Privacy Policy

The controller of personal data processing is CRISTIANO V. SRL, with registered office at Via Starza 113, 81036 San Cipriano d'Aversa (CE), Italy, VAT no. 03925530614, reachable at privacy@showlab.ai or by certified email cristianov@legalmail.it.

• Registration data: email address, display name, preferred language.
• Payment data: handled entirely by Stripe; showlab receives only the Stripe customer ID, the subscription status and the Credit quota, NEVER the card number or banking details.
• Uploaded content: product photos and briefs provided by the User for generation.
• Generated outputs: images, videos and texts produced by the AI at the User's request.
• Technical logs: IP addresses, user agent, request timestamps, for security and diagnostic purposes.

• Provision of the Service (art. 6.1.b GDPR — performance of the contract): content generation, Credit and Library management.
• Billing management (art. 6.1.c GDPR — legal obligation): issuing invoices and tax retention.
• Security (art. 6.1.f GDPR — legitimate interest): protection against fraud and abuse.
• Service communications (art. 6.1.b): transactional email confirmations, quota and expiry notices. These are not marketing activities.
• Assistance and support (art. 6.1.b — performance of the contract / 6.1.f — legitimate interest): handling requests sent through the support chat and by email.
• Marketing (art. 6.1.a — consent): only if explicitly given, always revocable.

The content uploaded by the User is transmitted to the artificial intelligence providers (Google Gemini and OpenAI for photos; Replicate/Kling for videos, with Google Veo as backup engine) only for the time necessary for the requested generation. The full list of providers is in point 7. In relation to such processing showlab acts as Controller and the AI providers act as processors (sub-processors) pursuant to art. 28 GDPR. A Data Processing Agreement is available on request for professional customers.

showlab does NOT use the User's content to train its own or third-party artificial intelligence models beyond the execution of the specific request.

Account data and Library content are retained for the entire duration of the subscription. Upon termination they remain accessible for 60 days for export purposes and are then deleted, save for tax retention obligations (10 years for invoices, art. 2220 of the Italian Civil Code) and pending disputes. Technical logs are retained for 12 months.

The User may at any time exercise the rights provided by arts. 15-22 GDPR: access, rectification, erasure, restriction, portability, objection to processing and, for marketing, withdrawal of consent. Requests should be sent to privacy@showlab.ai. Reply within 30 days. If no reply is received or the reply is unsatisfactory, the User may lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).

To provide the Service, showlab relies on the following suppliers, which process data as processors or sub-processors pursuant to art. 28 GDPR, each bound by a specific agreement. Account data and files (uploads and Outputs) are stored permanently in the European Union (Ireland); AI processing involves only a temporary transmission, limited to the individual request.

An up-to-date list of sub-processors is available on request at privacy@showlab.ai; material changes are communicated to professional customers in accordance with the art. 28 GDPR DPA.

The application infrastructure (Vercel) and the AI providers may involve transfers of personal data outside the EEA. Such transfers take place on the basis of the Standard Contractual Clauses adopted by the EU Commission and, where applicable, the adequacy frameworks in force (e.g. the EU-US Data Privacy Framework).

The Service uses essential technical cookies for its operation (session, authentication, language). There are no third-party profiling cookies. Any activation of anonymous aggregate analytics will be preceded by a dedicated notice.

The Service is aimed at adults acting for professional purposes. We do not knowingly process data of minors. If a parent or guardian believes that a minor has provided personal data, they may write to privacy@showlab.ai and we will proceed with deletion.

showlab does not take decisions based solely on automated processing producing legal effects or similarly significantly affecting the User pursuant to art. 22 GDPR. Content generation takes place upon the User's input and request and does not involve profiling with such effects.

In the event of a personal data breach, showlab adopts the measures provided by arts. 33 and 34 GDPR: notification to the Italian Data Protection Authority within 72 hours where the conditions are met, and communication to data subjects without undue delay where the breach presents a high risk to their rights and freedoms.