Effective date: October 9, 2026
Last updated: October 19, 2026
1. Scope and roles
This Data Processing Addendum ("DPA") is part of the Terms of Service between MLo Labs Inc. ("MLo Labs", "we") and the customer using VisoLab ("Customer", "you"). It applies when you use the Service to process personal information about other people (for example, photos of people, voices, or customer lists in prompts) on behalf of your organization, and the GDPR, UK GDPR, Swiss FADP, PIPEDA, Quebec's Law 25, or a US state privacy law applies.
Roles. For that content ("Customer Personal Data"), you are the controller (or business) and MLo Labs is your processor (or service provider). For your own account, billing and security information, MLo Labs is a controller. That is covered by the Privacy Policy, not this DPA.
No signature needed. This DPA applies automatically when you accept the Terms. If your procurement team needs a signed copy, email legal@visolab.io.
2. Details of the processing
- Subject matter and purpose: providing the Service: generating, editing, storing and showing media from your Inputs.
- Duration: as long as you have an account, plus the retention in section 8.
- Nature of processing: hosting, storing, transmitting to the AI provider you chose, and returning Outputs.
- Types of data: whatever you put into the Service, which may include images, video, audio, voices, names and other personal information in prompts and files.
- People concerned: people shown, voiced or named in your Inputs, and your own team members.
- Sensitive data: the Service isn't meant for it. Please don't upload special-category data (see the Privacy Policy).
3. What we do
1. Instructions. We process Customer Personal Data only on your documented instructions, which are the Terms, this DPA, and your use of the Service's features. We tell you if we think an instruction breaks the law.
2. Purpose limit. We don't sell it, don't use it to train our own AI models, and don't use it for any purpose other than providing the Service to you, except where the law requires.
3. Confidentiality. People who can access it are bound by confidentiality.
4. Security. We keep the measures in the Annex, and we may improve them.
5. Help with requests. If someone asks us to access, correct or delete their data and it is Customer Personal Data, we pass the request to you without answering it ourselves, unless the law says otherwise. We give reasonable help so you can answer it. The Service lets you export and delete your content.
6. Breaches. We tell you without undue delay after we become aware of a personal-data breach affecting Customer Personal Data, with what we know about it and what we are doing.
7. Assessments. We give reasonable help with your data-protection impact assessments and consultations with regulators, where they relate to the Service.
4. Sub-processors
You agree that we may use the sub-processors on the sub-processor page, which includes the AI model providers that run the models you choose. We have a written agreement with each, or use their published terms, with data-protection obligations that are no less protective than these.
We give at least 30 days' notice before adding or replacing a sub-processor, by updating that page and emailing the account owner. You may object on reasonable data-protection grounds by writing to legal@visolab.io within that period. If we can't resolve it, you can stop using the affected model or feature or end your plan, and we refund the unused part of your paid period. We remain responsible for our sub-processors.
We name the company behind each AI model provider on request, and in a signed DPA.
5. International transfers
MLo Labs Inc. is in Canada. Our sub-processors are mainly in Canada and the United States. Where the GDPR, UK GDPR or Swiss FADP restricts a transfer of Customer Personal Data to us or onward, we rely on an adequacy decision, the EU-US Data Privacy Framework where a provider is certified, or the EU Standard Contractual Clauses (Module 2, controller to processor, and Module 3 for onward transfers), which are incorporated into this DPA. The UK Addendum applies for UK transfers, and the Swiss changes apply for Swiss transfers.
For the Clauses: the competent supervisory authority is the one in the Customer's country; the governing law is the law of Ireland; the courts are those of Ireland; the Annex of this DPA and the sub-processor page are the annexes. If the Clauses and this DPA conflict, the Clauses win.
6. US state privacy laws
For Customer Personal Data subject to the CCPA or another US state privacy law, MLo Labs is your service provider or processor. We don't sell or share it, don't keep, use or disclose it outside our direct business relationship with you or for any purpose other than the one in the Terms, and don't combine it with other data except as the law allows. We will tell you if we can no longer meet these obligations, and you may take reasonable steps to stop and fix any unauthorized use.
7. Audits
On request, we give you the information needed to show we follow this DPA, such as a written summary of our security measures. If that isn't enough, or a regulator requires it, you may audit us once a year with reasonable notice, during business hours, under confidentiality, and at your own cost, in a way that doesn't disrupt the Service or expose other customers' data.
8. Deletion and return
You can export and delete your content in the Service at any time. When your account ends, we delete Customer Personal Data, except where the law requires us to keep it. Copies in backups are deleted within 90 days. We tell you if a legal obligation means we must keep something.
9. Liability and order of precedence
Each party's liability under this DPA is subject to the limits in the Terms, except where the law or the Standard Contractual Clauses say otherwise. If this DPA and the Terms conflict about Customer Personal Data, this DPA wins. A signed enterprise agreement can replace this DPA.
10. Contact
Privacy questions: privacy@visolab.io. Signed copies and objections: legal@visolab.io. MLo Labs Inc., 51 E. Liberty St, Toronto, ON M6K 3P8.
Annex: security measures
- Encryption of data in transit.
- Passwords and one-time tokens are stored hashed, never in plain text.
- Access controls: staff access is role-based, and administrator actions are recorded in an audit log.
- Rate limiting on sign-in and other abuse-prone actions.
- Signed, expiring links for downloads and data exports.
- Provider selection: we use hosting, database and payment providers that have recognized security programs.
- A security contact for vulnerability reports: security@visolab.io.