GDPR · Data Processing Addendum.

Last updated 19 October 2026

This Data Processing Addendum (“DPA”) is part of the Terms of Service (the “Agreement”) between LensLabs LLC (“LensLab”), the company that operates lenslab.dev, and the customer who uses Heavenly (the video product at lenslab.dev/heavenly). Capitalized terms not defined here have the meaning in the Agreement. Questions: hello@lenslab.dev.

1. What this addendum is

Video shows and records people. When a customer brings footage, captions, team members or an audience into Heavenly, the customer is handing LensLab personal data about people other than themselves. Data protection laws require a written agreement for that. This DPA is that agreement. It applies automatically to every customer: nothing needs to be signed. A customer who needs a countersigned copy can ask for one at hello@lenslab.dev.

The Privacy Policy describes, feature by feature, what Heavenly does with data. This DPA sets out the legal commitments that go with it.

2. Definitions

“Customer Data” means personal data LensLab processes on the customer’s behalf through Heavenly, as described in Annex A.

“Data Protection Laws” means laws that apply to that processing, including the GDPR, UK GDPR and Data Protection Act 2018, the Swiss Federal Data Protection Act, the CCPA, PIPEDA, Brazil’s LGPD, and the Australian Privacy Act 1988, where they apply.

“Security Incident” means unauthorized access to, or accidental or unlawful loss, destruction, alteration or disclosure of, Customer Data on systems LensLab manages.

“Sub-processor” means a third party LensLab engages to process Customer Data in order to run the Service. It does not include LensLab staff.

“Sensitive Data” means government IDs, full payment-card numbers, health or biometric data, passwords, or special categories of data under GDPR. Do not send those to Heavenly on purpose. Footage may show people; the customer is responsible for that content.

“Standard Contractual Clauses” or “SCCs” means the clauses approved by European Commission Implementing Decision (EU) 2021/914.

“Controller”, “processor”, “personal data”, “processing” and “data subject” have the meanings given in the GDPR, and include the equivalent terms in other Data Protection Laws (for example “business” and “service provider” under the CCPA).

3. Roles

For Customer Data processed to run Heavenly for the customer, LensLab is a processor and the customer is the controller (or a processor for their own client). This DPA does not cover processing where LensLab is the controller, such as the public site, the account holder’s own account details, billing records LensLab keeps as a merchant, or optional analytics after cookie Accept. Those sit in the Privacy Policy.

If the customer acts as a processor for someone else, the customer confirms that its instructions to LensLab, including the use of the Sub-processors in section 9, have been authorized by that controller.

4. What LensLab does with Customer Data

LensLab processes Customer Data only to provide Heavenly as configured by the customer, to follow documented instructions in the Agreement, or to comply with law. The Agreement, this DPA, and what the customer does in the product (dropping a file, pasting a link, scheduling a post, connecting an account, inviting a teammate) are the customer’s complete instructions.

Heavenly cuts footage in the browser. A file is uploaded to LensLab’s storage and media service when the customer exports it, clips it, posts it, or asks Heavenly to watch and listen to it, and its sound, sampled stills, and transcript go to Google Gemini, and for Clips to Groq (and to Deepgram when Groq can’t), to transcribe and understand it. A sound effect the customer describes on the editor’s soundboard is made by ElevenLabs from that description alone.

LensLab will not:

• sell Customer Data, or share it for advertising;
• use Customer Data to train a model shared with other customers;
• combine Customer Data with data from other customers, except in totals that no longer relate to a person; or
• use Customer Data for any purpose of its own beyond running and securing Heavenly.

If LensLab believes an instruction breaks a Data Protection Law, it will tell the customer and may hold the instruction until the customer confirms or changes it. If a law requires LensLab to process Customer Data in a way the customer has not instructed, LensLab will tell the customer first, unless that law forbids it.

5. The customer’s responsibilities

The customer warrants they have the rights and notices needed for LensLab to process Customer Data as described here, including people who appear in footage. In particular the customer is responsible for:

• having a lawful basis for the personal data in what they upload, clip, caption or post;
• telling the people involved where the law requires it;
• choosing which optional features to switch on, such as footage understanding;
• deciding which networks to connect and what to post to them;
• not sending Sensitive Data on purpose; and
• the account credentials, API tokens and team members they control, and their own copies of the footage.

6. People who handle Customer Data

LensLab limits access to Customer Data to people who need it to run, secure or support Heavenly, and binds them to confidentiality. People at LensLab do not open a customer’s footage, chats or projects unless the customer asks for support that requires it, it is needed to investigate a security or abuse problem, or the law requires it.

7. Security

LensLab uses TLS on lenslab.dev, hashed passwords held by its sign-in provider, signed-in sessions checked on the server, and access controls on the Worker. Uploaded footage and renders sit in private storage, reached by the customer’s signed-in account or through signed links that expire. Social tokens are encrypted with AES-256-GCM. Stripe handles card data; LensLab does not store full card numbers. Annex B lists the measures in full.

LensLab does not claim a named third-party audit report on this page. Security measures change as the service does, without lowering the overall protection described here.

The customer is responsible for account credentials, for what they upload or drop, and for keeping their own copies of footage.

8. Security incidents

If LensLab becomes aware of a Security Incident, it will email the account contact without undue delay, and where feasible within 48 hours, with what it knows and what it is doing. That notice is not an admission of fault.

The notice will say, as far as LensLab knows at the time:

• what happened and when;
• which kinds of Customer Data and roughly how many people or records are affected;
• what the likely consequences are;
• what LensLab has done and plans to do to contain and fix it; and
• who to contact.

LensLab will send updates as it learns more and will give the customer the information the customer reasonably needs to notify regulators or the people affected. A failed sign-in attempt, a blocked scan or another event that does not compromise Customer Data is not a Security Incident.

9. Sub-processors

The customer gives LensLab a general authorization to use Sub-processors. LensLab currently uses:

Social network tokens the customer connects are encrypted before LensLab stores them, and are used only to post what the customer schedules and to read the account details, the performance figures of posts Heavenly made, and the YouTube revenue the customer allows. Footage reaches a Sub-processor only for the work in section 4.

The social networks and other destinations a customer connects are not Sub-processors. LensLab sends them content because the customer instructs it to, and each handles that content as its own controller under its own terms. The same is true of an outside tool the customer connects through the API or the connector, and of the customer’s own Dropbox or Google Drive, from which LensLab fetches only a file the customer picks and to which only a clip the customer saves there is sent. PostHog, Sendblue and Cloudflare’s email service handle data for which LensLab is the controller, as the Privacy Policy describes, not Customer Data.

LensLab will put written data-protection terms on Sub-processors that match this DPA for the work they do, and remains responsible for that work. This page is updated before a new Sub-processor starts handling Customer Data. Email hello@lenslab.dev to be told before a new Sub-processor is added. A customer may object to a new Sub-processor on reasonable data protection grounds within five days of notice. LensLab and the customer will then look for a workable alternative; if there is none, the customer may stop the affected part of the Service, or end the plan and receive back the unused part of what was prepaid.

10. International transfers

lenslab.dev runs on Cloudflare; footage work runs on Google Cloud, the Gemini API, Groq and Deepgram, sound effects on ElevenLabs, and sign-in and storage on Supabase. Customer Data may be processed in the United States and other regions where these providers or Stripe operate. Where GDPR, UK, or Swiss law requires a transfer tool, LensLab uses Standard Contractual Clauses or another lawful mechanism. Ask hello@lenslab.dev for a copy.

Where a transfer of Customer Data from the customer to LensLab needs the SCCs, they are incorporated into this DPA and apply as follows:

• Module Two (controller to processor) applies where the customer is a controller, and Module Three (processor to processor) where the customer is a processor.
• The optional docking clause (Clause 7) does not apply.
• For Clause 9, Option 2 (general written authorization) applies, with the notice in section 9 of this DPA.
• The optional wording in Clause 11 does not apply.
• For Clauses 17 and 18, the SCCs are governed by the law of Ireland, and disputes about them are heard by the courts of Ireland.
• Annex I of the SCCs is completed by Annex A of this DPA and the parties’ details in the Agreement; the competent supervisory authority is the one for the customer’s establishment in the EEA, or otherwise Ireland’s. Annex II is completed by Annex B. Annex III is the list in section 9.

For transfers from the United Kingdom, the UK International Data Transfer Addendum to the SCCs applies, completed with the same information. For transfers from Switzerland, the SCCs apply with references to the GDPR read as references to the Swiss Federal Data Protection Act, and the Swiss Federal Data Protection and Information Commissioner as the supervisory authority.

If a public authority asks LensLab for Customer Data, LensLab will check that the request is lawful, try to redirect the authority to the customer, tell the customer unless the law forbids it, and disclose only the minimum the request lawfully requires.

11. Help with requests and assessments

The customer can access, correct, export, or delete much of their workspace from the product. For the rest, email hello@lenslab.dev with the subject “Privacy rights”. If a person contacts LensLab about Customer Data, LensLab will point them to the customer unless law requires a direct reply.

Taking into account what LensLab actually knows about the processing, LensLab will give the customer reasonable help with a data protection impact assessment, and with a prior consultation with a regulator, where a Data Protection Law requires the customer to carry one out because of its use of Heavenly.

12. Information and audits

On written request to hello@lenslab.dev, LensLab will provide information reasonably needed to show compliance with this DPA, no more than once per calendar year unless a Security Incident or a regulator requires more. LensLab does not publish third-party audit reports it does not have.

If that information is not enough for the customer to meet an audit obligation under a Data Protection Law, LensLab will allow an audit by the customer or an independent auditor bound to confidentiality, on reasonable notice, during working hours, at the customer’s cost, and limited to what is needed to check compliance with this DPA. An audit does not include access to other customers’ data or to anything that would weaken security.

13. Return or deletion

When the account ends, LensLab deletes Customer Data it holds within 30 days, except records the law requires (for example billing) and backups that are isolated until they expire. Footage on the customer’s machine is the customer’s to keep or erase. A written confirmation of deletion is available on request.

Before the account ends, the customer can download renders, edit lists and transcripts from the product, and can ask LensLab for a copy of other Customer Data. Posts already published to a network stay on that network until the customer removes them there. What the customer posted on the feedback board, and edits made inside another customer’s team project, are not removed with the account, as the Privacy Policy explains.

14. California, Canada, Europe, the UK and Switzerland

Where CCPA applies, LensLab acts as a service provider: it does not sell or share Customer Data for cross-context advertising, and it only processes it for the Service. LensLab will not keep, use or disclose Customer Data outside its direct business relationship with the customer, will tell the customer if it can no longer meet its obligations under the CCPA, and lets the customer take reasonable steps to stop and fix unauthorized use.

Where PIPEDA applies, Sub-processors are under written terms substantially like this DPA.

EEA, UK, and Swiss customers may object to a new Sub-processor within five days of notice; if there is no workable path, they may stop the affected part of the Service. Section 10 sets out the transfer terms for those customers.

15. Liability and the Agreement

Liability under this DPA follows the limits in the Terms, except where Data Protection Laws do not allow a limit on an individual’s rights. If this DPA and the Terms conflict, Standard Contractual Clauses (where they apply) win, then this DPA, then the Terms.

16. Term and changes

This DPA lasts as long as LensLab processes Customer Data for the customer. LensLab may update it when the service, the Sub-processors or the law change. An update that reduces the protection of Customer Data takes effect only after notice to the customer by email or in the app.

17. Contact

LensLabs LLC · Heavenly · lenslab.dev · hello@lenslab.dev

18. Annex A: details of the processing

The parties. The data exporter is the customer, at the contact details on its account. The data importer is LensLabs LLC, United States, contact hello@lenslab.dev.

Data subjects. People who hold a LensLab account and use Heavenly on the customer’s team, and people who appear or are heard in footage the customer drops, or are named in captions the customer writes.

Personal data. Footage, sound, transcripts, captions, and renders the customer uploads, clips, exports, or posts, and whatever they show or say about people; chat messages; the names, email addresses and roles of team members the customer invites; encrypted tokens, account ids, and names for connected social networks, and the posts the customer schedules; YouTube revenue totals if the customer allows it; and, if the customer connects their Stripe account, its id, or a restricted key encrypted at rest, and the amount, time and currency of sales made through the customer’s tracked links. The customer decides what they drop or publish.

Sensitive data. LensLab does not ask for Sensitive Data. Do not upload it on purpose. Footage can incidentally reveal such information about the people in it; the customer decides whether to use that footage.

Nature and purpose. Cut footage, transcribe and caption it, find clips, render exports, and post to the social accounts the customer connects, when the customer schedules it. This involves storing, copying, transcoding, analyzing with AI models, and transmitting the data.

Frequency and duration. Processing is continuous while the account is open, then as in section 13.

Sub-processors. As listed in section 9, for the work described there, for as long as the account is open.

19. Annex B: security measures

• Encryption in transit. All traffic to lenslab.dev and between LensLab’s services uses TLS.
• Encryption of credentials. Tokens and keys for connected accounts and destinations are encrypted with AES-256-GCM and bound to the owning account before they are stored. API tokens, connector tokens and invite links are stored only as one-way hashes. Passwords are hashed by the sign-in provider.
• Access control. Every request to Heavenly’s services is checked against the signed-in session on the server. Database queries are scoped to the owning account. Team roles (admin, editor, viewer) and project scope limit what a member can open.
• Private storage. Uploads, renders and post media sit in private storage. The media service and the networks reach them only through signed links that expire within minutes or hours.
• Separation of duties between services. The media service uses its own service credential, accepts only an allowed list of request headers, and requires HTTPS.
• Payment data. Card data is entered on Stripe’s own pages. Messages from Stripe are verified by signature.
• Abuse controls. Rate limits on chat, transcription, Help messages and automated calls; a daily limit on API calls that spend credits; a bot check on sign-up.
• Browser protections. A content security policy, protection against the site being framed by other sites, and restricted browser permissions.
• Data minimization. Requests to the AI model provider are sent with storage turned off. Processing traces hold codes and numbers, not content, and expire. Analytics are off unless the visitor accepts.
• Deletion. Account deletion removes Customer Data from each store, and a store that fails to clear is flagged for manual removal.