Privacy Policy

Last updated: 29 October 2026

Third Law ApS ("3RD", "we", "us" or "our") respects your privacy and is committed to protecting personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and other applicable data protection legislation.

This Privacy Policy describes how we collect, use, disclose and protect personal data in connection with our SaaS platform and related services (the "Services").

1. Data Controller

The data controller is:

Third Law ApS (3RD)

Pilestræde 52A

DK-1112 Copenhagen K

Denmark

CVR: DK45948471

Email: gethelp@get3rd.com

2. What Personal Data Do We Collect?

We collect and process the following categories of personal data:

2.1 Account Information

Name, email address, phone number
Company information (company name, business registration number, address)
Job title and role in the organization
Login credentials (encrypted password)

2.2 Payment Information

Billing information (name, address, business registration number)
Payment data is processed by our payment provider Stripe as an independent data controller

2.3 Usage Data

Log data (IP address, browser type, device information)
Interaction data (features used, clicks, navigation)
Performance data (response times, error reports)
Session data (login times, duration)

2.4 Customer Content

Prompts, queries and instructions, including questions asked through the 3RD Slack app
Configurations, brands, markets and settings
Feeds, data and other input to the Services
Output generated through the Services

2.5 Communications

Support requests and correspondence
Feedback, suggestions and reviews
Marketing communications (if you have given consent)

3. How Do We Collect Personal Data?

We collect personal data through:

Directly from you: When you create an account, fill out forms, contact support or use the Services
Automatically: Through cookies, log files and similar technologies when you access the Services
From third parties: From payment providers, authentication services (SSO) or other integrated services

4. Purposes and Legal Basis for Processing

We process personal data for the following purposes:

4.1 Provision of Services

Purpose: Operation, maintenance and delivery of the Services
Legal basis: Performance of contract (GDPR Art. 6(1)(b))

4.2 Payment Processing

Purpose: Billing, payment processing and accounting
Legal basis: Performance of contract (GDPR Art. 6(1)(b))

4.3 Support and Communication

Purpose: Responding to inquiries, providing technical support and customer service
Legal basis: Performance of contract (GDPR Art. 6(1)(b)) and legitimate interest (GDPR Art. 6(1)(f))

4.4 Product Development and Improvement

Purpose: Analysis of usage data, debugging, optimization and development of new features
Legal basis: Legitimate interest (GDPR Art. 6(1)(f))

4.5 Security and Abuse Prevention

Purpose: Security monitoring, prevention of abuse, fraud detection
Legal basis: Legitimate interest (GDPR Art. 6(1)(f)) and legal obligation (GDPR Art. 6(1)(c))

4.6 Marketing

Purpose: Sending newsletters, product updates and marketing materials
Legal basis: Consent (GDPR Art. 6(1)(a)) – can be withdrawn at any time

4.7 Legal Compliance

Purpose: Compliance with legal requirements, accounting rules and government requests
Legal basis: Legal obligation (GDPR Art. 6(1)(c))

5. Disclosure of Personal Data

We only disclose personal data in the following situations:

5.1 Sub-processors

We use reliable third-party providers to deliver the Services:

Cloud hosting: Vercel (application hosting), Supabase (database) and Amazon Web Services (analytics database), all in EU regions
AI/LLM providers: OpenAI, Anthropic, Google (process Customer Content to generate Output)
Payment processing: Stripe (independent data controller)
Product analytics: PostHog (EU)
Analytics and monitoring: Tools for system monitoring and debugging
Support tools: Customer support and helpdesk systems
Integrations: Pipedream (stores HubSpot connection credentials and relays our requests to HubSpot, only for customers who connect HubSpot)

An updated list of sub-processors is available at:

https://trust.get3rd.com/subprocessors

5.2 Google integrations (Google Analytics, Search Console and Google Ads) and Google OAuth

If you choose to connect a Google account to a brand in 3RD, you authorize 3RD through Google's OAuth consent flow to read data from the Google services you choose. The Google account and its Analytics properties, Search Console sites and Google Ads accounts remain owned and controlled by you or your organization; 3RD does not claim ownership of them.

We request read-only access only:

Google Analytics (`analytics.readonly`): to list the Analytics properties you can access and retrieve reporting data for the property you select, such as sessions, traffic sources and landing pages, including traffic from AI assistants
Google Search Console (`webmasters.readonly`): to list the sites you can access and retrieve search performance data for the sites you choose
Google Ads (`adwords`): to list the Google Ads accounts you can access and retrieve campaign reporting (spend, clicks, impressions and conversions). We never create, change or delete campaigns, ads, budgets or account settings
Email address (`userinfo.email`): to identify the Google account that authorized the connection

We use this data only to provide and improve the features you see in 3RD, such as traffic insights and comparing paid spend with AI visibility. We do not sell it, use it to serve advertising, use it to train generalized AI or machine-learning models, or make it available to other 3RD customers. People at 3RD can read it only with your consent, for security purposes, to comply with applicable law, or as part of our internal operations under confidentiality obligations.

How we protect Google user data and OAuth tokens is described in section 9. We keep Google user data only while the connection is active. When you disconnect a Google service in 3RD, we revoke our access with Google and delete the stored tokens and the Google data we've synced for that connection. Deleting a brand or organization deletes its connections too. You can also remove 3RD's access at any time at https://myaccount.google.com/permissions. AI prompts you created from Ads keywords stay in your account until you delete them. Anything else you choose to save in 3RD from these integrations, such as search queries added as prompts, remains part of your Customer Content (see section 7).

Google Ads keywords are sent to Anthropic (Claude) via the Vercel AI Gateway to suggest prompts. Anthropic may process them in the United States and does not use them to train its models.

3RD's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google processes the requested data in accordance with Google's privacy policy and terms. 3RD does not knowingly request or require special-category personal data through these integrations.

5.3 Slack integration

If your organization installs the 3RD app in a Slack workspace, users can ask 3RD questions directly in Slack.

What we receive: We only receive the questions that Slack users send to the 3RD app, together with the identifiers needed to deliver the answer back to the right place (Slack user ID, workspace ID and channel or conversation ID). When you mention 3RD in a thread, 3RD reads the earlier messages in that thread (up to 30) as context for its answer. In direct messages it reads the last 10 messages. 3RD does not read other channels, messages or files.

How we use it: Questions are used only to generate and return an answer inside Slack. To generate the answer, the question is sent to our AI/LLM providers (OpenAI, Anthropic, Google) as described in section 5.1. This may involve transfers outside the EU/EEA as described in section 6.

Retention: Questions received through Slack and the answers generated are treated as Customer Content and are retained during the subscription period + 30 days after termination (see section 7). You can remove the 3RD app from your Slack workspace at any time; after removal, 3RD no longer receives data from Slack. You can request earlier deletion by contacting gethelp@get3rd.com.

5.4 Legal Requirements

We may disclose information if required by law, court order or government request.

5.5 Business Transfers

In the event of a merger, acquisition or sale of assets, personal data may be transferred as part of the transaction.

5.6 Consent

We may disclose information with your explicit consent.

6. International Transfers

Personal data may be transferred to and processed in countries outside the EU/EEA, including the USA, when we use third-party LLMs.

We ensure appropriate safeguards through:

EU Commission Standard Contractual Clauses (SCC)
Adequacy decisions
Other GDPR-approved transfer mechanisms

7. Retention of Personal Data

We retain personal data only as long as necessary:

Account information: Retained while your account is active
Customer Content: Retained during subscription period + 30 days after termination
Slack questions and answers: Retained as Customer Content (subscription period + 30 days after termination)
Billing information: 5 years after transaction date (accounting law)
Support requests: 2 years after closure
Marketing data: Until consent is withdrawn or data is outdated
System logs: Up to 90 days
Database backups: Kept for a limited period before being overwritten

After expiration of retention periods, personal data is deleted or anonymized.

8. Your Rights

Under GDPR, you have the following rights:

8.1 Right of Access (Art. 15)

You can request a copy of the personal data we process about you.

8.2 Right to Rectification (Art. 16)

You can request correction of inaccurate or incomplete information.

8.3 Right to Erasure (Art. 17)

You can request deletion of your personal data (the "right to be forgotten").

8.4 Right to Restriction (Art. 18)

You can request restriction of processing in certain situations.

8.5 Right to Data Portability (Art. 20)

You can request to receive your data in a structured, machine-readable format.

8.6 Right to Object (Art. 21)

You can object to processing based on legitimate interest.

8.7 Right to Withdraw Consent

You can withdraw consent at any time for marketing communications.

8.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the Danish Data Protection Agency:

Datatilsynet

Carl Jacobsens Vej 35

2500 Valby

Denmark

Email: dt@datatilsynet.dk

To exercise your rights, contact us at:

gethelp@get3rd.com

9. How we protect your data

We have technical and organizational security measures in place to protect the confidentiality, integrity and availability of your data, including Google user data.

Encryption in transit. All traffic to 3RD, and between 3RD and Google's APIs, uses HTTPS (TLS).
Encryption at rest. Data is encrypted at rest. In addition, all Google OAuth tokens (Google Analytics, Search Console and Google Ads) are encrypted at the application level with AES-256-GCM before they are stored, and are only decrypted on our servers when needed to call Google.
Hosting in the EU. Your data is stored with our hosting and database providers in EU regions.
Access control. Each customer can only see their own organization's data. Access checks run on every request, and the database denies direct public access by default. Our staff access production systems only when needed, on a least-privilege basis.
Minimal access to Google. We request only the scopes we need and use them read-only. Each Google service is connected on its own, so connecting one never widens access to another.
Revocation. When you disconnect, we revoke the token with Google so it can no longer be used, then delete it.
Incidents. If a security incident affects your data, we will notify you without undue delay, and report personal data breaches to the authorities within 72 hours as GDPR requires.

More detail is on our Security page: https://www.get3rd.com/security

10. Cookies and Tracking Technologies

We use cookies and similar technologies for:

Necessary cookies: For login, session management and basic functionality
Functional cookies: To remember preferences and settings
Analytical cookies: To analyze usage and improve the Services
Marketing cookies: For targeted marketing (only with consent)

You can manage cookies through your browser settings. Note that disabling certain cookies may affect the functionality of the Services.

Read more in our Cookie Policy: https://trust.get3rd.com/cookies

11. Children's Privacy

The Services are not directed at persons under 18 years of age. We do not knowingly collect personal data from children. If you are under 18, you must not use the Services or provide us with personal data.

12. Changes to Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email or through the Services at least 30 days before taking effect.

The latest version is always available at:

https://trust.get3rd.com/en/privacy

By continuing to use the Services after changes take effect, you accept the updated Privacy Policy.

13. Contact Us

If you have questions about this Privacy Policy or our processing of personal data, please contact us:

Third Law ApS (3RD)

Pilestræde 52A

DK-1112 Copenhagen K

Denmark

CVR: DK45948471

Email: gethelp@get3rd.com

*This Privacy Policy is part of 3RD's legal framework. For additional information, see:*

Terms and Conditions: https://trust.get3rd.com/terms
Data Processing Agreement: https://trust.get3rd.com/dpa
AI Policy: https://trust.get3rd.com/ai