. We will respond to all requests within one month.

Access (Art. 15): obtain a copy of the data we hold about you.
Rectification (Art. 16): correct inaccurate or incomplete data. Most data can be updated directly in the App.
Erasure (Art. 17): delete your data. You can delete your account in Settings → Account → Delete account, and we then erase your data as described in section 9. You can also ask us at privacy@buzzmark.ai from the email address you sign in with.
Restriction (Art. 18): limit how we process your data in certain circumstances.
Portability (Art. 20): receive your data in a structured, machine-readable format. You can export your content in Settings.
Objection (Art. 21): object to processing based on our legitimate interests, and to direct marketing at any time.
Withdraw consent (Art. 7): at any time, using the unsubscribe link in any email or by contacting us. Withdrawal does not affect prior processing.

To exercise any of these rights, contact privacy@buzzmark.ai. You may also lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se, or with the supervisory authority where you live.

11. Cookies and browser storage

We use only what the Services need to work, so there is no consent banner:

What	Why	How long
Session cookie (buzzmark_session)	Keeps you signed in	30 days, or until you sign out
Browser storage	Keeps you signed in, and remembers your settings on this device, such as theme, background, sidebar, language and calendar view	Until you sign out or clear it

Website visit statistics (section 3.3) use no cookies and no browser storage.

If we introduce advertising or any other technology that requires your consent, we will update this section and ask for your consent before it begins.

12. Minimum age

You must be at least 18 years old to create an account. The Services are built for businesses and the people who run them, and are not directed at children. We do not knowingly collect personal data from anyone under 18.

If you believe a person under 18 has provided us with personal data, contact us at privacy@buzzmark.ai and we will investigate and delete that data promptly.

13. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

Encryption of data in transit using TLS 1.2 or higher
Encryption of stored data at rest, in our database and file storage
Sign-in with one-time codes, with limits on attempts
Access controls so that your data is accessible only to your account
Tokens for connected AI apps stored only as one-way hashes, and revocable at any time
Credentials for our service providers held in secret storage, never in source code
Selection of processors who offer appropriate security guarantees under Article 28 GDPR

Files you add to a post, and pictures we make for you, are stored at web addresses that cannot be guessed, so that the platforms can fetch them. Anyone who has such an address can open the file.

No system is perfectly secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by GDPR Articles 33 and 34.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the version number and the “Last updated” date at the top of this document;
Notify you by email if you have an account with us;
Where required by law, seek your renewed consent.

Earlier versions remain available from the top of this page.

15. Users outside the EEA

The Services are operated from Sweden and are designed around EU data protection standards. If you use the Services from outside the EEA, your personal data will be processed in the EEA and in the other locations described in sections 7 and 8. Depending on where you live, you may have additional or different rights under local law. Contact us at privacy@buzzmark.ai and we will tell you what rights apply to you and help you exercise them.

If you live in the United States, your state may give you specific rights over your personal data, such as the right to know what we hold, to have it corrected, or to have it deleted. We extend the rights described in section 10 to everyone who uses the Services, wherever they live.

If you live in California, you can ask to know, correct or delete the personal information we hold about you, and to limit how we use it, without being treated differently for asking. Write to privacy@buzzmark.ai.

16. Governing law and jurisdiction

This Privacy Policy is governed by the laws of Sweden and the European Union, including the General Data Protection Regulation (EU) 2016/679 and the Swedish Data Protection Act (lag (2018:218)).

Any disputes arising from this Policy are subject to the jurisdiction of the Swedish courts, without prejudice to your rights as a consumer under applicable mandatory law in your country of residence.

17. Contact us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Company: Piik Labs AB
Organisation number: 559577-8506
VAT number: SE559577850601
Address: Box 691, 414 52 Göteborg, Sweden
Privacy enquiries: privacy@buzzmark.ai
Legal and compliance: legal@buzzmark.ai
Supervisory authority: Integritetsskyddsmyndigheten (IMY), imy.se · imy@imy.se