BackThe AI Model Lab
Legal

Privacy Policy

Last updated: October 15, 2026

In short

  • Since September 30, 2026, the controller of your data has been Brain2 Licenciadora de White Labels Ltda. (CNPJ 63.327.013/0001-90). Data Protection Officer (DPO): Bruno Felipe Freitas Magueta. Contact: privacy@help.theaimodelab.com.
  • We process your account data, the content you upload and generate, payment data, and usage and security records.
  • Intimate content and face photos can be sensitive data. We process that data with your specific consent, given the first time you access the Platform.
  • We do not sell personal data and we do not use your content to train our own AI models.
  • AI, payment and infrastructure providers receive only what they need to provide the service, and several are located outside Brazil.
  • You can request access, correction, portability and deletion of your data at any time.

The summary is a reading aid. The full text below is what governs.

1. Who the controller is

Since September 30, 2026, Brain2 Licenciadora de White Labels Ltda., registered under CNPJ No. 63.327.013/0001-90, headquartered at Rua Sousa Caldas, 282, Sala 2, Brás, São Paulo/SP, CEP 03025-040, Brasil, has operated The AI Model Lab and has been the controller of the personal data processed on the Platform, under the Lei Geral de Proteção de Dados (LGPD, Brazil's General Data Protection Law), Law No. 13.709/2018.

Data Protection Officer (DPO, called the Encarregado under the LGPD): Bruno Felipe Freitas Magueta. Contact for data subjects and for the DPO: privacy@help.theaimodelab.com.

This Policy explains what data we process, why, who we share it with, how long we keep it and how you can exercise your rights.

2. Data we process

2.1. Account and profile

Name, email, phone number, photo and display name, country, language, currency and time zone. Your password is stored only as an irreversible hash (bcrypt). Your phone number is used in payments and in conversion events (section 11). If you sign in with Google, we receive the name, email and photo from your Google account.

2.2. Content

Prompts, uploaded images, videos and audio (which may show faces or contain voices), generated outputs, avatars and voices you create, folders, favorites and community posts. Some of this content may be sensitive data (section 3).

2.3. Payments and subscription

Plan, purchase and credit history, transaction identifiers, country and currency, and CPF or CNPJ (Brazilian tax ID) when the payment method requires it. Card data is handled by the payment processor. We do not store the full card number.

If you take part in the affiliate program, we also store the PIX key (PIX is Brazil's instant payment system) that you provide to receive commissions.

2.4. Usage, device and security

IP address, date and time of access, browser, operating system and device, pages viewed, generations and credits used, technical logs and security events. Examples of security events: a request refused for mentioning a minor, stored with the date and an excerpt of up to 300 characters, or a generation stopped because the provider detected a minor in the image.

We also store, together with the generation, the image authorization confirmation that you check in the photo tools.

2.5. Support and reports

Messages you send us by email, WhatsApp or chat (including those answered by the support AI assistant) and content reports. In reports, the IP address is not stored in plain text. We keep only a code generated with a secret key (a hash), used to curb abuse of the form.

2.6. Marketing and traffic source

Campaign parameters (UTM), landing page, ad identifiers, referral code and conversion events (such as sign-up and purchase). Section 11 explains how measurement works.

2.7. Quiz and offer pages

If you answer the quiz or fill out an offer page, we process your name, email, phone number, answers and traffic source (section 2.6).

2.8. Data about other people that you upload

If you upload another person's image or voice, you are responsible for having their authorization (see the Acceptable Use Policy). We do not use images to identify who a person is (facial recognition).

3. What we use your data for and the legal basis

Providing the service

Creating your account, generating and storing content, billing, releasing credits and providing support. Basis: performance of a contract (art. 7, V).

Intimate content and face photos

They may be sensitive data. Basis: your specific and prominent consent (art. 11, I), given in its own checkbox the first time you access the Platform, and regular exercise of rights (art. 11, II, d).

Security and moderation

Preventing fraud and abuse, moderating content and protecting children and teenagers. Basis: legitimate interest (art. 7, IX) and legal obligation (art. 7, II). When sensitive data is involved: compliance with a legal obligation (art. 11, II, a) and regular exercise of rights (art. 11, II, d).

Legal obligations

Keeping access logs as required by art. 15 of the Marco Civil da Internet (Brazilian Internet Civil Framework), meeting tax obligations and complying with orders from authorities. Basis: legal obligation (art. 7, II) and regular exercise of rights (art. 7, VI).

Service notices

Receipts, account notices and security notices. Basis: performance of a contract (art. 7, V).

News and offers

Product emails and promotions. To stop receiving them, reply to any email or write to support@help.theaimodelab.com, and we will remove you from the list within 2 business days. Basis: legitimate interest (art. 7, IX) or consent (art. 7, I).

Campaign measurement

Knowing which ad brought each sign-up and each sale (section 11). Basis: legitimate interest (art. 7, IX) and, where required, consent.

You can withdraw your consent at any time at privacy@help.theaimodelab.com. Withdrawal applies from that point on and does not reach the records the law requires us to keep. Without consent, we cannot process this type of content. We do not sell personal data and we do not use your content to train our own AI models.

4. Automated decisions

Automatic filters may refuse or stop a generation request, for example when the text mentions or suggests a minor, when the AI provider detects a minor in an image, or when the provider blocks the content. You can ask support for human review of that decision (art. 20 of the LGPD).

5. Who we share data with

  • AI providers, which run the generation and receive the prompt and the files for that request: Google (Gemini and Veo), kie.ai, WaveSpeed, ComfyDeploy, HeyGen, Deepdeep (n88ed) and Inworld. Through these intermediaries, the request may also reach models from OpenAI, ByteDance, Kuaishou, MiniMax and xAI.
  • Infrastructure (hosting for the website and the API, database, file storage and queues): Vercel, Supabase, dedicated servers (Hostinger) and Railway.
  • Payments, depending on the method used for the purchase: Stripe, Perfect Pay, Cakto, Mercado Pago, Asaas, Hotmart, Greenn, Cartpanda and Hubla.
  • Email and support: Resend (email delivery), WhatsApp (Meta) through an integration provider, the support AI assistant (Anthropic) and Microsoft (support mailbox).
  • Measurement and sign-in: UTMify and Meta (campaign measurement, section 11) and Google (Sign in with Google).
  • Public authorities, when the law or a court order requires it, or to protect rights, including when reporting crimes against children and teenagers.
  • In a corporate transaction (sale, merger or transfer of the business), the successor receives the data and is bound by this Policy.

Our vendors process data on our behalf and under our instructions. When they act as independent controllers (for example, payment providers), they also follow their own privacy policies.

6. International transfers

Several vendors are located outside Brazil, mainly in the United States, the European Union and Asia (including China and Singapore).

The transfer is allowed by art. 33 of the LGPD because it is necessary to perform the contract with you (art. 33, IX, together with art. 7, V). When the vendor signs the standard clauses approved by the ANPD (Brazilian Data Protection Authority), the transfer also follows those clauses.

7. How long we keep data

  • Account and profile: for as long as the account exists. After a deletion request, we delete or anonymize the data within 15 days, except for what the law requires us to keep.
  • Generated content: stays in your gallery for the gallery retention period of your plan (stated on the plans page) or until you delete it. When you delete an item, it leaves your gallery immediately, and you can ask at privacy@help.theaimodelab.com for the file to be permanently removed.
  • Files you upload for a generation: deleted right after it finishes.
  • Access logs (IP address, date and time): 6 months, as required by the Marco Civil da Internet (art. 15).
  • Payment and tax records: for the period set by tax law (as a rule, 5 years counted from the year after the purchase).
  • Security events, reports and moderation records: up to 5 years, or longer during an investigation or legal proceeding.
  • Support messages: up to 2 years after the last contact.
  • Backups: up to 12 months, with restricted access.

Once the purpose has been met, data is deleted or anonymized, unless the law requires us to keep it.

8. Deleting your account and data

You can ask for your account to be deleted through support (support@help.theaimodelab.com or WhatsApp +55 11 92219-8321) or at privacy@help.theaimodelab.com. Access is blocked immediately: we end your sessions, and a device that was already signed in loses access within 15 minutes.

Within 15 days, we delete or anonymize your account data, generations and files. We keep only what the law requires us to keep (payment and tax records and access logs) and security and moderation records, for the periods in section 7.

When you delete your account, we cancel the renewal of your subscriptions. If a subscription is billed through Perfect Pay, we show you how to cancel it there. A renewal charged after deletion is refunded in full.

9. Your rights

Under the LGPD (art. 18), you can request the following at any time:

  • Confirmation that we process your data, and access to it.
  • Correction of incomplete, inaccurate or outdated data.
  • Anonymization, blocking or deletion of data that is unnecessary, excessive or processed in non-compliance with the law.
  • Portability of your data to another provider.
  • Deletion of data processed on the basis of your consent.
  • Information about who we share your data with.
  • Information about the option of not giving consent and the consequences of that.
  • Withdrawal of consent.
  • Review of decisions made solely on the basis of automated processing.

To exercise any right, write to privacy@help.theaimodelab.com. We may confirm your identity before we act on your request. We respond within 15 days. You can also file a complaint with the ANPD (Autoridade Nacional de Proteção de Dados) at www.gov.br/anpd.

10. Security

We use encrypted connections (TLS), passwords stored only as an irreversible hash (bcrypt), team access limited to administrators, and encryption at rest at our storage providers.

Generated files are delivered through long links that are hard to guess. Anyone who has the link can open the file, so do not share links to private content.

If a security incident happens that may cause a significant risk or harm, we notify the ANPD and the people affected, as art. 48 of the LGPD requires.

11. Measurement and cookies

The The AI Model Lab website does not use Google Analytics, and the Meta Pixel is turned off. Campaign measurement is done through UTMify.

On sign-up and purchase events, UTMify and Meta (through the Conversions API, when active) receive your email, phone number and name in hashed form (a code, not the text), plus your country, IP address and browser data, so we can tell which ad brought the sale. Payment processors also send the sale data to UTMify.

  • Necessary cookies: they keep you logged in and remember your language and preferences. Without them, the Platform does not work.
  • Measurement cookies: _fbp, _fbc and theaimodelab_attribution, stored for up to 90 days.

You can block or delete cookies in your browser. Blocking the necessary ones may prevent you from logging in.

12. Children and teenagers

The Platform is exclusively for people 18 or older, and we do not intentionally process the data of minors. If we identify an account belonging to a minor, we terminate the account and delete the data, except for what must be preserved for the authorities. Content that involves minors is refused and, once the case is confirmed, reported to the competent authorities.

13. Users outside Brazil

If you are in the European Union, the United Kingdom or any other place with its own data protection law, you also have the rights that law gives you (such as access, correction, deletion, portability and objection) and you can complain to your local data protection authority. The contact channel is the same: privacy@help.theaimodelab.com.

14. Changes to this Policy

We may update this Policy. The new version is published here with its update date, and significant changes are announced on the Platform or by email.