Privacy

• It runs on your computer. Your projects, settings and the API keys you add stay in its data folder, on your computer. We receive none of it, unless you sign in to an account (see below).
• The AI you choose with your own access (Claude Code, Codex, Ollama, or a provider with your key) receives what you ask it, under that provider's own terms.
• Free photo search sends the words you search for to Openverse, and to Pexels or Pixabay if you add a key for them.
• To tell you about a new version, the app asks the npm registry (registry.npmjs.org) for the latest version number. Like any web request, this shows npm your IP address.

• Your account: email address, name, password (kept only as a one-way hash by our database provider) or your Google or GitHub sign-in, and your preferences.
• Your workspace: its name, its members and the invitations sent (the invited person's email address).
• Billing: your plan, its payment state, your billing address and VAT number if you give one, and your invoices. Card details go straight to Stripe; we never see them.
• Your work in the cloud: the projects, files, brand kits and comments you keep in the web app or in sync.
• Hosted AI: for each request, the model, the tokens, the cost, the project's name and a short description of what was asked. What you send is passed to the model so it can answer (see "AI and your data").
• The community: the projects you publish (picture, file, name, author name) and the reports you send.
• Sites on Onlab Cloud: their files, their address and the domain you connect.
• Security: to stop abuse of sign-in emails, a hash of the email address and of the network that asked for a code, kept for one day; and the technical logs our host keeps for a short time (IP address, browser, page asked for).

We send no newsletters and no ads. When you close your account, we delete it, the workspace you own, its projects, its sites and your community posts. If you are a member of someone else's workspace, what you made there stays with that workspace. Invoices stay in our accounting records (Stripe) for 10 years.

Provider	What for	Where
Supabase	Accounts, database and files	European Union (Paris)
Vercel	Hosting onlabstudio.com and the sites published on Onlab Cloud	Functions in Paris, content served from the nearest location; Vercel Inc. (United States), certified under the EU-U.S. Data Privacy Framework
Stripe	Payments, invoices and tax	Stripe Payments Europe (Ireland). Stripe is also responsible, on its own account, for its fraud checks and its legal duties
OpenRouter	Hosted AI, passed on to the model's provider	United States, then the model provider's country
Resend	Account emails	United States
GoogleGitHub	Signing in with Google or GitHub	Only if you sign in with them; they are responsible for their part

Transfers outside the European Union rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework for certified companies) or on the European Commission's standard contractual clauses. We sell no data, show no ads and use no analytics.

• Hosted AI requests go through OpenRouter to the model's provider, which answers them. We ask OpenRouter to send them only to providers that do not use them to train models. For models that allow it, we also require zero retention: the provider keeps nothing. The few models that keep requests for a while are marked in the model picker.
• We do not use your projects or your requests to train any model.
• Pictures made or changed by AI carry a machine-readable mark in their file (IPTC's digital source type), as the EU AI Act requires (article 50).
• No decision with legal or similarly significant effects on you is made by automated means (GDPR, article 22).

Only the cookies the service needs: staying signed in (Supabase), your language (PARAGLIDE_LOCALE), the workspace and the AI you picked (onlab-workspace, onlab-ai). They need no consent (article 82 of the French Data Protection Act). No analytics, advertising or tracking cookies.

• Everything travels over HTTPS. In the database, each workspace's data is walled off from the others (row-level security), and the database is encrypted at rest by our provider.
• Payment details never reach our servers. Server keys stay on the server, never in the app you download. Only Onlab's own team can reach the production systems.
• If a data breach puts your rights at risk, we tell the CNIL within 72 hours and you without undue delay (GDPR, articles 33 and 34).

You can access your data, correct it, erase it, receive it in a common format, object to a use of it or limit it, and say what should happen to it after your death (French Data Protection Act, article 85). Write to hello@onlabtechnologies.com: we answer within one month (GDPR, article 12). You can delete your account yourself in Settings. You can also complain to the CNIL, France's data protection authority (cnil.fr).

Onlab Studio is not meant for children under 15.

When this page changes, so does the date at the top. If a change affects you, we write to you before it applies. See also the terms and the legal notice.