Privacy Policy
Last updated: October 16, 2026
1. Who we are
LabelOp is run by an individual operator, not a company. The operator is responsible for the personal data described here (the data controller). You can reach us at [email protected].
2. What we collect
- Account data: name, email, sign-in details, and workspace membership.
- Your content: images, annotations, labels, and model outputs you upload or create.
- Usage and security data: server logs, IP address, browser details, and product usage events.
- Billing data: subscription status and invoice references from Polar. We never see or store your full card number.
- Vast.ai credential: stored encrypted, only if you connect it.
- Support messages you send us.
3. Why we use it
We use this data to run the service and the features you request, keep accounts secure, prevent abuse, enforce plan limits, handle billing, send service emails, and meet legal obligations. Our legal bases are performing our agreement with you, our legitimate interest in running a secure service, legal obligations, and your consent where the law requires it.
We do not sell personal data, do not use it for advertising, and do not use your content to train AI models.
4. Personal data inside your content
If your uploads contain other people's personal data, we process it only to provide the service to you. You decide what to upload and why, and you are responsible for having a legal basis and for handling requests from those people.
5. AI in your browser and free tools
Local models, including models you add yourself, run in your browser, so the images they analyze are not sent to us. To run them, your browser downloads model files from Hugging Face and the runtime from jsDelivr, which can see your IP address.
Some free tools run entirely in your browser. Others send the file you choose to our server, where it is processed in memory to produce the result and is not stored.
6. Service providers
We share data only with providers that help run LabelOp:
- Hosting and database providers that store accounts, projects, and uploads.
- Cloudflare for AI inference, R2 file storage, and Turnstile bot checks on sign-in, sign-up, and password reset.
- Google or GitHub, if you choose to sign in with them.
- Resend for account, invitation, and service emails.
- Polar for checkout, subscriptions, invoices, and taxes.
- Vast.ai, only when you connect your own account and start training.
- Hugging Face and jsDelivr, which serve model files and the runtime for local AI.
We may also disclose data when the law requires it, to protect our rights, or to a successor if the service is transferred.
7. Cookies and analytics
We use only the cookies needed to keep you signed in and secure. We do not use advertising or tracking cookies. Product analytics run on a self-hosted Umami instance that does not use cookies, and it is turned off when your browser sends Do Not Track.
8. How long we keep data
- Account data and your content: while your account is active. Deleting your account from Settings removes them, apart from short-lived backups and records we must keep by law.
- Inactive accounts: after 45 days without a sign-in we may send a warning email; after 60 days, projects, images, and training results may be removed. Nothing is removed unless the warning was delivered.
- Product usage events: up to 90 days. Billing records are kept as long as tax and accounting rules require.
9. International transfers
Our providers may process data outside your country, including in the United States and the European Union. Where the law requires it, we rely on safeguards such as standard contractual clauses offered by those providers.
10. Your rights
Depending on where you live, you can ask to access, correct, delete, or export your personal data, and to object to or restrict how we use it. This includes rights under the GDPR, UK GDPR, Turkish Law No. 6698 (KVKK), and similar laws. Email [email protected]; we may need to confirm your identity first. You can also complain to your local data protection authority.
11. Security
We use encryption in transit, encrypted storage for credentials, and access controls. No system is perfectly secure, so we cannot guarantee absolute security.
12. Children
LabelOp is not for people under 18, and we do not knowingly collect their data.
13. Changes
We will post updates here with a new date and notify you by email or in the app about material changes.