PRIVACY STATEMENT

We Say Less B.V. ("we", "us" or "our") is responsible for the processing of personal data as described in this privacy statement. We attach great importance to the protection of your privacy and act in accordance with the General Data Protection Regulation (GDPR).

This privacy statement applies to:

• Visitors to our website www.wesayless.io

• Users of our AI-driven content platform for marketers and content teams

Do you have questions? Please contact us at wobke@wesayless.io.

1. What personal data do we process?

1.1 Website visitors

When you visit our website, we automatically collect technical data such as your IP address, browser type and browsing behaviour. Some of this data is collected via cookies. For a complete overview, please refer to our cookie policy.

This data is technically necessary for the functioning of the website and is used for the analysis of website traffic.

1.2 Users of the AI-driven content platform

When you create an account and use our AI-driven content platform, we process:

• Account data: name, company name, profile photo, email address, username and password (encrypted)

• Entered content: texts, instructions and documents you enter into the platform

• Generated content: AI output created and stored via the platform

• Usage data: which features you use, how long and when

• Technical data: IP address, device type, browser type

1.3 Data via social media connections

When you connect a social media account to our content platform, we receive the following data from the respective platform:

• LinkedIn: name, profile photo, profile ID, access token, and (where applicable) engagement data from your posts such as views, likes and comments. We process this data in accordance with the LinkedIn API Terms of Use.

• Instagram and Facebook (Meta): name, profile ID, access token, and engagement data from your posts. We process this data in accordance with the Meta Platform Terms.

• YouTube: name, channel ID, access token, and video data. We process this data in accordance with the Google API Services User Data Policy, including the limited use requirements.

Data from connected social media accounts is used exclusively to:

• (a) publish posts on your behalf at your explicit instruction via the platform;

• (b) display engagement statistics from your own posts within the platform (such as views, likes and comments);

• (c) display your profile information within the platform for account recognition and personalisation.

Data from connected social media accounts is used solely for the performance of the service and is not shared with other parties, not resold and not used for third-party advertising purposes.

Personal data and content from connected LinkedIn, Meta and YouTube accounts are not used for training AI models — not by us and not by our sub-processors.

1.4 Contact form and email

When you contact us via email or a contact form, we process your name, email address and the content of your message.

Special categories of personal data: We do not process special categories of personal data such as health data, ethnic origin or political beliefs.

2. For what purposes do we use your data?

We only process personal data where there is a legal basis for doing so. Below we describe the legal basis we use for each purpose.

2.1 Performance of the agreement

To provide our content platform to you and manage your account:

• Creating and managing your account

• Providing the AI features

• Processing invoices and managing your subscription

• Providing customer support

• Sending administrative messages such as password resets and invoice confirmations

2.2 Legitimate interest

For the following purposes we rely on our legitimate business interest, where your privacy interest does not outweigh ours:

• Securing the platform and preventing fraud and abuse

• Analysing usage trends to improve the platform

• Informing existing customers about relevant updates and new features of the platform

• Measuring the effectiveness of our marketing activities via website analysis

2.3 Consent

For the following processing we ask for your prior consent:

• Placing non-functional cookies and trackers on the website (see article 6)

• Sending newsletters and marketing communications to non-customers

You may withdraw your consent at any time. This does not affect processing carried out prior to withdrawal.

2.4 Legal obligation

• Retaining invoice data for the statutory fiscal retention period of 7 years

• Providing data to competent authorities where legally required

3. How long do we retain your data?

We do not retain personal data for longer than necessary for the purpose for which it was collected. The specific retention periods per category are set out below.

• Account data (name, email): for as long as your account is active. After cancellation, your data will be deleted within 90 days.

• Entered content and AI output: for as long as your account is active. Upon deletion of the account, this data will be erased within 90 days.

• Social media tokens (LinkedIn, Meta, YouTube): only for as long as the connection is active. Upon disconnection or account deletion, tokens are deleted immediately.

• Invoice and accounting data: 7 years after the financial year, in accordance with the statutory fiscal retention obligation.

4. With whom do we share your data?

We only share your personal data with third parties where necessary for the performance of our service or where we are legally required to do so.

4.1 AI service providers

For the AI functionality of the content platform, we use the following providers. Your input (texts, files and instructions) is processed by these parties to generate the AI output:

• OpenAI — privacy policy

• Anthropic — privacy policy

• Google — privacy policy

• Mistral — privacy policy

4.2 Website analytics and marketing

For analysing website visits and measuring the effectiveness of our marketing activities, we use analytics tools from third parties. An up-to-date overview of these tools and the associated cookies is available in our cookie statement at wesayless.io/cookiepolicy.

4.3 Business operations

For our internal business operations, we use service providers for invoicing and accounting, email communication and website hosting. We share only the data that is strictly necessary for the relevant service.

4.4 Other situations

We may also share your data:

• With competent authorities where we are legally required to do so

• In the event of a merger, acquisition or sale of (part of) our company, whereby the new owner is bound by this privacy statement

We never sell your personal data to third parties.

5. Cookies and tracking technologies

We use cookies and similar technologies on our website and in the content platform. For a complete overview, please refer to our cookie statement.

We use the following categories of cookies:

• Functional cookies: necessary for the functioning of the website and the platform. No consent is required for these.

• Analytical cookies: to gain insight into website usage. We use anonymised data and request consent via our cookie banner.

• Marketing cookies: for measuring advertising campaigns. Only placed after your explicit consent.

You can adjust your cookie preferences at any time via the cookie banner on our website or by changing your browser settings.

6. Security of your data

We take appropriate technical and organisational measures to protect your personal data against loss, unauthorised access or unlawful processing. These include:

• Encrypted connections (HTTPS/SSL) for all data transfers

• Encrypted storage of passwords

• Strict access control: only authorised employees have access to personal data

• Data processing agreements with all external parties that process data on our behalf

Data breaches: In the event of a data breach that poses a risk to your rights and freedoms, we will report this to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours. If the breach is likely to have serious consequences for you personally, we will also notify you directly.

7. Your privacy rights

Under the GDPR, you have the following rights with regard to your personal data:

• Access: you may request which data we process about you.

• Rectification: you may request correction of inaccurate or incomplete data. Basic data can also be changed by yourself via your account settings.

• Erasure: you may request deletion of your personal data. We will comply unless we have a statutory retention obligation (e.g. invoice data).

• Restriction: you may request a temporary halt to the processing of your data.

• Data portability: you may request your data in a structured, commonly used and machine-readable format.

• Objection: you may object to processing based on legitimate interest, for example for marketing purposes.

• Withdrawal of consent: if we process your data on the basis of consent, you may withdraw this at any time. This does not have retroactive effect.

You can exercise your rights by sending an email to wobke@wesayless.io. We will respond to your request within four weeks. For complex requests, we may extend this period by two months, of which we will notify you in a timely manner.

If you believe that we are processing your personal data unlawfully, you have the right to lodge a complaint with the Autoriteit Persoonsgegevens (AP), Postbus 93374, 2509 AJ Den Haag.

9. Minors

Our content platform is intended exclusively for persons aged 18 and over. We do not knowingly collect personal data from minors. If we establish that we have collected data from a minor, we will delete it as soon as possible. Do you suspect this is the case? Please contact us at wobke@wesayless.io.

10. Automated decision-making

We do not make automated decisions about data subjects that have legal consequences or otherwise significantly affect them within the meaning of Article 22 GDPR. The AI features of the content platform generate suggestions and content to support the user, but all decisions remain with the user.

11. Changes to this privacy statement

We may amend this privacy statement, for example due to new features, new service providers or changes in laws and regulations. The most up-to-date version is always available on our website. In the case of material changes, we will actively inform you by email or a notification in the platform.

12. Contact

Do you have questions, comments or requests regarding this privacy statement or the processing of your personal data? Please contact us:

We Say Less B.V.

Waarderweg 50

2031 BP Haarlem, the Netherlands

Email: wobke@wesayless.io

Website: www.wesayless.io