Privacy Policy

1. Overview

This Privacy Policy explains how ShortLane collects, uses, stores, shares, and otherwise processes personal data when you visit our website, join the waitlist, create an account, connect third-party platforms, or use the product.

We designed this notice to be more closely aligned with privacy frameworks such as the European Union General Data Protection Regulation (GDPR) and the Brazilian Lei Geral de Protecao de Dados Pessoais (LGPD). It is a product-facing transparency notice, not legal advice.

2. Controller, Operator, and Processing Roles

For the website, waitlist, account creation, product administration, security, support, and analytics described in this notice, ShortLane generally acts as the controller under the GDPR and the controlador under the LGPD because we determine the purposes and means of that processing.

When we process customer content, publishing metadata, or connected platform data on behalf of a workspace or business customer, our role may vary by context. In some workflows, we may act as a processor under the GDPR or an operator under the LGPD, following the documented instructions of the relevant customer controller.

If a specific processing activity is governed by a separate data processing agreement, order form, or enterprise contract, that document will control to the extent of any conflict with this public-facing notice.

3. Categories of Personal Data We Collect

The information we collect depends on how you interact with ShortLane.

• Contact information you submit, such as your name, email address, company, and workflow context when joining the waitlist or contacting us.
• Account and workspace information needed to create and manage access to the product.
• Content and publishing metadata you upload or create in the service, such as videos, titles, captions, schedules, publication history, and connected platform details.
• Authentication, device, browser, log, and session information that helps us operate the service, detect abuse, and improve reliability.
• Analytics and interaction data generated when you use the website or product, such as page views, product events, and approximate technical context.

4. Purposes of Processing and Legal Bases

We process personal data only when we have a valid legal basis. Depending on the context, that basis may include consent, performance of a contract, compliance with legal obligations, legitimate interests, or the regular exercise of rights in judicial, administrative, or arbitral proceedings where applicable.

• We use contract necessity or pre-contractual steps to create accounts, authenticate users, manage workspaces, process uploads, schedule posts, and operate the core workflow.
• We use legitimate interests, and where required consent, to measure demand, understand product usage, detect fraud or misuse, secure the platform, and improve performance and usability.
• We use consent where required by law for optional communications or similar processing that depends on prior permission.
• We use legal-obligation grounds when we must retain or disclose data for tax, accounting, compliance, audit, law-enforcement, or dispute-related reasons.

5. Transparency About Collection and Use

We aim to tell you, in a clear and accessible way, what data we collect, why we collect it, how long we keep it, whether we share it, and how you can exercise your rights.

If we ask you for information that is not required to provide the service, we will try to make that distinction clear at the point of collection. If consent is the basis for a processing activity, you may withdraw that consent at any time, but that will not affect processing already carried out before withdrawal.

6. Analytics and Product Measurement

ShortLane uses client-side analytics and product telemetry to understand website and product usage. These tools may collect information such as page views, browser details, interaction events, approximate device context, and identifiers needed to understand product flows.

We use this information to evaluate demand, improve onboarding, prioritize features, measure product health, and investigate reliability or abuse issues. Depending on the jurisdiction and the specific processing activity, this processing may rely on consent or legitimate interests.

7. Sharing, Recipients, and Processors

We do not sell personal data.

We may share personal data with service providers and subprocessors that help us operate infrastructure, authentication, storage, analytics, customer communications, support, and third-party platform integrations, but only to the extent reasonably necessary for those services.

Where processing is carried out on our behalf, we expect processors and operators to act under appropriate contractual restrictions and security obligations.

8. International Data Transfers

Your personal data may be processed in countries other than your own, including where our cloud providers, subprocessors, or connected services operate.

When we transfer personal data internationally, we aim to use a lawful transfer mechanism appropriate to the context, which may include adequacy decisions, standard contractual clauses, contractual safeguards, or other mechanisms recognized by applicable law.

9. Retention

We retain personal data only for as long as necessary for the relevant purpose, unless a longer retention period is required or permitted by law.

Retention periods may vary depending on whether you are a waitlist subscriber, a prospect, an authenticated user, an active customer, or a former user, and whether the data must be preserved for compliance, dispute resolution, fraud prevention, security investigations, or backup recovery windows.

10. Your Rights Under GDPR and LGPD

Depending on your location and the applicable law, you may have the right to request confirmation of processing, access to your personal data, correction of inaccurate or incomplete data, anonymization, blocking, restriction, deletion, portability, information about sharing, objection to certain processing, and review of decisions based solely on automated processing where legally applicable.

You may also withdraw consent when consent is the legal basis for processing. Some rights are subject to legal exceptions and may be limited when retention or processing remains necessary for legal claims, security, fraud prevention, contractual performance, or compliance obligations.

• For GDPR-style requests, this may include rights of access, rectification, erasure, restriction, portability, and objection.
• For LGPD-style requests, this may include confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, revocation of consent, and review of automated decisions where applicable.

11. How to Exercise Your Rights

You may submit privacy or data-rights requests by emailing [email protected] or by using the contact channel made available on our website or inside the product. We may request information reasonably necessary to verify your identity and the scope of your request before acting on it.

If we are acting only as a processor or operator for a customer, we may need to direct your request to the relevant customer controller so the request can be handled by the party that determines the purpose and means of processing.

If you believe your request was not handled appropriately, you may also have the right to complain to the competent supervisory authority, including an EU/EEA data protection authority under the GDPR or the ANPD in Brazil under the LGPD.

12. Security Measures and Incident Response

We use reasonable administrative, technical, and organizational measures designed to protect personal data against unauthorized access, loss, misuse, destruction, or alteration.

No system is completely secure. If we become aware of a security incident that triggers notification duties under applicable law, we will act in accordance with those duties, including notifications to affected parties or authorities where required.

13. Children and Sensitive Data

ShortLane is intended for professional and business use and is not designed for children. We do not knowingly seek to collect personal data from children in a way that would require a different legal standard of consent.

We also do not intend to request special categories of personal data or sensitive personal data for ordinary use of the service. If that kind of data is submitted through the product, it should be limited to what is strictly necessary and supported by an appropriate legal basis.

14. Contact and Complaints

You can contact us regarding privacy, data protection, or rights requests at [email protected]. If we designate a specific privacy contact, DPO, or encarregado for a region or service, we may publish that contact in the product or in a supplemental notice.

If you are in Brazil and believe your LGPD rights were not adequately addressed, you may also seek recourse through the ANPD. If you are in the EU or EEA, you may have the right to lodge a complaint with your local data protection authority.

15. Changes to This Policy

We may update this Privacy Policy to reflect product changes, operational changes, legal requirements, or evolving guidance.

When we make material changes, we will revise the date on this page and, where appropriate, provide additional notice.