Privacy policy

Sophei in Chrome

The optional Sophei Chrome extension connects to your existing workspace. It processes your account and workspace identity, sign-in credentials issued to the extension, messages, replies and reviewed-action outcomes to provide the assistant, save your conversations and keep your workspace access secure. The extension stores its scoped sign-in and current conversation reference in Chrome so you can return after closing the setup tab or restarting the browser.

Page sharing is optional. When you choose Share tab, Sophei receives the selected site's address, bounded visible page text and supported control labels. That text may include personal information visible on the page. The extension does not read your browsing history, cookies, screenshots or the values already entered in form fields. It excludes hidden and editable text and blocks known password and payment screens. These protections are not a guarantee that every sensitive detail will be detected: share only content you are entitled to use.

Your messages and shared-page content are processed with relevant workspace knowledge by Sophei's services and the AI model providers described below to answer your request and prepare work for review. Content from shared pages can appear in saved conversations. Browser actions require your approval of the specific proposed step; sharing a page is not approval to act on it.

You can approve, reject or close work Sophei has prepared from the extension. We record your decision, the exact version you reviewed and the outcome, as we do in your workspace. Reviews can show customer content such as an email recipient, a social reply or an image, and only to members allowed to see it in your workspace. Before you approve work that sends, publishes, spends or changes your setup, we email a one-time code to your account email address. We do not store the code. We record only that you confirmed, and that confirmation expires after 15 minutes.

When the tab you share is a site Sophei recognises, such as Instagram, Meta Business Suite, Shopify, Klaviyo, Gmail or Canva, Sophei uses the site's address to offer relevant help. If your workspace turns on Instagram recognition, Sophei can match a username visible on the page you share to a conversation already in your workspace. It then shows that customer's profile summary only if they have opted in. It does not show their name or contact details in Chrome, and it never uses a username to combine customer records.

Stop sharing ends further page access. Pausing or ending a shared-page session clears its current page snapshot when the service processes that change. It does not erase content already included in saved conversations. Signing out removes the extension's saved sign-in from this browser; uninstalling does not delete your workspace or its conversations. Saved account and conversation data follow the retention policy below. To request access or deletion, contact privacy@locketailabs.com and identify your workspace and conversation; do not send passwords or access codes.

We use Chrome extension data to provide and secure the features you request. We do not sell this data or use it for advertising, and we do not use it to train foundation models. Support and privacy contacts are listed below.

Optional website analytics and homepage experiments

With your analytics consent, we assign your browser to a homepage experiment on your next homepage load. We record which version you see, example interactions, signup and demo-link clicks, and whether you create an account and complete your first payment within 14 days. A demo click is not a confirmed booking. We use this information to compare homepage effectiveness, not to change your price.

The locket_website_analytics preference cookie and, after consent, the locket_website_assignment cookie last up to 90 days. Assignment cookies contain an opaque identifier. A validated identifier may pass to our configured signup domain to connect your visit with your account. We keep your existing website or Shopify signup source separately. We do not record the text you type into examples as experiment analytics.

Use Cookie preferences in the website footer to decline or withdraw analytics at any time. Withdrawal stops tracking and removes the assignment and account link; aggregate counts already collected may remain. If the service is unavailable, a necessary temporary withdrawal cookie retains only the revocation identifier until deletion can be retried. Identifiable experiment records and account links are deleted within 90 days; only aggregate counts remain. This does not delete billing records we need to operate your account.

Who we are

Sophei is operated by Locket AI Labs, registered in Ireland under company number 805123 ("Locket AI Labs", "we", "us"). We build Sophei, an AI marketing intelligence platform for brand teams. When you use Sophei, we act as a data processor on your behalf for your customer data, and as a data controller for the account and usage data you provide to us directly.

Data we collect

We collect three broad categories of data, each with a clear purpose:

• Account data: name, work email, workspace, billing details. Used to run your account.
• Customer data: the customer, event and product data you connect via Klaviyo, Shopify, CSV or our APIs, and messages your customers send to your connected Instagram, Facebook Messenger or WhatsApp accounts. If you turn on Instagram recognition, this includes the Instagram username of people who message or comment on your account. Used to power Sophei's signals, recommendations and the replies you approve.
• Usage data: pages visited, features used, error logs. Used to improve the product and keep it secure.

How we use data

We do not sell customer data. We do not use customer data from your workspace to train foundation models or share it across workspaces.

• Operate and improve the platform, including generating recommendations and content
• Provide support and communicate with you about your account
• Comply with legal, tax, and security obligations
• Detect abuse, fraud, and misuse, including automated safety checks on generated content

AI and sub-processors

Sophei relies on trusted infrastructure and model providers. When customer data is sent to a sub-processor for inference, it is scoped to the task at hand and processed under strict data-use terms, including no-training-on-customer-data commitments where available.

• Model providers: Anthropic and OpenAI (inference only, no training on your data)
• Cloud & storage: AWS (US and EU regions)
• Payments, Paygentic / Stripe
• Product analytics: first-party, self-hosted where possible

Your rights

Depending on where you are, you may have the right to access, correct, delete, port, or restrict the processing of your data. Enterprise workspaces can trigger full data exports and deletions from the admin console. Individual customers on your list can be deleted through your workspace or by contacting us directly.

To request deletion of data Locket AI Labs received through Facebook, Messenger, Instagram or Threads, email privacy@locketailabs.com. Include the service, your account handle or Page name, and the brand or Sophei workspace involved, if known, so we can locate the data. We may need to verify that you control the account before processing the request. Do not send passwords, access tokens or authentication codes. If a customer withdraws consent through a connected channel, for example by replying STOP, we erase their stored message content and Instagram username for that workspace.

Data retention

We retain account and workspace data for as long as your account is active. Customer data is retained under your workspace policy, you can set retention windows in settings. On workspace deletion, data is purged within 30 days from primary systems and within 90 days from encrypted backups.

International transfers

Locket AI Labs is registered in Ireland. If you are in the EU or UK, we rely on Standard Contractual Clauses (and the UK Addendum) to transfer data. EU customers on Growth and Pro plans can pin data storage to our EU region.

Changes to this policy

We will notify workspace owners by email at least 14 days before any material change takes effect. Older versions of this policy are available on request.

Contact

Questions about privacy? Email privacy@locketailabs.com. For general support, email hello@locketailabs.com.