PRIVACY POLICY

Last updated October 10, 2026 - Version v10

This Privacy Policy explains how Philipp Fanta, trading as Web2Labs (Einzelunternehmen) ("Web2Labs", "we", "us", "our") collects, uses, and protects personal data when you use our Site and Services. It is written to comply with the EU General Data Protection Regulation (GDPR) and the German Bundesdatenschutzgesetz (BDSG).

1. CONTROLLER

Philipp Fanta, trading as Web2Labs (Einzelunternehmen)
c/o Autorenglück #33004
Albert-Einstein-Straße 47
02977 Hoyerswerda
Germany

Email: [email protected]
Telephone: +49 6223 4240111

For privacy enquiries and requests about customer data-processing agreements, contact [email protected]. Philipp Fanta handles privacy requests personally. The controller remains responsible for responding to your request.

2. SCOPE

This Policy applies to:

• the Web2Labs Site at https://www.web2labs.com;
• the Studio product (upload, transcription, editing, rendering);
• the Materials, Drops, Skills, Profiles, Leaderboards, Networking, and Merch features;
• any native mobile or desktop applications we distribute;
• email, in-app chat, and other direct communication with us.

It does not cover third-party websites, social-media platforms your content appears on, or services whose links we display.

3. PERSONAL DATA WE PROCESS

3.1 Account data

Name, email address, passwordless sign-in records, linked sign-in provider identifiers, session records, account preferences, newsletter opt-in, feedback opt-in, accepted terms and privacy versions, the date of your 18+ declaration (and any historic age declaration), country/region (derived from IP for legal purposes), language.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(a) GDPR (consent) for optional items like newsletter.

3.2 Payment and billing data

Billing name, billing address, VAT identifier, country, transaction amount, payment method (last 4 digits and card brand only - we do not store full card numbers), invoice history.

Payments are processed by Stripe and PayPal. Full payment credentials are handled entirely by those processors; we receive only tokenized identifiers.

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR (legal obligation - tax/invoice retention under § 147 AO).

3.3 Uploaded content (Contributions)

Video, audio, images, transcripts, project metadata, render artifacts, thumbnails, and any material you upload to or create in the Services.

For account holders, processing necessary to deliver the requested service is based on Art. 6(1)(b) GDPR. When a customer determines the purpose of processing other people’s personal data in uploaded content, we process that content on documented instructions as a processor under Art. 28 GDPR. The customer must establish the applicable lawful basis and provide the required information to the people concerned; their presence in a video does not itself establish consent or a contract with us. Contact [email protected] to arrange the data-processing agreement and processing details before using Studio for that purpose.

3.4 AI processing data

Transcripts, chunked audio, filler/profanity detections, cut decisions, zoom detections, scoring signals, and other intermediate artifacts generated when Studio processes your uploads.

Legal basis: Art. 6(1)(b) GDPR. These artifacts exist only to produce your output and are deleted or archived with the project itself. We do not use them to train foundation models or resell them.

3.5 Profile and social-media data

If you list social handles on your public Web2Labs profile, we fetch and cache publicly available metrics (follower count, post count, growth rate) directly from the platforms to populate your profile, leaderboards, and creator discovery. We do not request your platform password. Separately authorised channel connections can include non-public channel analytics, as explained in Section 3.9.

Legal basis: Art. 6(1)(b) GDPR (performance of the Profile/Leaderboard features) and Art. 6(1)(f) GDPR (legitimate interest in providing discovery features) when the data relates to you as the account holder.

3.6 Leaderboard and gamification data

XP, rank, league, badges, streaks, drops received, skill progress, anti-gaming signals (rate, device fingerprint-lite, account-age features).

Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (legitimate interest in preventing cheating).

3.7 Usage and telemetry data

Necessary operational and security records include IP address, user agent, request time, errors, processing performance and security events. We process these under Art. 6(1)(f) GDPR to deliver a reliable service, investigate failures and prevent abuse; legal obligations can require particular records under Art. 6(1)(c).

Optional product analytics records include pages, clicks, device/browser information and visitor/session identifiers. These require your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG before collection. They are disabled by default, including when we cannot determine your region. See the Cookie Policy for the controls and storage inventory. Refusing optional analytics does not prevent using the service.

We also maintain daily service-activity totals for project-creation, processing-start and checkout requests, and saved analytics-consent choices. These counters use requests already needed for the service; they do not add browser tracking calls, read analytics storage, or retain an IP address, user agent, account ID, session ID, fingerprint, URL or individual request record. Each stored row contains only a UTC date, a fixed activity category and a count. Totals include repeated requests and do not identify unique visitors or connect a person's actions. We retain these totals for up to 425 days. Necessary account, payment, security and consent-evidence records are separate; these may still contain personal data and remain subject to their stated purposes, safeguards and retention rules.

3.8 Communications and feedback

Emails you send us, in-app chat messages, support tickets, and records of notices, appeals, and complaints submitted under the DSA.

When you use the private in-app feedback form, we store the feedback type and message, whether you want a reply, the reply address you provide, any founder reply and its status, and limited technical context needed to understand the report (such as the page route, browser user agent, viewport size, and a Studio project identifier when applicable). Feedback is private by default and is available only to authorized administrators. We do not publish the message or identify you publicly without separate permission.

Legal basis: Art. 6(1)(b) and (f) GDPR, and Art. 6(1)(c) GDPR for DSA-mandated record-keeping.

3.9 Platform connections and publishing

Sign-in, channel analysis and publishing are distinct uses of platform data. The permissions shown by the provider and the connection you request determine the available operations:

• Sign-in: provider account identifiers, name and email where supplied, used to identify your Web2Labs account.
• Journey/channel analysis: channel identity, uploaded-video details, public metrics and authorised channel analytics. A connected channel can be checked periodically to update your journal, milestones and statistics while the connection remains active; these reads do not require a new click for every scheduled update.
• Publishing: account/channel identifiers and permissions needed to upload your selected media, captions and related publishing details and track the result of the publishing action you request.
• Credentials: OAuth access and refresh tokens and granted scopes are stored server-side; connected-platform tokens are encrypted at rest. We do not ask for your platform password.

Discord community roles: if you link a Discord account, we receive your Discord user ID through Discord's identify permission. We use it to assign Web2Labs-managed roles on the Web2Labs Discord server that reflect your membership plan and leaderboard league, and we may announce a league promotion in that server's milestones channel with your Web2Labs username. Other members of that server can see these roles and announcements. Unlinking Discord stops future updates and removes the roles we manage. Discord operates its platform as an independent controller under its own privacy policy.

Disconnect the relevant connection in account or Journey channel settings to stop future use of its authorisation. Sign-in links and other separately authorised connections must be managed separately. You can also revoke Web2Labs access in the platform’s own permissions settings. For Google and YouTube connections, use Google’s permissions page to review and revoke Web2Labs access. Revocation does not remove content already published on that platform. To request deletion of associated personal data, contact [email protected] or use account deletion.

Platform-specific data policies:

• YouTube: Google Privacy Policy and YouTube Terms of Service. Our use of YouTube API Services is subject to the Google API Services User Data Policy.
• TikTok: TikTok Privacy Policy and TikTok Developer Terms of Service.
• X (Twitter): X Privacy Policy and Developer Agreement.
• Meta (Facebook and Instagram): Meta Privacy Policy and Meta Platform Terms. We implement Meta's Data Deletion Request callback at /api/cutter/platform/meta/data-deletion.
• LinkedIn: LinkedIn Privacy Policy and LinkedIn API Terms of Use.
• Pinterest: Pinterest Privacy Policy and Developer Terms.
• Vimeo: Vimeo Privacy Policy and Vimeo Terms of Service.

Legal basis: Art. 6(1)(b) GDPR for the connected feature you request. Where processing relies on optional consent, Art. 6(1)(a) GDPR applies and you can withdraw it. Granting a platform permission does not give us unrestricted permission to reuse your data. Our use and transfer of Google API data complies with the Google API Services User Data Policy, including its Limited Use requirements.

3.10 Cookies and local storage

See Section 10.

4. PURPOSES OF PROCESSING

We process personal data to:

• create and manage your account;
• deliver Studio, Materials, Drops, Skills, Profiles, Leaderboards, and Merch features;
• process your uploads and produce your outputs;
• publish your content to connected third-party platforms on your behalf;
• calculate rankings and prevent cheating;
• charge and refund subscriptions and purchases;
• send service and transactional emails;
• respond to your requests and DSA notices/appeals;
• keep the Services secure and detect abuse;
• improve the Services through our own analytics (no profiling for automated decisions with legal effect);
• comply with our legal obligations.

5. RECIPIENTS AND PROCESSING ROLES

Authorised personnel and service providers receive data needed for the purposes above. Hosting, storage and content-processing providers include IONOS, Google Cloud, RunPod, OpenAI, Google, Anthropic, xAI and optional audio providers. xAI's Grok models generate and rate text for Studio projects and for several free Tools. In Studio they produce project metadata (such as ratings, chapters, titles, descriptions, tags and thumbnail concepts) and recognise the type of video; in the long-form editing mode they also propose cuts, zooms, emphasised words and short clips and review an edit for coherence. They receive the transcript excerpts or segments, project metadata or text submitted for that step. Cloudflare operates the network edge in front of our website and API: it delivers content, terminates encrypted connections and filters attacks and abusive traffic. It therefore processes connection data such as your IP address, the location derived from it and request headers, and the content of requests and responses while they pass through its network. The Service providers and sub-processors list describes their functions, relevant regions and other recipients, including the support assistant and the Discord community integration.

Providers acting on our instructions require an Art. 28 GDPR agreement. Payment providers and connected social platforms may act as independent controllers for their own payment, fraud prevention, legal compliance or platform operations. Their own privacy notices apply to those operations; they are not all our sub-processors.

We disclose personal data to authorities or other recipients where required by applicable law, or where necessary to establish, exercise or defend legal claims. We do not sell your uploads or personal data.

6. INTERNATIONAL TRANSFERS

Our application database is hosted in Germany. Network delivery and security filtering, content processing, media storage, payment processing and optional connected services can involve access or processing outside the EEA, including the United States. Selecting an EU hosting region does not by itself rule out international access by a provider.

Transfers requiring a Chapter V GDPR safeguard must be covered by an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses and any necessary supplementary measures. The EU-US Data Privacy Framework applies only where the actual recipient and processing are covered by an active certification. A provider’s brand or location alone does not establish coverage. Consent to use a feature is not a substitute for the safeguards required for routine transfers.

You may request the relevant recipient, processing region and a copy or description of applicable safeguards at [email protected]. Confidential information and other people’s personal data may be redacted.

7. RETENTION

We keep personal data only for as long as we need it:

Consent and legal-request records are retained as evidence for the relevant consent, declaration and any applicable limitation period or legal obligation. Account identifiers may be removed while evidence is retained. A hash or a record with an account identifier removed can still be personal data; we do not treat this alone as irreversible anonymisation.

Scheduled erasure and backup expiry are separate processes. Where a deletion fails, it must be retried and resolved; we do not treat the failure as completed erasure. Requests for the applicable period or its determining criteria can be sent to our privacy contact.

8. YOUR RIGHTS (GDPR ART. 15–22)

You have the right to:

• Access (Art. 15): confirmation of processing and a copy of your data.
• Rectification (Art. 16): correction of inaccurate data.
• Erasure / "right to be forgotten" (Art. 17): deletion of your data, subject to legal retention obligations.
• Restriction (Art. 18): temporary halt of processing.
• Data portability (Art. 20): structured export of data you provided to us.
• Objection (Art. 21): to processing based on legitimate interest (Art. 6(1)(f)), including direct marketing.
• Withdraw consent (Art. 7(3)) at any time, without affecting the lawfulness of prior processing.
• Protection against solely automated decisions that produce legal or similarly significant effects, subject to the conditions and exceptions in Art. 22 GDPR. Anti-gaming checks use activity rates, account age and technical signals to identify suspected manipulation. The multi-account detector records evidence for review; it does not itself impose leaderboard or prize exclusions. Other security/rate controls can limit activity to prevent abuse. You can contest a decision, explain your position and request human intervention using the appeal link in the decision notice or [email protected]. An automated flag is not proof that you cheated.

To exercise a right, email [email protected]. You do not have to sign in or use a particular form. We may request proportionate information to verify identity where necessary. We respond without undue delay and within one month; for a justified extension of up to two further months, we explain the reason within the first month. An in-product download can help you access your data but does not limit the scope of an Art. 15 request, including personal data inferred about you.

Right to lodge a complaint (Art. 77 GDPR). You may complain to a supervisory authority, particularly in the EU member state of your habitual residence, place of work or the alleged infringement. Contact details are available from the European Data Protection Board’s list of supervisory authorities.

9. AI, AUTOMATED PROCESSING, AND NO-TRAINING COMMITMENT

Studio and related features use automated and AI/ML systems to process your uploads. We disclose specifically:

• No foundation-model training on your uploads. We do not use your Contributions, transcripts, cuts, captions, or project artifacts to train general-purpose or foundation AI models for resale, licensing, or any third-party benefit.
• Our own detectors. We may use aggregated, de-identified signals to tune our own detectors (e.g., filler-word detection thresholds) that run within the Services. This is a legitimate interest under Art. 6(1)(f) GDPR and does not include the personal content of your projects.
• Sub-processors. Where AI steps run on third-party infrastructure, the sub-processors are listed in Section 5 and at /legal/sub-processors.
• Accuracy. AI outputs may be inaccurate. You are responsible for reviewing outputs before publishing.
• Automated moderation. We use automated means as part of content moderation (profanity, abuse, suspected copyright issues). Automated decisions can be challenged and referred for human review; see Section 8 and the Terms of Service. This review path does not by itself establish that a solely automated significant decision is lawful.

10. COOKIES, LOCAL STORAGE, AND TRACKING

We distinguish three categories of cookies and similar technologies:

• Strictly necessary - login session, CSRF token, load-balancing. Loaded without consent (§ 25(2) TDDDG).
• Preferences - UI language, theme, volume, editor layout. Loaded without consent where tied to features you actively use.
• Analytics and third-party - if used, loaded only after you opt in through our cookie banner.

You can change your choices at any time via the "Cookies" link in the sidemenu footer.

Where advertising tags are configured, they require the corresponding optional consent. Embedded players and the support assistant require a separate choice on the relevant page. You can decline them and still use the rest of the service.

11. SECURITY

We apply appropriate technical and organizational measures to protect personal data, including:

• HTTPS for browser access and protected transport for service connections;
• encrypted connected-platform credentials and restricted access to sensitive stores;
• role-based access control and least-privilege principles;
• short-lived passwordless sign-in credentials and revocable sessions;
• regular dependency updates and monitoring;
• segregation of production and development environments;
• logged administrative access.

Protect the email account or identity provider you use to sign in, including its available multi-factor authentication, and revoke unfamiliar sessions in your account settings.

12. CHILDREN

Accounts and tool processing are available only to people aged 18 or older. We ask for an affirmative 18+ declaration; we do not collect a date of birth or identity document as part of that declaration. This is a self-declaration, not identity-based age verification. Guests can use eligible tools without an account after a separate affirmative 18+ declaration. A signed, HttpOnly first-party cookie remembers that declaration for up to 24 hours; it contains no name, date of birth or account identifier, and does not grant account access. It is necessary to provide the requested adult-only tool service (§ 25(2) TDDDG); associated personal-data processing relies on Art. 6(1)(b) GDPR. It is separate from optional analytics and marketing choices. We do not offer a parental-consent registration process.

If you believe a minor holds an account, contact [email protected]. Philipp Fanta will review the report, restrict ineligible access and arrange account closure and erasure where appropriate, subject to lawful restricted retention. We will not require an adult declaration to handle a privacy request or cancellation. The adult-account rule does not establish the age of people appearing in uploaded or publicly available content; processing that content still requires an appropriate legal basis and safeguards.

13. CHANGES TO THIS POLICY

We may update this Policy from time to time. Material changes will be brought to your attention in-product or by email as appropriate before the changed processing begins. If a change requires consent, we ask for it before processing on that basis. Acknowledging this notice does not waive your rights or substitute for optional consent. The current version and last-updated date are shown at the top.

14. CONTACT

Questions, requests, complaints:

Web2Labs
c/o Autorenglück #33004
Albert-Einstein-Straße 47
02977 Hoyerswerda, Germany
Email: [email protected]