Privacy Policy

1. Who we are

This policy is issued by Rank First Labs Ltd, the company behind Lola, registered in Cyprus (registration number HE 494678) and based in Limassol, Cyprus ("we", "us", "Lola"). For the personal data described here, we are the data controller, which means we decide how and why it is used. Because we are established in the European Union, we follow the EU General Data Protection Regulation (GDPR). We also respect the privacy laws of the US states where our clients and visitors are.

When we act for our clients. Some information we handle belongs to our clients' own customers, for example reviewers whose reviews we answer, or questions customers asked a business. For that information we act on behalf of our client (as a "processor" or "service provider"), and the client's own privacy notice applies too. Contact: hello@startlola.com.

2. What we collect

Information you give us

• Waitlist and contact forms: your name, phone number, email address, business name and anything you write to us.
• The Lola ASK interview: your answers about your business, such as services, jobs you have done, service areas, equipment, licenses, insurance, certifications, what customers ask you, what makes you different, and the work you want more of.
• Your team: names, roles, photos and stories of employees or crew you choose to share, and job photos or videos your crew sends us.
• Account and access details: login details or manager access you give us for your domain, website, Google Business Profile and other accounts, and your approval settings.
• Billing: billing name, address and plan. Card payments are handled by our payment provider; we do not store full card numbers.
• Conversations: emails, WhatsApp and SMS messages, and call notes between you and us.

Information we collect automatically

• Website use: pages visited, device and browser type, approximate location from your IP address, referring site and similar data, collected through cookies and similar tools (see section 13).
• Performance data from your accounts: with your access, data such as Google Business Profile insights, search performance, rankings, indexing status, website analytics and reviews, so Lola can see what is working.

Information from other sources

• Public information about your business and your competitors, such as listings, websites, reviews and search results.
• Details from someone who referred you, or from an agency that works with us under a white label agreement.

3. Information about your team and your customers

If you give us information about your employees or crew, you confirm they know about it and agreed to appear on your website and profiles. They can ask us, or you, to remove them at any time.

If we reply to reviews or use customer questions for your pages, we only use what is needed for that job. We do not publish a customer's private details on your pages. Questions from customers are used as topics, not as personal records.

Please do not send us sensitive information we do not need, such as health information about customers, Social Security numbers or payment card numbers.

4. How we use it, and our legal reasons

Under the GDPR we must have a legal reason (a "lawful basis") for each use. Here is what we do and why:

5. How Lola uses AI

Lola uses AI models, together with our team, to draft pages, articles, posts and review replies, and to analyze what is working. To do that, we send relevant information (for example your ASK answers or a review you received) to AI model providers who process it on our behalf.

• Lola learns from the work. We use the information from the work we do for clients, such as ASK answers, the pages and content we create, and their results (what gets indexed, what ranks, what brings calls), to train and improve Lola. This is how Lola gets better for every client.
• This learning stays inside our own systems. We never sell it, and we never publish one client's private information on another client's pages.
• If you do not want your data used to train Lola, email us and we will exclude it from future training. This does not affect the Service you receive.
• Our team reviews Lola's work, and you choose in your settings what needs your approval before it goes live.

6. Who we share it with

We do not sell your personal information. We share it only with:

• Service providers who help us run Lola, such as website hosting, WordPress and site tools, email, messaging (including WhatsApp and SMS providers), AI model providers, payment processing, customer support, analytics and cloud storage. They may only use it to provide their service to us.
• Platforms where you ask us to act, such as Google (for your Business Profile and search tools) and Meta (for WhatsApp, Facebook and Instagram). What we publish there becomes public.
• An agency you work with, if you came to Lola through a white label partner.
• Professional advisers such as lawyers and accountants, under confidentiality.
• A buyer or successor if our business is merged, sold or reorganized, under this policy.
• Authorities when the law requires it or to protect rights and safety.

If you allow marketing cookies (section 13), advertising platforms may receive data about your visit. Some US state laws call this "sharing" for targeted advertising. You can turn this off at any time in Cookie settings, and we honor the Global Privacy Control signal as an opt out.

7. Text messages and WhatsApp

Mobile numbers and text message consent are never shared with third parties or affiliates for their own marketing or promotional purposes. We share them only with the providers that deliver messages for us. Message frequency varies and message and data rates may apply. Reply STOP to opt out of SMS or HELP for help, or email hello@startlola.com.

8. International transfers

We are based in Cyprus, our clients are in the United States, and some of our providers are in the US and other countries. When personal data moves from the European Economic Area to a country without an EU adequacy decision, we use safeguards approved by the European Commission, such as Standard Contractual Clauses, or rely on the EU US Data Privacy Framework where a provider is certified.

9. How long we keep it

• Waitlist data: until you start a plan or ask us to delete it. You can unsubscribe or ask for deletion at any time.
• Client data: while you are a client, and up to 12 months afterward so we can help with transfers, questions and disputes. Then we delete it or make it anonymous.
• Billing and tax records: as long as tax and accounting laws require.
• Access credentials: we stop using them when you leave and delete any stored credentials within 30 days.

Your website and content belong to you, so leaving does not delete them from your own accounts.

10. How we protect it

We use reasonable technical and organizational measures to protect your data, including access limited to team members who need it, encrypted connections, secure credential storage and trusted providers. No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities where the law requires.

11. Your rights

Everyone

You can ask us to show you the personal data we hold about you, correct it, delete it, or stop sending you marketing. Email hello@startlola.com. We may need to confirm your identity first. We reply within one month, or within 45 days where US state law sets that period.

People in the EU, UK and EEA

You also have the right to data portability, to restrict or object to processing (including processing based on legitimate interests), and to withdraw consent at any time. You can complain to the Cyprus Commissioner for Personal Data Protection (dataprotection.gov.cy) or to your local data protection authority.

US state residents

Depending on your state (for example California, Colorado, Connecticut, Virginia, Texas and others), you may have the right to know what we collect and share, to access, correct and delete it, to get a portable copy, and to opt out of sale, sharing for targeted advertising, and profiling. We do not sell personal information and do not use it for profiling that produces legal or similarly significant effects. You can use an authorized agent, and we will not treat you differently for using your rights. If we decline a request, you can appeal by replying to our decision.

12. Marketing choices

You can unsubscribe from marketing emails with the link in any email, reply STOP to marketing texts, or email us. You will still receive messages needed to run your plan.

13. Cookies

Cookies are small files a website stores in your browser. We group ours into three types. Necessary cookies are always on, because the site cannot work properly without them. Analytics and marketing cookies only run if you say yes in the cookie banner. You can change your choice at any time in Cookie settings, or through a link in the footer.

We list analytics and marketing tools we use or may use. They only load after you allow their type. Our website also loads fonts from Google Fonts, which receives your IP address to deliver the font files but does not set cookies.

You can also block or delete cookies in your browser settings. Blocking necessary cookies may stop parts of the site from working.

14. Children

Lola is a service for businesses. It is not meant for anyone under 18, and we do not knowingly collect personal data from children. If you think a child sent us information, contact us and we will delete it.

15. Changes to this policy

We may update this policy as Lola grows. The date at the top shows the latest version. If a change materially affects how we use your personal data, we will tell you by email or on this website before it applies.

16. Contact us

Rank First Labs Ltd (Lola), data controller
Registered in Cyprus, registration number HE 494678
Athinas 25, Agios Athanasios
4105 Limassol, Cyprus
Email: hello@startlola.com

For any privacy question or request, write to us and put "Privacy" in the subject line.