Privacy Policy

LensLab, Lange Kleiweg 62, 2288 GK Rijswijk, the Netherlands (Chamber of Commerce no. 98869086), is responsible (the “controller”) for the personal data processed through lenslab.tech and our related websites. Questions about privacy: hello@lenslab.nl.

• Account data: your name, email address, the organisation you belong to, your role and login details.
• Brand data: your website address and the public content of that website, social media profile links, logos and images you upload, and the Brand DNA analysis we create from them.
• Product data: SKUs, categories, product names, product URLs and briefings you add or import (by hand, from a CSV file, a Google Sheet or your own webshop).
• Requests and visuals: briefings, reference images, the visuals we create for you and your choices on them (accepted, declined, revision).
• Dealer data: when a client invites a dealer: the dealer's company name and email address, which products are shared with them and which visuals they download.
• Connected social accounts: see section 4.
• Billing data: your plan, credit balance and payment status. Payments are handled by Stripe; we don't receive or store your card details.
• Technical data: log data such as IP address, browser type and the time of requests, and cookies needed to keep you logged in.

• To provide the service you signed up for: your account, Brand DNA analysis, visual production, product catalogue, dealer sharing and social posting (performance of a contract).
• To send service emails, such as invitations, login links and notifications about your requests (performance of a contract).
• To handle payments and meet our legal obligations, such as keeping financial records (legal obligation).
• To keep the platform secure and improve it (legitimate interest).
• To publish posts on the social media accounts you connect, only when you ask us to (your consent, which you can withdraw at any time by disconnecting the account).

We don't sell personal data and we don't use your data for advertising.

You can connect your Facebook Pages and linked Instagram business accounts to LensLab to publish product visuals. When you do, and only with your permission in Meta's login screen, we receive and store:

• the ID, name and profile picture of the Facebook Pages you manage and of the Instagram business accounts linked to them;
• an access token for each Page, which we store encrypted and use only to publish the posts you create in LensLab;
• for each post you publish: the visual, the caption, the post ID and link, and whether publishing succeeded.

We use the permissions pages_show_list, pages_read_engagement, pages_manage_posts, business_management, instagram_basic and instagram_content_publishonly to list your Pages and accounts and publish the posts you choose. We don't read your messages, followers or other people's content, and we don't post anything you didn't ask us to post.

You can disconnect an account at any time under Settings → Social accounts; we then delete its access token straight away. You can also remove LensLab in your Facebook settings under Business integrations. See our data deletion instructions.

You can import your own visuals from Google Drive. LensLab uses Google's file picker with the drive.filepermission: we can only access the files you pick yourself, never the rest of your Drive. We copy the picked files into your LensLab account so they stay available for your products and dealers. The temporary Google access token is used only for that copy and is not stored. LensLab's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use trusted service providers that process data on our behalf, under a data processing agreement:

• Supabase: database, login and file storage;
• Vercel: hosting of the platform;
• Anthropic (Claude): analysis of brand identity and writing captions;
• fal.ai: generating images;
• Resend: sending emails;
• Stripe: payments;
• Meta: publishing to the Facebook and Instagram accounts you connect;
• Google: importing the Google Drive files you pick.

Within LensLab, product information and approved visuals are shared with dealers only when the client who owns them chooses to share them. Some providers process data outside the European Economic Area; in that case we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

• Account, brand, product and visual data: for as long as your account is active. After you close your account we delete it within 30 days, except where we must keep it longer by law.
• Social media access tokens: until you disconnect the account, or when your LensLab account is closed.
• Financial records: 7 years, as required by Dutch tax law.

The platform uses only cookies that are necessary to keep you logged in and make it work. Our marketing pages may use a visitor tracking script from lemlist to understand which companies visit our website.

We protect data with encryption in transit and at rest, access controls per organisation, and encryption of social media access tokens. Only people who need access for their work have it.

You have the right to access, correct, delete or export your personal data, to object to or restrict its processing, and to withdraw consent at any time. Email hello@lenslab.nland we'll respond within one month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We may update this policy. We'll post the new version here and, for significant changes, let you know by email.