Log inBook a demoCheck your visibility for free

Privacy Policy

Welcome to Third Law ApS (“Third”, “we”, “us” or “our”). This Privacy Policy sets out how we, as data controller, process personal data in connection with your use of our website and related services (“Services”). The Policy is intended to provide clarity on the categories of personal data we process, the purposes for which such data is used, the legal bases applied, and the rights available to you under the General Data Protection Regulation (GDPR) and the Danish Data Protection Act.

1. Data Controller

The data controller is:

Third Law ApS
Østerfælled Torv 10
2100 København Ø, Denmark
CVR no.: DK45948471
Email: support@get3rd.com

2. Data We Process

We may process the following categories of personal data:

  • Contact information: name, email address, phone number, job title, company affiliation
  • Usage data: IP address, browser type, device information, pages visited, date and time of access
  • Communication data: correspondence and business inquiries
  • Marketing data: preferences and newsletter subscription details

We do not process special categories of personal data under Art. 9 GDPR.

3. Google user data

When you connect Google Analytics, Google Search Console or Google Ads to 3RD, you sign in with Google and choose what to share. We only read data. We never create, change or delete anything in your Google accounts.

  • Google Analytics (analytics.readonly): the list of GA4 properties you can pick from, plus sessions, engagement and conversions for the property you pick. We use it to show traffic from AI assistants (such as ChatGPT, Perplexity and Gemini) on your AI traffic page.
  • Google Search Console (webmasters.readonly): the list of sites you can access and search performance data (such as queries, clicks and impressions) for the sites you choose. We use it to show how your brand performs in Google Search alongside your AI visibility.
  • Google Ads (adwords): the email address of the Google account you sign in with, the Ads accounts it can open, and spend, clicks, conversions and keywords for those accounts. We use it to show your Ads spend summary, to suggest AI prompts based on your paid keywords, and, for agencies, to list client ad spend when preparing pitches. Google offers only this one scope for Ads, but we use it read-only.
  • Email address (userinfo.email): to identify the Google account that authorized the connection.

How we use it. We use Google user data only to provide and improve features you can see in 3RD for your own organization. We don't sell it, use it for advertising, or use it to train AI models, and we never share it between customers. Our use of data received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Who we share it with. Only the service providers that run 3RD for us, under data processing agreements: Vercel (application hosting), Supabase (database), Amazon Web Services (analytics database) and PostHog (product analytics), all hosted in the EU. To turn your Google Ads keywords into suggested AI prompts, we send those keywords to Anthropic (Claude) through the Vercel AI Gateway. Anthropic may process them in the United States and does not use them to train its models. We may also disclose data where the law requires it. We don't transfer it to anyone else.

Retention and deletion. We keep Google user data only while your account is connected. When you disconnect a Google service in 3RD, we revoke our access with Google and delete the stored access tokens and the Google data we've synced for that connection. Deleting a brand or organization deletes its connections too. AI prompts you created from Ads keywords stay in your account until you delete them. System logs are kept for up to 90 days, and database backups are kept for a limited period before being overwritten. You can also remove 3RD's access at any time from https://myaccount.google.com/permissions, or ask us to delete your data at support@get3rd.com.

4. How we protect your data

We have technical and organizational security measures in place to protect the confidentiality, integrity and availability of your data, including Google user data.

  • Encryption in transit. All traffic to 3RD, and between 3RD and Google's APIs, uses HTTPS (TLS).
  • Encryption at rest. Data is encrypted at rest. In addition, all Google OAuth tokens (Google Analytics, Search Console and Google Ads) are encrypted at the application level with AES-256-GCM before they are stored, and are only decrypted on our servers when needed to call Google.
  • Hosting in the EU. Your data is stored with our hosting and database providers in EU regions.
  • Access control. Each customer can only see their own organization's data. Access checks run on every request, and the database denies direct public access by default. Our staff access production systems only when needed, on a least-privilege basis.
  • Minimal access to Google. We request only the scopes we need and use them read-only. Each Google service is connected on its own, so connecting one never widens access to another.
  • Revocation. When you disconnect, we revoke the token with Google so it can no longer be used, then delete it.
  • Incidents. If a security incident affects your data, we will notify you without undue delay, and report personal data breaches to the authorities within 72 hours as GDPR requires.

More detail is on our Security page: https://www.get3rd.com/security

5. Purpose and Legal Basis

Personal data is processed only where a lawful basis applies under GDPR:

  • Contract (Art. 6(1)(b) GDPR): to deliver our Services and manage client relationships
  • Legitimate interests (Art. 6(1)(f) GDPR): to maintain and improve our Services, ensure security, and communicate with business contacts
  • Legal obligations (Art. 6(1)(c) GDPR): to comply with Danish and EU legislation (e.g. tax and accounting rules)
  • Consent (Art. 6(1)(a) GDPR): for newsletters, marketing, and the use of analytics cookies

6. Cookies

We use cookies and similar technologies. Necessary cookies make the website work and are always on. All other cookies are only set with your consent, which you give, change or withdraw in our cookie banner.

Necessary: Cookiebot remembers your cookie choice (CookieConsent, up to 1 year). Our contact form is provided by Pipedrive and uses Cloudflare bot protection cookies (cf_clearance, up to 1 year, and __cf_bm, 30 minutes).

Statistics, with your consent: Google Analytics (Google Ireland Limited), PostHog and Piwik PRO help us understand how the website is used. Google Analytics cookies (_ga, _ga_*) last up to 400 days.

Marketing, with your consent: Google Ads, Meta, LinkedIn, OpenAI Ads, Leadfeeder and Dreamdata measure our campaigns and recognize which companies visit. Their cookies (for example _gcl_au, _fbp, bcookie, __obref, _lfa and dd_anonymous_id) last between 1 day and 1 year.

Some of these providers may transfer data to the United States under the EU–US Data Privacy Framework or Standard Contractual Clauses.

You may withdraw consent at any time via our cookie banner or browser settings.

7. Newsletter Subscription

If you subscribe to our newsletter, we process your name and email address to send updates about Third and our Services.

Legal basis: your consent (Art. 6(1)(a) GDPR)

You may withdraw consent at any time using the unsubscribe link in the email or by contacting us.

8. Sharing of Data

We may share personal data with:

  • Service providers who process data on our behalf under data processing agreements
  • Public authorities where required by law
  • Business partners where necessary to provide Services

We do not sell personal data.

9. Transfers Outside the EU/EEA

If personal data is transferred outside the EU/EEA, it will be safeguarded by Standard Contractual Clauses or other mechanisms ensuring compliance with GDPR.

10. Retention

Personal data is retained only as long as necessary for the purposes described in this Policy or as required by law. Thereafter, it will be deleted or anonymized.

11. Your Rights

Under GDPR, you have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Request erasure of data
  • Restrict or object to processing
  • Data portability
  • Withdraw consent at any time

You may exercise these rights by contacting us (see Section 12). You also have the right to file a complaint with the Danish Data Protection Agency (Datatilsynet).

12. Contact

For questions about this Policy or to exercise your rights, please contact:

Third Law ApS
Østerfælled Torv 10
2100 København Ø, Denmark
CVR no.: DK45948471
Email: support@get3rd.com