Data Processing Addendum

Updated: 2 November 2026

This is a summary of how we handle personal data that you, as our customer, send through the VidLab API. For most data (your account, your billing), we are the controller and the Privacy Policy applies. For personal data inside the content you send (for example a photo of a person in a request), you are the controller and we are your processor. A signed copy of this addendum is available on request at support@vidlab.ai.

What we agree to

• Instructions. We process your content only to run your requests and provide the Service, and as you instruct us in the API. We tell you if an instruction breaks the law, as far as we know.
• Confidentiality. People who can access the data are bound to keep it confidential.
• Security. We keep the measures on the Security page in place.
• Sub-processors. You allow us to use the companies on the Sub-processors page. We bind them to data protection terms no weaker than these. We give notice of a new sub-processor before it starts, and you can object on reasonable grounds.
• Assistance. We help you answer data subject requests and meet your duties on security, breach notice and impact assessments, within reason.
• Breach. We tell you without undue delay after we learn that personal data in your content was breached.
• Transfers. Where personal data leaves the EEA, UK or Switzerland, we use standard contractual clauses or another lawful transfer tool.
• Deletion. On your request or when your account ends, we delete your content as set out in the Privacy Policy, unless the law requires us to keep it.
• Audits. We answer reasonable security questionnaires and, once a year, a reasonable audit request by email.

Your part

You make sure you have a lawful basis and the permissions to send the personal data in your content, and you do not send special categories of data or data about children unless you are allowed to and have told us.

Details of the processing