SomaLabs

1. Introduction

SomaLabs ("we," "us," or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our AI image and video generation services (the "Service").

By using the Service, you consent to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our practices, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

Account Information: When you create an account, we collect your email address and authentication credentials.
Profile Information: Optional information you provide, such as a display name.
Payment Information: When you make purchases, our payment processor collects billing details. We do not store complete payment card numbers.
User Content: Text prompts, uploaded reference images, and the images and videos generated through the Service.
API Usage: If API access is enabled for your plan, we collect data about your API requests, including endpoints accessed, timestamps, and rate-limit metrics.
Communications: Information you provide when contacting us for support or feedback.

2.2 Information Collected Automatically

Device Information: Browser type, operating system, and device type.
Usage Data: Features used, generation history, and interaction patterns.
Log Data: IP address, access times, and error logs.
Essential Cookies: We use an authentication session cookie so you stay signed in (see Section 6).

3. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Service
Process your transactions and manage your account
Generate images and videos based on your prompts and inputs
Analyze prompts and generated images using automated systems to detect content that violates our policies or applicable law
Log content-moderation decisions for platform safety and legal compliance
Send transactional communications (receipts, account and security updates)
Respond to your requests, comments, and questions
Detect, prevent, and address technical issues and fraud
Enforce our Terms of Service and Acceptable Use Policy
Comply with legal obligations

We may use anonymized and aggregated data for research, analytics, and service-improvement purposes.

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

4.1 Service Providers

We share information with third-party vendors who help us provide the Service, including:

Cloud hosting and storage providers
Payment processor (we do not store complete payment card numbers)
AI model providers for image and video generation - your prompts and reference images are sent to these providers for processing
Infrastructure monitoring and email delivery services

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

4.2 Legal Requirements

We may disclose your information if required by law, legal process, or government request, or if we believe disclosure is necessary to:

Protect the rights, property, or safety of SomaLabs, our users, or others
Enforce our Terms of Service
Investigate potential violations of our policies
Detect and prevent fraud or security incidents
Report apparent child sexual abuse material (CSAM) to the appropriate authorities, including the National Center for Missing & Exploited Children (NCMEC), as required by applicable law

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and the choices you may have.

5. Data Retention

We retain your information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy. Specifically:

Account Data: Retained while your account is active and for a reasonable period after deletion for legal and operational purposes.
Generated Content: Stored privately in your account until you delete it or your account is terminated.
Transaction Records: Retained for legal and accounting purposes as required by law.
Log Data: Typically retained for a limited period for security and debugging purposes.
Content Moderation Records: Violation records, including the flagged prompt and the moderation decision, are retained for legal compliance and platform safety.
CSAM Records: Content identified as child sexual abuse material and the related records are preserved as required by law and are not deleted upon an account-deletion request.

6. Cookies

We use only essential cookies that are required for the Service to function. Specifically, we use a secure, httpOnly session cookie to keep you signed in and to protect your account.

We do not use advertising cookies, and we do not use third-party analytics or cross-site tracking cookies. Because we do not run advertising or tracking cookies, there is no consent banner to manage.

You can clear cookies through your browser settings. Note that clearing or blocking the essential session cookie will sign you out and prevent the Service from functioning.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

Encryption of data in transit (TLS/SSL)
Secure authentication mechanisms, including hashed passwords and httpOnly session cookies
Access controls limiting data access to authorized personnel
Regular monitoring and incident-response procedures

While we strive to protect your information, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security.

8. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal data:

8.1 Access and Portability

You can export a copy of your account data at any time from your account settings, in a structured, machine-readable format.

8.2 Correction

You can update your account information through your profile settings or request corrections to inaccurate data.

8.3 Deletion

You can delete your account and personal data from your account settings, subject to our retention requirements for legal and operational purposes.

8.4 Objection and Restriction

You may object to certain processing of your data or request that we restrict processing under certain circumstances.

To exercise any of these rights, please contact us at support@somalabs.studio.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. When we transfer data internationally, we implement appropriate safeguards to ensure your data receives adequate protection.

10. Children's Privacy

The Service is not intended for users under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected personal information from a person under 18, we will take steps to delete that information. If you believe we have inadvertently collected such information, please contact us immediately.

11. European Users (GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR):

Legal Basis: We process your data based on (a) your consent, (b) performance of a contract, (c) legal obligations, or (d) legitimate interests that do not override your rights.
Right to Lodge a Complaint: You have the right to file a complaint with your local data protection authority.
Data Protection Inquiries: Contact support@somalabs.studio.

12. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

Right to know what personal information we collect and how it is used
Right to request deletion of your personal information
Right to opt out of the sale of personal information (we do not sell your data)
Right to non-discrimination for exercising your privacy rights

13. AI Processing and Generated Content

When you use our AI image and video generation features:

Your text prompts are processed by AI models to generate images and videos. Prompts may be temporarily stored for processing.
Uploaded reference images are processed to understand content and style and are stored securely for use in your generations.
Generated images and videos are stored privately in your account.
We may use anonymized prompt patterns (without personal identifiers) to improve our content filtering and safety systems.
AI Content Labeling: We do not currently embed persistent provenance metadata (such as C2PA Content Credentials) in your generated images and videos. You remain responsible for any AI-disclosure labeling required where you publish.

13.1 Automated Content Moderation

To ensure platform safety and legal compliance, we employ automated content moderation:

Pre-Generation Scanning: Prompts are analyzed by automated systems before generation begins and may block generation if a policy violation is detected.
Post-Generation Scanning: Generated images are scanned by AI vision analysis before being stored or displayed to you, and may be blocked if they violate our policies.
Scope: Automated moderation is designed to detect illegal content (such as CSAM, non-consensual intimate imagery, and content involving minors). Adult and NSFW content that complies with our Acceptable Use Policy is permitted and is not flagged by these systems.
Violation Records: When content is flagged or blocked, we log the moderation decision, the prompt text, and the moderation category for legal compliance and platform safety.
CSAM: If our systems detect apparent child sexual abuse material, we preserve the relevant data and report it to the appropriate authorities, including NCMEC, as required by applicable law.

14. Age Verification

The Service requires age verification. We collect your date of birth once during the verification process solely to confirm that you meet the minimum age requirement (18 years old).

We store only an age-verification timestamp on your account record to indicate that verification is complete. We do not retain your date of birth after verification, and the verification is handled entirely within the Service - no data is shared with third-party age-verification providers.

15. Content Moderation and Appeals

When we take a content-moderation or enforcement action against your account, we provide the reason for the action. If you believe a moderation decision was made in error, you may appeal through our Discord appeal channel, which is also linked from the account-restriction screen.

16. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties, and we encourage you to read the privacy policies of any third-party services you use.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on the Service and updating the "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.

18. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Email: support@somalabs.studio
Community: our Discord server