1. Who we are and what this policy covers
This Privacy Policy explains how AstraiLab ("AstraiLab," "we," "us" or "our") handles personal information when you visit astrailab.com, create an account, use the creative workspace, contact support or interact with our public pages.
AstraiLab is operated by the operator of the AstraiLab service. Our privacy contact is support@astrailab.com. We use the terms "controller" and "processor" in the sense used by applicable data-protection law. The party responsible for a particular workspace may also determine the purposes of processing for information that it uploads or directs us to process.
2. Personal information we collect
The information we collect depends on how you use AstraiLab. We do not need every category below from every visitor.
| Category | Examples | How it is collected |
|---|---|---|
| Account and identity | Name, email address, account ID, sign-in provider and profile image when supplied. | From you or the identity provider you choose. |
| Workspace and creative content | Prompts, instructions, uploaded reference files, generation settings, outputs, creations, job status and related metadata. | From actions you take in the workspace. |
| Billing and subscription | Plan, billing interval, checkout status, transaction identifiers, entitlement and credit records. Payment-card details are handled by the payment provider shown at checkout. | From checkout, the payment provider and our billing records. |
| Support and communications | Messages, attachments you choose to send, account details needed to investigate an issue and communication preferences. | From support requests and other direct contact. |
| Security and operations | IP address, request timestamps, browser and device information, authentication events, error reports, rate-limit signals and audit records. | Automatically when the service is requested. |
| Optional analytics | Page paths, selected product events, an anonymous browser identifier and technical usage data collected by Google Analytics when you consent. | From the browser after an analytics choice is granted. |
We may receive information from service providers that help us authenticate accounts, process payments, deliver files, operate AI models, detect abuse or measure service performance. We do not ask for sensitive personal information and do not intentionally collect it as a category for advertising.
Account, workspace, billing and security information may be required to create an account, process a purchase or provide protected product features. If you do not provide required information, we may not be able to provide the related service. Optional analytics is not required to use AstraiLab and can be declined.
3. Sources of information
- You provide information when you register, sign in, create a workspace, upload content, start a generation, subscribe or contact support.
- Connected identity, payment, infrastructure and AI providers provide limited account, transaction, task or delivery information needed for the requested service.
- Our systems create technical, security, billing and audit records as the service operates.
- Optional analytics providers collect usage information only after the browser records your optional cookie choice.
4. How we use information and our legal bases
We use personal information for the purposes below. Where the GDPR, UK GDPR or a similar law applies, the corresponding legal basis is shown. A legal basis may vary by context and jurisdiction.
| Purpose | Information used | Legal basis |
|---|---|---|
| Provide the workspace | Account, workspace content, job and credit records. | Performance of a contract; legitimate interests in operating a secure service. |
| Process subscriptions and credits | Account, plan, transaction and entitlement information. | Performance of a contract; legal obligations for accounting and fraud prevention. |
| Secure and improve the core service | Technical logs, error records, abuse signals and aggregated product information. | Legitimate interests, balanced against user rights. |
| Optional analytics | Analytics identifiers, page views and selected event data. | Consent where required; you can decline or withdraw it. |
| Meet legal duties | Information reasonably necessary for tax, accounting, legal requests, disputes and compliance. | Legal obligation or legitimate interests in establishing and defending claims. |
5. AI inputs, outputs and third-party model providers
When you request a generation, we process the prompt, settings and reference files needed to submit that request, track its status and return the result. Depending on the selected model and workflow, the request may be sent to a configured provider such as KIE, FAL or BytePlus. The provider may process the request under its own terms and privacy policy.
You are responsible for having the rights, permissions and lawful basis required for every prompt, image, video, voice, likeness, trademark or other material you submit. AI outputs may be inaccurate, similar to outputs generated for other users or unsuitable for a particular purpose. Review outputs before publishing or relying on them, and do not use AstraiLab for emergency, medical, legal, employment, credit, insurance or other high-impact decisions.
We do not put prompts, uploaded file names, uploaded file URLs or generated content into product analytics parameters. Provider requests still contain the content necessary to perform the generation you asked for; do not upload material that you are not permitted to send to the selected provider.
We may use automated systems to detect abuse, fraud, policy violations or provider restrictions and to decide whether a request can proceed. These checks are not intended to make decisions producing legal or similarly significant effects about you. Contact support if you need a review of a blocked request or account restriction.
6. When we disclose information
We disclose information only as needed for the purposes described in this policy, to provide the service, or when required by law. Current categories of recipients include:
- Infrastructure and storage: Cloudflare and Supabase/Postgres or equivalent infrastructure used for delivery, authentication, database and file operations.
- Payment services: Creem or another payment provider displayed at checkout for payment authorization, subscription management, tax and fraud controls.
- AI providers: The model provider selected for the requested workflow, including the providers described in Section 5 when applicable.
- Analytics: Google Analytics only after your optional analytics consent. Its standard collection may include browser, device, approximate location and usage information.
- Professional and legal advisers: Advisers, auditors, authorities or counterparties when reasonably necessary for legal compliance, security, a merger, an acquisition or a dispute.
We do not currently sell personal information or share it for cross-context behavioural advertising. We do not use Google Signals or Google advertising-personalization signals in the site tag. If those practices change, this policy and the consent experience will be updated before the change takes effect where required.
7. Cookies, local storage and analytics
AstraiLab uses essential browser storage for authentication, security, workflow continuity and remembering your cookie choice. Optional analytics cookies are off until you select “Accept cookies” in the consent banner. The separate Cookie Policy describes these technologies, purposes and choices in more detail. You can change the choice by clearing the saved preference in your browser and revisiting the site.
This policy covers the storage and analytics technologies currently used, their purposes and how to manage them. Google Analytics may set first-party cookies such as _ga only after consent, subject to the Google Analytics configuration and browser controls.
8. Retention
We keep information only for as long as it is reasonably necessary for the purpose for which it was collected, the active account and workspace, security and fraud prevention, customer support, legal obligations, accounting or the establishment and defence of claims. When a fixed period is not practical, we use these criteria to decide when deletion or anonymisation is appropriate.
- Account and workspace records are retained while the account or workspace is active and for a limited period afterwards when needed for deletion, support, security or legal obligations.
- Generation inputs and outputs are retained according to workspace operation, deletion requests and storage controls available in the product.
- Billing, tax, fraud and legally required records may be retained for the period required by applicable law.
- Operational logs are kept for the shorter period reasonably needed to secure, debug and maintain the service.
- Google Analytics retention follows the configured property settings; you can decline or withdraw optional analytics consent.
9. Security
We use technical and organisational safeguards appropriate to the information and risks involved, including server-side secret handling, access controls, authentication protections, rate limits, provider security controls, audit records and encrypted transport where supported. No internet service, storage system or transmission can be guaranteed to be completely secure.
If you believe your account or content has been compromised, contact support@astrailab.com promptly and rotate affected credentials. Do not include passwords or access tokens in the message.
10. International transfers
AstraiLab and its service providers may process information in countries other than the country where you live. Where applicable, we use a lawful transfer mechanism such as an adequacy decision, contractual safeguards or another mechanism recognised by data protection law. You can request more information about applicable safeguards from our privacy contact.
11. Your privacy rights
Depending on where you live and subject to legal exceptions, you may have the right to access or know what personal information we hold, correct inaccurate information, delete information, receive a portable copy, restrict or object to certain processing, withdraw consent, appeal a decision, or complain to your local data-protection authority. California residents may also have rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information where applicable, and receive equal service.
To make a request, email support@astrailab.com from the account email when possible. State the request, the account or workspace it concerns and the jurisdiction you are relying on. We may ask for reasonable information to verify identity, will not use your request to discriminate against you and will respond within the time required by applicable law. You may also use the in-product account controls available to you.
12. Children
AstraiLab is not directed to children who are below the minimum age required to use an online service in their jurisdiction. Do not create an account or submit information on behalf of a child without the required parental or guardian authority. If you believe a child has provided information to us, contact support@astrailab.com.
13. Changes and contact
We may update this policy when our product, providers or legal obligations change. We will update the date at the top of this page and, where required, provide additional notice. Questions, privacy requests and complaints can be sent to support@astrailab.com.