Privacy Policy
Updated: 2 November 2026
This policy explains what VidLab AI ("VidLab", "we", "us") collects when you use the VidLab website, dashboard and API (the "Service"), why, who sees it, how long we keep it, and what you can do about it. VidLab AI is the controller of your personal data. Privacy questions go to support@vidlab.ai.
What we collect
| What | Details | Why |
|---|---|---|
| Account | Name, email address, sign-in method, and the profile details a sign-in provider such as Google or Whop sends us | To run your account and sign you in |
| Contact channels | Any extra contact details you add, such as a chat handle | To reach you about your account when you ask us to |
| API keys | A hash of each key, its name, scopes, limits and last use. The full key is shown once and is never stored | To authenticate your requests |
| Requests | The model, settings, prompts and the links or files you send, and the results | To run your request and show it in your task logs |
| Uploads | Images, video and audio you upload for use in a request | To pass them to the model that runs your request |
| Logs | Task ids, status, price, time, error codes, IP address and browser details | To bill you, fix problems, prevent abuse and keep the Service secure |
| Payments | Amount, date, payment status, and a customer reference from our payment provider. We do not store card numbers | To take payments, issue refunds and keep tax records |
| Support | What you write to us and our replies | To help you |
| Usage analytics | Which pages and features are used, without prompts or file contents | To understand and improve the Service |
What we do not do
- We do not sell your personal data and we do not share it for advertising.
- We do not train models on your prompts, files or results.
- We do not use advertising or cross-site tracking cookies. See the Cookie Notice.
Google sign-in
If you sign in with Google, we receive only your name, email address and profile picture. We use them to create and sign you in to your account and for nothing else. VidLab's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can remove VidLab's access in your Google account settings.
How we use it and our legal bases
- To provide the Service you asked for, including running requests and billing them (contract).
- To keep the Service safe, prevent fraud and abuse, and fix errors (our legitimate interest).
- To measure and improve the Service (our legitimate interest).
- To send you account, billing and security messages (contract and legitimate interest). You can opt out of anything that is not required.
- To meet tax, accounting and other legal duties (legal obligation).
- Where we ask for your consent, you can withdraw it at any time.
Who receives it
- AI model providers. To run a request we send its inputs (prompt, settings and any files or links) to the company that runs the model. We send what is needed for the request, not your name or email. Each provider handles that data under its own terms.
- Service providers that process data for us: payments, email delivery, hosting and storage, error monitoring and analytics. They are listed on the Sub-processors page.
- Authorities and advisers where the law requires, to protect our rights or users, or in a sale or merger of the business.
How long we keep it
| What | How long |
|---|---|
| Account details | While your account is open, then deleted within 30 days of a deletion request, except what we must keep by law |
| Prompts and request settings | Kept with the task record while your account is open |
| Uploaded files | 7 days, then deleted. The link to an upload expires before the file does |
| Results | Deleted 30 days after they are created. Result links you receive are signed and work for 6 hours; fetch the job again for a fresh link |
| Task and access logs | Kept while your account is open |
| Billing and tax records | As long as tax and accounting law requires |
| Support messages | While needed to help you, then deleted or anonymised |
Security
We protect data with encryption in transit, private encrypted storage for files, hashed API keys, signed and expiring links, access limits for staff and rate limits. See Security. No system is perfectly secure, so we cannot promise absolute security.
International transfers
We and our providers may process data in the United States and other countries. Where the law requires it, we use safeguards such as standard contractual clauses.
Your rights
Depending on where you live (including under the GDPR, UK GDPR and the California Consumer Privacy Act), you may have the right to:
- access the personal data we hold about you and get a copy;
- correct it, or delete it;
- object to or restrict some uses, and withdraw consent;
- move your data to another service;
- not be treated worse for using these rights.
To use a right, write to support@vidlab.ai from the email on your account. We answer within one month, or sooner where the law says so. You can ask us to delete your account at any time. If you are in the EU or UK, you may also complain to your data protection authority. If you are in California, we do not sell or share your personal information as those terms are defined by California law.
Children
The Service is not for anyone under 18, and we do not knowingly collect data from children. If you think a child has given us data, tell us and we will delete it.
Changes
We may update this policy. We will change the date above and, for significant changes, tell you in the Service or by email.
Contact
VidLab AI. Email support@vidlab.ai.