Privacy Policy
Effective date: 16 October 2026
Version: 2.2
This Privacy Policy explains how CyberLab.Team OÜ ("CyberLab.team", "we", "us") processes personal data when you visit cyberlab.team (the "Website"), use our client portals on *.cyberlab.team (the "Client Cabinet"), use our services, or contact us. It also covers the application CyberLab.team that asks for access to Google services. It is drawn up in English, with translations into Ukrainian, Polish and Russian; the language rules of our Terms of Service apply (for business clients the English version prevails; for consumers the language version in which the contract was concluded applies).
1. Who we are and how to contact us
CyberLab.Team OÜ, registry code 14647320, VAT EE102131851, Sepapaja tn 6, Tallinn 15551, Estonia.
For all privacy questions and requests (access, deletion, objections, complaints): info@cyberlab.team.
Our role. We are the controller for data about visitors of the Website, people who contact us, our clients and their representatives, and users of the Client Cabinet. Where we process personal data contained in our clients' own data on their instructions (for example personal data that appears in their Google Business Profile, reviews or advertising accounts, and chat messages and materials in their Client Cabinet workspace), we act as a processor under our Data Processing Agreement (DPA), and the client is the controller. Google acts as an independent controller for the data in Google Business Profile and in your Google accounts under Google's own terms.
2. Whose data we process and why
| Who | What data | Why | Legal basis (GDPR) | How long |
|---|---|---|---|---|
| Website visitors | IP address and technical data needed to deliver the Website and protect it from bots (Cloudflare, including Cloudflare Turnstile on forms) | Delivering and securing the Website | Legitimate interest (Art. 6(1)(f)) | Not stored by us; processed by Cloudflare for security |
| Website visitors who consent | Google Analytics identifiers and usage data and, if you also consent to advertising, Google's advertising features (Google signals, audiences) | Measuring the Website and, with that consent, our own advertising | Consent (Art. 6(1)(a)), given for Analytics and Advertising together or separately; see the Cookie Policy | Consent choice: 365 days; Google Analytics data: per our Google Analytics settings |
| Website visitors | Cookieless visit statistics (Cloudflare Web Analytics) | Basic statistics | Legitimate interest | Aggregated |
| People who contact us | Name, email, phone, company, message, and anything you send in the form or by email, chat or messenger | Replying and preparing an offer | Steps before a contract / legitimate interest | 6 months after the enquiry is closed, unless a contract follows |
| Clients and their representatives | Name, email, phone, company, role, contract and order data, invoices, payment status, correspondence | Providing our services, invoicing, support | Contract (Art. 6(1)(b)); legal obligation for accounting (Art. 6(1)(c)) | Contract data: during the contract and the limitation period; accounting records: 7 years |
| Client Cabinet users (including team members invited by a client) | Name, email, sign-in data, security data (two-factor authentication), activity in the Client Cabinet, approvals and consents you give, logs of access by our staff | Running the Client Cabinet, security, quality control, proving approvals and consents | Contract; legitimate interest (security, quality control); legal obligation. Chat messages and materials in a client's workspace are processed for that client as processor under the DPA | Chat messages: 30 days; other data: during the contract, then see Section 8 |
| People in our clients' Google data (for example reviewers) | Content received from Google (reviews, ratings, profile data) | Providing services to our client | As processor for the client | No longer than 30 days (Section 3.6) |
We do not collect identity documents for Google advertiser verification; you provide them to Google directly. Card numbers are entered only on Stripe's pages; we never receive them. For bank transfers we process your bank details for accounting. A client who invites team members to the Client Cabinet must inform them about this Privacy Policy.
Sensitive data. We do not ask for special categories of personal data (for example health data). If such data appears in reviews, messages or materials we handle for you, we use it only as far as needed to provide the service and do not use it for any other purpose.
Customer data of our clients. We currently do not process our clients' customer lists for Google Ads audiences (Customer Match) or leads from Google Ads lead forms. If we offer such services in the future, we will update this Policy and the DPA before starting.
3. Data from Google services
3.1. Limited Use. CyberLab.team's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3.2. What we request. For "Sign in with Google" we request only openid, email and profile. To connect your locations we ask you, once, to sign in to Google and grant https://www.googleapis.com/auth/business.manage; this is used to invite CyberLab.team as a manager of the locations you select. We do not keep your Google sign-in tokens after the connection; afterwards we work in your Business Profile through our own agency access as your manager. We do not ask you for access to Google Ads through your Google sign-in: we manage Google Ads through our manager account (MCC) after you accept our link request in Google Ads.
3.3. What we use it for. We read and update your Business Profile on your instructions: profile information, posts and photos, reviews and replies, and performance figures for reports; we use data from your Google Ads account to manage your campaigns and report on them. We use this data only to provide the features you see in the Client Cabinet and the services you ordered.
3.4. What we never do. We do not sell Google user data, do not transfer it to advertising platforms, data brokers or information resellers, do not use it for advertising (including retargeting or personalised advertising) other than managing your own Google Ads campaigns on your instructions, for credit or lending decisions, or to train AI models. We do not combine one client's Google data with another client's data and never show it to another client.
3.5. Who can see it. Only people who need it to provide your service: your assigned manager and, for quality control, supervision and substitution of managers, a senior manager and the head of CyberLab.team. You confirm this access when you connect your locations; under the GDPR it is based on the performance of our contract and our legitimate interest in quality control (Section 4), not on consent. Otherwise people see Google data only when you ask us to, for security purposes (for example investigating abuse), or where the law requires it.
3.6. How long. Content received from Google (including Business Profile performance figures, review data, profile name, address and category, and identifiers and links of posts and photos) is kept no longer than 30 days and is not aggregated. While a location is connected, the copy is refreshed from Google; after you disconnect a location, the copy is deleted within 30 days. The address of a location shown in your contract and invoices is part of our accounting records (Section 8).
3.7. Changes. If we want to use Google data in a new way, we will do so only where Google's policies and the law permit it, and only after informing you and obtaining any permission required. Your consent does not allow us to keep Google data longer than Google's policies allow.
4. People who can access your data in our team
Each client has an assigned manager. A senior manager and the head of CyberLab.team can read Client Cabinet chats and see the work done for clients for quality control, supervision and to replace an absent manager. Every such access to a chat is logged. This is necessary to provide our services reliably (contract and legitimate interest). You can object under Art. 21 GDPR; we will assess your objection individually.
5. Artificial intelligence
We do not currently send your content or data received from Google to external AI providers. If we start doing so (for example to prepare draft replies to reviews), we will use only providers listed on our subprocessors page under terms that prohibit them from storing the data or using it for training, we will notify you at least 30 days in advance, and every AI draft will be reviewed and approved by a person before publication. We do not make decisions about you based solely on automated processing within the meaning of Article 22 GDPR; the automatic pause of an unpaid service is a contractual measure under Section 5 of the Terms of Service, based on the amount due, the due date and the recorded payment status. If you think a payment status is wrong or want to contest an automatic pause, write to info@cyberlab.team: you can obtain a review by a person who can correct the status and resume the service, and you can explain your point of view (for example by sending proof of payment).
6. Recipients
We share personal data only with service providers that help us provide our services (hosting, security, email, payments, notifications, backups), with Google where you use Google services through us, with our accountants and legal advisers, and with authorities where the law requires it. We do not use a CRM; our business email runs on Google Workspace. The current list of recipients — with their role, location and purpose — is published at cyberlab.team/subprocessors. We notify clients about a new subprocessor at least 30 days in advance.
7. Transfers outside the EEA
Our servers and databases are in the European Union. Some providers (for example Resend, our email delivery provider, in the USA, and Google or Stripe for some processing) may process data outside the EEA. Such transfers are protected by the EU-US Data Privacy Framework or by the European Commission's Standard Contractual Clauses, as listed on the subprocessors page.
8. How long we keep data
| Data | Period |
|---|---|
| Content received from Google (Section 3.6), including our log of changes made in your profile | No longer than 30 days |
| Client Cabinet chat messages | 30 days |
| Records of emails we send (delivery log) | 90 days |
| Sign-in events of the Client Cabinet (security log) | 10 days |
| Photos and other materials you upload for publication | Deleted automatically 20 full days after their final use (publication or final rejection), unless they are subject to a hold; otherwise together with your other Client Cabinet data |
| Your Client Cabinet data after you leave | Leaving means: 30 days after the end of your last contract without a new one, or closing the Client Cabinet. Your data can be exported during these 30 days and is then deleted; our records of advertising work (plans, operation log, account link and alerts — not data received from Google, which is kept no longer than 30 days in any case) are deleted 30 days later |
| Backups | Overwritten within 35 days; deleted data disappears from backups at the latest then. Content received from Google is not kept in these backups, so the 30-day limit in Section 3.6 is never extended; after a restore it is fetched from Google again |
| Contracts, invoices, payments and the location address in them | 7 years from the end of the financial year of the transaction (Estonian Accounting Act § 12) |
| Records of acceptance of our documents, approvals and correspondence with clients | During the contract and the limitation period for claims |
| Enquiries from the Website forms and by email that do not lead to a contract | 6 months after the enquiry is closed |
| Records of data protection requests (for example access or erasure requests) | 3 years after the request is closed |
| Logs of access by our staff (for example reading of Client Cabinet chats) | 3 years |
| Technical activity and security logs of our systems | 12 months |
| Data subject to a legal hold (for example a dispute or an authority's request) | Until the hold ends (each hold has a recorded reason and scope and is reviewed regularly), then deleted within 30 days |
Some of the automatic deletions listed above are being completed; until each runs automatically, we carry it out manually within the same period.
9. Your rights
You have the right to access your data, to have it corrected, deleted or restricted, to receive it in a portable format, to object to processing based on legitimate interests, and to withdraw consent at any time (without affecting earlier processing). Owners and administrators of a Client Cabinet can export its data in the Client Cabinet; data we keep for your account outside the Client Cabinet (for example advertising plans and limits, alerts and account links) is not in that export and we send it to you on request. For everything else, including deletion, write to info@cyberlab.team; we also handle requests that reach us through our other official contact channels; we answer within one month (extendable by two months for complex requests, with notice). We may ask you to confirm your identity, but only as far as reasonably necessary. If we refuse a request or charge a fee because it is manifestly unfounded or excessive, we explain why and tell you how to complain or go to court. If your request concerns data we process for a client as processor, we will forward it to that client. You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or the authority in your country.
10. Security
We protect data with access control, two-factor authentication for our staff, encrypted connections, encrypted backups, logging of access to client chats, and separation of each client's data. We do not store Google passwords and do not keep clients' Google sign-in tokens. We notify you and the authorities about personal data breaches as required by law.
11. Cookies
The Website and the Client Cabinet use cookies and similar technologies as described in our Cookie Policy.
12. Children
Our services are for adults. We do not knowingly collect data of children under 16 as our users; if we learn that we have, we delete it, unless the law or a client's lawful instructions require otherwise (for example, content in a client's Google reviews).
13. Changes to this Policy
We will notify you by email and in the Client Cabinet at least 30 days before material changes take effect and, where required, ask for your consent before a change.