Effective date: October 9, 2026
Last updated: October 19, 2026
1. Who is responsible for your information
VisoLab is owned and operated by MLo Labs Inc. ("MLo Labs", "we", "us"), 51 E. Liberty St, Toronto, ON M6K 3P8.
MLo Labs is the organization accountable for your personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act respecting the protection of personal information in the private sector.
Person in charge of the protection of personal information: Privacy Officer, MLo Labs Inc., privacy@visolab.io, 51 E. Liberty St, Toronto (Ontario) M6K 3P8.
- Phone: 416-268-5004
2. Summary
- We collect what we need to run your account, generate your media, bill you and keep VisoLab safe.
- To create your media, we send prompts and uploaded files to the third-party AI provider that runs the model you choose.
- We don't sell your personal information. We don't use your prompts, uploads or Outputs to train or improve AI models.
- On every plan except Max, we may show Outputs you generate, and the prompts used to make them, in our gallery and marketing (never uploads or identifiable real people). If you live in Quebec, showcasing is off by default (section 4A).
- The Service is offered in Canada and the United States. Our service providers are mainly in Canada and the United States, so your information may be processed outside your province or country.
- You can access, export, correct and delete your data in Settings, or by emailing privacy@visolab.io.
3. What we collect
Account: Name, email, password hash (never the password itself), email-verification status, terms-acceptance date and version, age confirmation, and province or state.
Google sign-in: If you choose Google sign-in, Google gives us your name, email address and whether it has verified your email. We save your name and email (and mark your email as verified) in your account. Google also sends a profile picture and account ID with every sign-in; we don't save or display them.
Studio content: Prompts, settings, uploaded images, audio and video, generated Outputs, project names, comments, Formulas workflows.
Billing: Plan, billing interval, subscription status, Airwallex customer and subscription IDs, payment status, amounts, credit ledger. We don't receive or store full card numbers.
Support: Messages you send us, abuse or copyright reports.
Technical and security: IP address, browser and device information, timestamps, sign-in events, rate-limit counters, error logs, generation and credit logs.
Analytics: Aggregate, cookieless page-view metrics (Vercel Web Analytics).
Sensitive content. Please don't upload sensitive personal information, such as health information or ID documents, or images or voices of other people without their consent. If you upload an image or voice of a person, you confirm you have the right to do so.
4. Why we use it
We use personal information to:
1. create, verify and secure your account
2. run generations and store, show and organize your projects and assets
3. process payments, renewals, refunds and taxes, and send receipts, agreement copies and service notices
4. provide support and respond to requests
5. prevent fraud, abuse and violations of our Terms and Acceptable Use Policy, including reviewing reports and, where required by law, reporting illegal content to the authorities
6. keep the Service reliable, debug it, and understand aggregate usage
7. comply with legal, tax and accounting obligations
8. show certain creations in our gallery and marketing (section 4A)
9. send marketing emails, only if you opt in (you can unsubscribe at any time)
What we don't do:
- We don't sell personal information, or "share" it for cross-context behavioural advertising.
- We don't use your prompts, uploads or Outputs to train or improve AI models.
- We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. If that changes, we'll tell you and explain your rights.
4A. Showcase and marketing
What we do. On every plan except Max, we show Outputs you generate, and the prompts used to make them, in VisoLab's public gallery and in materials that promote VisoLab: our website, social media, advertising and presentations. This is part of those plans and can't be switched off. Max keeps your creations private. We may credit you by your display name or show work uncredited.
What we never use:
- your uploads
- anything showing, naming or voicing an identifiable real person
- anything made on Max
- Enterprise or DPA content
We never publish your real name, email or account details.
If you live in Quebec, showcasing is off by default. We show your creations only if you turn it on yourself in Settings → Privacy. That's a consent that is manifest, free, informed and given for this purpose only. You can withdraw it at any time (Law 25, ss.9.1, 12, 14).
Removal. You, or anyone shown in an item, can ask us to remove it at privacy@visolab.io or the contact form with a link and how it relates to you. Intimate images: the intimate-image removal form (48 hours). Gallery items also have a Remove from gallery button.
- Items showing a real person: removed within 2 business days.
- Other items: removed from the gallery and from new and live marketing and ads within 10 business days.
We can't recall printed materials or copies others have shared.
Legal basis.
- Canada: we tell you about this purpose clearly before you sign up and when you accept the Terms. Max, and removal on request, let you limit it.
- EU/UK: not applicable. The Service isn't offered there (Terms s.3A).
- California and other US states: showcasing isn't a 'sale' or 'sharing' of personal information. We don't use it for cross-context behavioural advertising.
No training. We don't use your prompts, uploads or Outputs to train or improve AI models.
5. Consent and legal bases
Canada. We rely on your consent, given when you create an account and use the Service, for the purposes above. Secondary purposes (showcasing in Quebec, marketing email) are asked for separately. Some uses don't need consent where the law allows (for example, investigating fraud or complying with law). You may withdraw consent at any time, subject to legal or contractual restrictions. If you withdraw consent needed to run your account, we may have to close it.
7. Google sign-in and Google user data
If you choose Continue with Google, VisoLab asks Google for only the basic sign-in scopes: openid, email and profile. Google sends us your name, email address and whether it has verified your email, along with your Google account ID and profile picture. We save only your name and email (and mark the email as verified); we don't store or display the account ID or picture.
How we use it. Only to create your account, sign you in, verify your email address, show your name in the studio, and keep your account secure (for example, to stop someone else claiming an email address). We don't use it for advertising.
What we don't access. We don't request or read your Gmail, Google Drive, Calendar, Contacts, Photos or any other Google service data, and we don't act on your Google account.
Storage and sharing. We store it with the rest of your account information (see section 9) and share it only with the service providers listed in section 6 who run VisoLab for us, or as the law requires. We don't sell it or transfer it to advertisers, data brokers or resellers. We don't use it to train AI models. Our employees don't read it except to support you at your request, to investigate abuse or a security problem, or to comply with law.
Limited Use. VisoLab's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including its Limited Use requirements.
Your choices. You can stop using Google sign-in at any time: remove the connection under Third-party apps & services in your Google Account, and delete your VisoLab account in Settings (this deletes the Google information we hold, subject to the retention in section 9), or email privacy@visolab.io. Google's own handling of your data is covered by Google's Privacy Policy.
8. International transfers
MLo Labs is based in Ontario, Canada. Our providers process information in Canada, the United States and possibly other countries. In those countries, your information may be accessible to courts, law-enforcement and national-security authorities under local law.
We use contracts and other measures to protect information that we transfer.
Quebec. Before communicating personal information outside Quebec, we assess the privacy impact and require contractual protection.
9. How long we keep it
Account, projects, prompts, assets: Until you delete them or your account. Deleted from backups within 90 days.
Email-verification and password-reset tokens: Expire after 24 hours and 1 hour respectively; marked used when spent.
Billing records, invoices and the credit ledger: At least 6 years, for tax and accounting. After account deletion, your name and email are removed where possible.
Security logs and abuse reports: 12–24 months, longer if needed for an open investigation or a legal obligation.
Messages you send through the Contact form: Until we have resolved them, then deleted 12 months later. Deleted sooner if you delete your account.
Marketing consent records: As long as you're subscribed, plus 3 years as proof of consent.
Showcase and other consent records: For as long as the account exists, plus 3 years.
Confidentiality incident register: At least 5 years.
Breach records (if any): At least 24 months, as PIPEDA regulations require.
11. Your rights
Depending on where you live, you may have the right to:
- access your personal information and learn how it's used and disclosed
- correct inaccurate information
- delete your account and personal information (subject to legal retention)
- export a copy (Settings → Export gives a JSON file)
- withdraw consent, including for marketing and, in Quebec, for showcasing
- de-indexing and portability (Quebec)
- know about, delete and correct data, and opt out of sale or sharing (certain US states; we don't sell or share)
How to make a request. Use Settings, or email privacy@visolab.io. We may need to verify your identity. We'll respond within 30 days (PIPEDA and Quebec), or within the time your local law requires, and tell you if we need an extension.
If you are outside Canada and the United States, the Service isn't offered to you. If we hold your information anyway, you can still ask to access or delete it at privacy@visolab.io.
If you're not satisfied, you can complain to:
- the Office of the Privacy Commissioner of Canada (priv.gc.ca)
- the Commission d'accès à l'information du Québec (cai.gouv.qc.ca), if Quebec law applies
12. Security
We use reasonable safeguards, including:
- encryption in transit
- hashed passwords and tokens
- access controls
- rate limiting
- providers with recognized security programs
We keep a confidentiality incident register. If a breach creates a real risk of significant harm to you, we'll notify you and the regulators as the law requires, including the Commission d'accès à l'information when Quebec law applies. Report vulnerabilities to security@visolab.io.
13. Children
VisoLab isn't intended for anyone under 18. We don't knowingly collect personal information from children. If you believe a child has an account, email privacy@visolab.io and we'll delete it.
14. Marketing emails
We send marketing emails only with your consent. Each one identifies MLo Labs, includes our mailing address, and has a one-click unsubscribe link. We process unsubscribe requests within 10 business days.
Service messages (receipts, security alerts, policy notices) aren't marketing and will still be sent.
15. Changes
We'll post updates here and change the "Last updated" date. For material changes, we'll notify you by email or in the studio before they take effect. For Quebec consumers, see Terms section 20.5.
16. Contact
Privacy Officer, MLo Labs Inc. (operator of VisoLab)
- 51 E. Liberty St, Toronto, ON M6K 3P8
- privacy@visolab.io
- 416-268-5004