Privacy Policy
This policy explains how Protocol ("Protocol", "we", "us") collects, uses and protects personal information on our website at www.protocol-lab.co and in Protocol Lab, our partnership workspace at app.protocol-lab.co (together, the "Services"). Protocol is based in Montreal, Quebec, Canada.
1. Information we collect
On our website
Our website has no sign-up forms, no advertising trackers and no analytics cookies. Our hosting provider may automatically record basic technical data (such as IP address, browser type and the pages requested) to keep the site running and secure. If you email us, we receive your name, email address and whatever you choose to write.
In Protocol Lab
- Account information: name, email address and role of team members and invited users.
- Partner contact information: names, business email addresses, company names, job titles and notes about brands and partners we work with or contact. This comes from public sources, business introductions and lists we are entitled to use.
- Google user data: information from your Google account when you choose to connect Gmail (see section 2).
- Business records: deal, budget and transaction records entered by our team.
2. Google user data
When a team member connects their Google account to Protocol Lab, we ask for permission to:
- see the email address and basic profile of the connected account;
- send emails from that account, but only after the user reviews and confirms each email or sequence in Protocol Lab;
- read messages in email threads related to partner outreach, so replies appear in the Protocol Lab inbox and follow-ups stop when someone answers.
We use Google user data only to provide these features to the person who connected the account. We do not use it for advertising, we do not sell it, and we do not use it to build profiles for any other purpose. People do not read your Gmail data unless you ask us to (for example, for support), it is needed for security or to investigate abuse, or the law requires it.
Protocol Lab's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We do not use Google user data to develop, improve or train generalized artificial intelligence or machine learning models. If an AI provider processes any of this data to deliver a feature you asked for (such as drafting a reply), it is used only for that request.
You can disconnect Google at any time in Protocol Lab settings or at myaccount.google.com/permissions. When you disconnect, we delete the access tokens for that account.
3. How we use information
- To run the website and Protocol Lab, and keep them secure.
- To contact brands and partners about working with Protocol, and to reply to messages.
- To plan, deliver and report on events and brand activations.
- To keep business and accounting records.
- To meet legal obligations.
4. Who we share it with
We share personal information only with service providers that help us run the Services, and only as needed for that purpose:
- Railway: hosting and database for the website and Protocol Lab.
- Google: Gmail sending and inbox features you connect.
- Amazon Web Services: email delivery.
- AI providers (such as Anthropic and OpenAI): drafting and research features. They may not use this data to train their models.
Some of these providers store data outside Quebec and Canada, including in the United States. We also disclose information if the law requires it. We never sell personal information.
5. How long we keep it
We keep personal information only as long as we need it for the purposes above or as the law requires. Partner contacts who ask us to stop contacting them are marked so they are not emailed again. You can ask us to delete your information at any time.
6. Security
Access to Protocol Lab is limited to authorized users. Data is sent over encrypted connections (HTTPS) and stored with our hosting provider. No system is perfectly secure, but we take reasonable steps to protect your information and will notify you and the authorities of any serious incident as the law requires.
7. Your rights
Under Quebec and Canadian privacy law, you can ask to access, correct or delete your personal information, withdraw your consent, or ask how it is used. You can also ask us to stop sending you emails at any time; every outreach email can be answered with a request to stop. To make a request, email us at the address below. If you are not satisfied with our answer, you can contact the Commission d'accès à l'information du Québec.
8. Children
Our Services are not directed at children under 14, and we do not knowingly collect their information.
9. Changes
If we change this policy, we will post the new version here and update the date above.
10. Contact
Person in charge of the protection of personal information: Protocol, Montreal, Quebec, Canada. Email protocolevnts@gmail.com.