Privacy policy

Updated 12 October 2026

This notice explains personal-data processing in PV LAB, including its website, sign-in, creative tools and customer support. It also applies to test accounts; test payments do not make account or uploaded content anonymous.

Who is responsible

Contact the address above for any privacy request.

Information we process and why

• Account information: your account identifier, email, profile information and sign-in/session information are used to authenticate you and provide your account.
• Creative content: prompts, uploaded photos and videos, references, saved moods, identity-training images, generated results and job information are processed to carry out the features you request and maintain your private gallery.
• Payments: purchase and subscription references, payment status, credit balances, transactions, refunds and disputes are used to deliver credits and manage billing. Stripe collects payment and billing details in its checkout; do not send card details to PV LAB support.
• Technical and support information: requests to our services may include IP address, browser information, timestamps and errors. We use necessary operational records to deliver the site, prevent abuse, investigate failed jobs and answer your messages.

Account, creative and purchase processing necessary to provide the service is based on Article 6(1)(b) GDPR. Required accounting and legal records are processed under Article 6(1)(c). Service security, abuse prevention and resolving claims rely on our legitimate interests under Article 6(1)(f). Where an optional activity requires consent, that consent must be requested separately and can be withdrawn without affecting earlier lawful processing.

Account details are needed for signed-in features; a prompt or uploaded file is needed only when your chosen tool requires it. You can browse public pages without uploading creative content. Do not upload confidential or sensitive personal information, or another person’s photos without the necessary rights and permission.

Service providers and recipients

We use GitHub Pages for the public website, Cloudflare for application requests, databases and private file storage, Clerk for authentication, and Stripe for payments. If you choose Google sign-in, Google also processes the sign-in under its own privacy notice.

Generation and identity-training tools send the inputs needed for your selected operation to the relevant provider. Current integrations include SpicyAPI for generation, Higgsfield for Soul identity training and generation, and fal for supported training workflows. Availability depends on the tool and account. These providers may use downstream model providers. A job can require sending prompts, photos, videos or temporary links allowing the provider to retrieve those files.

Provider-side processing and retention are separate from the copies in your Lab gallery. We do not promise that deleting a gallery item immediately removes all provider records, or that every provider offers zero retention or a no-training commitment. Contact us before sending content for which you require specific processing restrictions.

Provider information: GitHub, Cloudflare, Clerk, Stripe, Google, SpicyAPI, Higgsfield and fal.

Information may also be disclosed where necessary to comply with law, address a dispute or protect service security. Private uploads are not made public merely by saving them in your account.

Processing outside Europe

Some providers operate internationally, including in the United States. Your selected workflow may therefore involve processing outside the European Economic Area. Applicable transfer arrangements depend on the provider and service, including adequacy decisions or contractual safeguards where applicable. Contact us for information about the recipients and safeguards relevant to your workflow. This notice does not represent that all data remains in Germany or the EU.

Optional Meta analytics and advertising measurement

If you choose Allow analytics, PV LAB loads the Meta Pixel (dataset ID 1087722353874433) to measure page visits, new registrations and checkout starts. When an opted-in customer completes a verified purchase, we may also send a Purchase event to Meta via its Conversions API. The purchase event includes the euro amount and a hashed account identifier, but not uploaded photos, prompts, card details or creative content. We do not load the PV LAB Pixel before you opt in. Declining does not prevent account creation, checkout or generation. You can change or withdraw your choice using Privacy choices on PV LAB pages. Meta may set its own identifiers after consent and may process information outside the EEA according to its terms. See Meta Privacy Policy.

Cookies and device storage

Sign-in and account features use necessary session and browser storage. The gallery may cache up to 128 MiB of previews and original images on your device. Cached copies can be reused for up to 24 hours, with expired copies removed when the cache is accessed. The cache is scoped to your account and cleared when you sign out, switch accounts or delete Lab content in that browser. Browser site-data controls can also clear local copies. Sign out when using a shared device.

How long information is kept

Gallery results are kept until you delete them or close your Lab account. Unused source uploads may be removed after 24 hours; references still used by jobs, saved packs or moods are protected. Account closure queues removal of Lab creative content after running jobs and recurring billing have been resolved. Temporary service failures can delay cleanup.

We keep billing, credit and dispute records where required for accounting, legal obligations or unresolved claims. Support and security records are retained as needed to resolve the request or incident and applicable claims, then deleted or anonymised when no longer needed. These purposes and any applicable statutory retention period determine retention; deleting creative files does not erase legally required transaction records.

PV LAB closure does not automatically delete your shared Parallel Vision sign-in or Nina account. Request deletion of those separately by email. Provider-held records and backups are subject to their applicable retention processes; we will assist with requests concerning data processed for us.

Your rights

Subject to the applicable conditions, you can request access, correction, erasure, restriction and portability of your personal data. You can object to processing based on legitimate interests and withdraw any consent you gave. Email us from your account address; we may need proportionate information to verify your identity. You can ask for human review of an account or billing restriction.

You may complain to a data-protection supervisory authority, including the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany. You do not have to contact us first.

Changes

We update this notice when relevant processing changes and indicate the revision date above. Material changes will be communicated where required.