Privacy policy

1. Scope

This policy applies when you visit Minilab, create an account, manage a collection, upload an image, use an AI feature, buy a plan, contact us, or exercise a privacy right. It does not govern a third-party website that you visit from Minilab.

2. Personal data we process

• Account data, such as your user ID, name, email address, profile image, authentication status, and account security events. Clerk handles the sign-in process.
• Collection data, such as collection names, realms, descriptions, miniature names, scale, acquisition date, notes, and display order.
• Image and AI data, such as uploaded miniature images, generated and edited images, cutout images, prompts, selected edit modes, model names, output names, and technical generation records.
• Billing data, such as plan, subscription state, credit balance, credit transactions, billing period, Stripe customer and subscription IDs, invoices, tax status, and payment status. Stripe receives payment card and billing address data. Minilab does not store full card details.
• Device and use data, such as page URL, route, referrer, approximate region, device type, operating system, browser, timestamps, IP address in security logs, request details, and error information.
• Support and legal data, such as messages, request details, proof of identity when needed, complaint records, and communication choices.

3. Where the data comes from

We receive data from you, your device, your use of the service, and our service providers. Clerk provides account and session information. Stripe provides billing and payment status. AI providers return output and technical response information. We can also receive information from a person who contacts us about content or an account.

4. Why we process data

Our legitimate interests are to provide a secure, useful, and reliable service, understand aggregate use, protect users and our rights, and prevent misuse. You can object to processing based on legitimate interests. We will assess your request under applicable law.

5. AI processing

When you request a repaint or edit, Minilab sends the selected image and the generation prompt to Vercel AI Gateway and the selected AI model provider. The current image model is Google Gemini. Minilab can send an output image and prompt context to OpenAI to create a short output name. When you request background removal, Minilab sends the selected image to fal.ai. These providers return generated content and technical response data.

Do not use Minilab to process sensitive personal data, government IDs, medical records, financial account data, confidential business data, or images of a person who did not agree to this processing. Minilab does not use AI output to make decisions that produce legal or similarly significant effects about you.

6. Service providers and disclosures

We disclose data only as needed for these purposes:

• Clerk for identity, authentication, and session security.
• Convex for application functions, databases, and image storage.
• Stripe for checkout, payments, tax, invoices, and billing support.
• Vercel for cookie-free analytics and AI routing.
• Google for AI image generation.
• OpenAI for AI-generated look names.
• fal.ai for background removal.
• Professional advisers, insurers, auditors, courts, regulators, and public authorities when reasonably necessary or legally required.
• A buyer, investor, or successor during a proposed or completed business transaction, subject to suitable confidentiality and legal safeguards.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising. We do not use advertising cookies.

7. International transfers

Our providers can process data in countries outside your country and outside the EEA or UK. Where transfer law requires it, we use an adequacy decision, approved standard contractual clauses, or another lawful safeguard. You can contact the privacy address in the legal notice for information about the safeguard that applies to a transfer.

8. Retention

We keep account, collection, and image data while your account is active and as needed to provide the service. When you delete a miniature, look, or collection, Minilab removes unreferenced images from active storage. Provider backups can retain limited copies until their scheduled expiration.

We keep billing, tax, refund, and transaction records for the period required by accounting, tax, fraud prevention, and legal claim rules. Security logs and support records are kept only as long as needed for their purpose. We can keep a limited record of a deletion or opt-out request so that we can honor it. We delete or de-identify data when the applicable retention period ends.

9. Your choices and rights

Depending on your location, you can ask us to access, correct, delete, restrict, or provide a portable copy of your personal data. You can object to some processing and withdraw consent at any time. Withdrawal does not affect processing that was lawful before withdrawal. You can also appeal a privacy request decision where local law gives that right.

You can edit or delete much of your collection content in the service. For an account-level request, use the privacy contact in the legal notice. We can ask for information needed to verify your identity and authority. An authorized agent can make a request where the law permits it.

You can complain to the data protection authority where you live, where you work, or where an alleged breach happened. If the operator is in Norway, the authority is the Norwegian Data Protection Authority.

10. Cookies and analytics

Clerk uses cookies that are necessary to create and protect a session. Vercel Web Analytics provides aggregate measurements without third-party cookies. See the cookie policy for the current list and controls.

11. Security

We use technical and organizational measures designed to protect personal data. These include authentication, access controls, encrypted network transport, provider security controls, and limits on public access to stored content. No online service can guarantee complete security. Tell us promptly if you think your account or data is at risk.

12. Children

Minilab is for adults and is not directed to children under 18. Do not create an account or send us personal data if you are under 18. A parent or guardian who believes that a child gave us personal data can contact the privacy address in the legal notice.

13. Changes to this policy

We can update this policy when the service, providers, or law changes. We will post the new policy and update its date. We will give additional notice when a change materially affects your privacy rights and the law requires that notice.

14. Contact

Use the privacy contact in the legal notice for privacy questions or requests.