This Notice explains what happens to the personal data processed by the Social Cognitive platform (the Service), operated by Lait (the Provider).
1. Read the part that applies to you
The Service processes personal data belonging to two very different groups of people, and what applies to one does not apply to the other. That distinction is what organises this document:
| If you are... | Your part | Who decides about your data |
|---|---|---|
| Someone with an account on the Service | Part A (sections 2 to 8) | The Provider |
| Someone whose public information on a social network was collected through the Service | Part B (sections 9 to 13) | The customer who instructed that collection |
Sections 14 to 20 apply to both groups.
If you are here because your information turned up in an analysis and you have no account, Part B and section 15 are the ones you want.
Part A — If you have an account on the Service
2. Data controller
The processing described in Part A is controlled by Lait.
For anything concerning your personal data or this Notice, including exercising your rights: manager@socialcognitive.app.
3. What data we process and where it comes from
| Category | What it includes | Where it comes from |
|---|---|---|
| Identification and contact | Name, email address | You provide it when registering |
| Credentials | Password, always stored one-way hashed | You create it, or you sign in with Google |
| Google account | Profile identifier, name and email, if you choose that method | Google, when you authorise it |
| Billing | Plan, subscription status, consumption and customer identifier at the payment provider | Generated by the Service and the provider |
| Service usage | Assistant queries, instructed collections, declared purposes, language and theme preferences | Generated by your activity |
| Technical logs | Access timestamps, session data and errors | Generated by the Service |
| Compliance | Which version of the Terms you accepted, which version of this Notice you authorised, and when | Stamped by the Service when you do it |
We do not ask for special categories of data — health, ethnicity, biometrics, beliefs, sex life — to run your account, and you should not supply them.
4. What we use it for
- Creating and maintaining your account, authenticating you and keeping your session.
- Providing the Service: running the collections and analyses you instruct and showing you results.
- Billing, tracking plan consumption and handling payments.
- Contacting you about operational notices, security notices and changes to the legal documents.
- Running and improving the Service, diagnosing faults and protecting it from abuse.
- Evidencing compliance: keeping what you accepted, when, and under which version — which is what the law requires us to be able to demonstrate.
Operational and security notices are not marketing and cannot be switched off while you hold an active account; marketing communications, if any, can.
5. On what legal grounds
| Purpose | Colombia (Law 1581) | GDPR / UK GDPR |
|---|---|---|
| Providing the Service and billing | Authorisation and performance of the contract | Art. 6(1)(b), performance of a contract |
| Operational and security notices | Authorisation and performance of the contract | Art. 6(1)(b) and 6(1)(f) |
| Security, abuse prevention and diagnostics | Authorisation | Art. 6(1)(f), legitimate interests |
| Evidencing compliance | Legal duty | Art. 6(1)(c), legal obligation |
| Marketing communications | Authorisation, revocable | Art. 6(1)(a), revocable consent |
Law 1581 has no standalone legitimate-interest ground: the rule is prior, express and informed authorisation, with the closed list of exceptions in article 10. Where this table mentions legitimate interests, that is the GDPR.
6. Who we share it with
We do not sell personal data. It is shared only with those needed to run the Service:
| Type | What for | What they receive |
|---|---|---|
| Cloud hosting and infrastructure | Running the Service | What is needed to host and serve |
| Payment provider | Charging the subscription | Identification, contact and subscription data |
| Data collection provider | Running the collections you instruct | The collection parameters |
| AI model providers | Producing analyses, summaries and charts | The query content and the data to analyse |
| Google authentication | Signing in, if you choose it | What Google requires for the flow |
All of them act on instructions and under confidentiality and security obligations. We may also disclose information where a competent authority requires it, or in a corporate transaction, in which case the acquirer remains bound by this Notice until it publishes its own and notifies you.
7. How long we keep it
- Account data: for as long as the account exists. Closing it opens a grace period, after which the data is irreversibly purged.
- Billing: the period imposed by accounting and tax rules, even if you close the account.
- Record of acceptances: for as long as data collected under that version is processed, because it is the evidence the law requires us to keep.
- Technical logs: short periods, those appropriate to diagnostics and security.
8. International transfers
The Service relies on infrastructure and providers that may sit outside your country, so your data may be processed in other territories. Transfers are made under whatever mechanism the applicable law requires: standard contractual clauses, adequacy decisions or your express authorisation, as the case may be.
Part B — If your information was collected from a social network
9. Why this Notice reaches you even though you are not a customer
The Service lets its customers collect and analyse public information from social networks: posts, comments and profiles. If your information was collected that way, you may well never have heard of us. This part exists precisely for that.
Information being public does not stop it being personal data, nor does it leave you without rights. Under Law 1581 public-nature data has its own regime, but it remains personal data and you keep the rights in section 14.
10. Who decides and who executes
The allocation of roles here differs from Part A, and it is worth being clear about it:
- The customer who instructed the collection is the controller: they decide what is searched, for what purpose and on what legal ground, and they warrant it contractually.
- The Provider acts as processor: it executes the instruction, does not originate it, and does not decide what is collected or what for.
So a request about the substance of the processing — why it was collected, on what ground — belongs to the controlling customer. Even so, you are not left without a door: section 15 explains how to come to us directly and what we will do.
11. What information is collected
Depending on what the customer instructs, and always from content the social network displays publicly:
- Posts and comments, with their text, date and visible metrics.
- Author profile data the network exposes: display name, username, picture, description and follower counts.
- Media attached to those posts.
- Derived analyses: topics, sentiment, clusters and synthetic audiences built on aggregate patterns.
We do not access private messages or restricted content, we do not circumvent any technical protection measure, and we do not use anyone's credentials to enter accounts that are not ours.
12. What we do not do with your information
- We do not sell it.
- We do not use it to identify you outside the context in which it was published.
- We do not build a profile of you that is sold or reused across different customers.
- We do not deliberately collect information about minors, and if we find that we did, it is deleted.
13. Political and electoral use
Political opinion is sensitive data and processing it demands reinforced safeguards. In Colombia it is specifically governed by External Circular 002 of 2026 of the Superintendence of Industry and Commerce.
What protects you does not depend on what any customer declares, and always applies:
- Your political leaning is never inferred. The Service does not derive or store the political orientation of an identified person. It is a technical prohibition, with no exception and no setting that turns it off.
- Electoral analysis features are switched off, and are enabled only for customers whose agreement expressly permits it.
What does depend on the customer's declaration is the customer's own obligation: anyone carrying out political or electoral processing must declare it on their account, and doing so subjects them to the reinforced regime in the Terms. That declaration adds no protection for you — the ones above already apply — it defines what that customer may ask the Service for, and lets us warn them when warranted.
Applies to everyone
14. Your rights
Whichever group you belong to, you have the right to:
- Know what data about you is processed and obtain a copy.
- Update and rectify anything inaccurate, incomplete or misleading.
- Delete it, to the extent the applicable law allows.
- Object to the processing and, in Part B, to any further collection about you.
- Withdraw any authorisation you gave, without retroactive effect on what was already done lawfully.
- Port your data to another controller, where the applicable law recognises it.
- Not be subject to decisions based solely on automated processing producing legal or similarly significant effects, where the applicable law recognises it.
- Complain to the supervisory authority that covers you. In Colombia, the Superintendence of Industry and Commerce, after first raising a query or claim with the controller.
15. How to exercise them
Write to manager@socialcognitive.app stating which right you are exercising and giving us enough to locate your information. If yours is a Part B case, pointing at the profile or the content is enough: you do not need to know which customer instructed the collection.
What we do on receiving it:
- We acknowledge receipt.
- If the processing is controlled by a customer, we handle it anyway and inform them.
- We carry out the deletion across the whole platform: you are excluded from further collections and removed from stored results and from any derived audiences.
- We confirm the outcome to you.
Timescales: queries are answered within ten business days and claims within fifteen business days, extendable under Law 1581. Under the GDPR, one month extendable by two more. Exercising them is free.
16. AI-assisted analysis
The Service uses AI models to summarise, classify and visualise collected information, and to build synthetic audiences from aggregate patterns.
Two clarifications that matter: those outputs are estimates and can be wrong, so they must not be taken as statements of fact about any particular person; and the Service makes no automated decisions producing legal effects on you or similarly significantly affecting you.
17. Security
We maintain technical and organisational measures proportionate to the risk: encryption in transit, access control, isolation between customers and logging of collection and analysis operations. No measure removes risk entirely. In the event of a security breach affecting you, we will notify whoever is required within the timescales the applicable law sets.
18. Minors
The Service is not directed at minors and accounts must not be opened for them. Nor do we deliberately instruct the collection of their information. If we find a minor's data, we delete it.
19. Changes to this Notice
When this Notice changes substantively, a new version is published with its own identifier and effective date, and a fresh authorisation is requested from anyone holding an account. Previous versions are retained and remain readable for as long as data collected under them is processed, so that what was disclosed at any given moment can be checked.
A change does not apply retroactively to what was already processed under the previous version.
20. Contact
Controller: Lait — Colombia. Email for personal data matters: manager@socialcognitive.app. Supervisory authority in Colombia: Superintendence of Industry and Commerce.