Privacy Policy
AI Lab, Glam Room and AI Editing Lab
Effective date: October 26, 2026
1. Who we are
Cristina Becher, doing business as AI Lab, 1005 Claremont St, Lincoln, NE 68508, runs https://cristinalab.com and the AI Lab member app (Glam Room and AI Editing Lab). We are the "controller" of your personal data. Questions or requests: support@cristinalab.com.
This policy explains what we collect, why, who we share it with, how long we keep it, and your rights. We wrote it in plain English on purpose.
2. The most important part: your face and voice
Glam Room works by processing pictures and video of your face and recordings of your voice. We treat this as sensitive data, and in some places (for example Illinois, Texas, Washington, Colorado and the EU) a "face model" or face geometry can count as biometric data.
- We only process your face and voice after you agree to the AI and Likeness Consent in the app.
- We use them only to make your own photos and videos and to keep them in your library.
- We never sell your face, voice, face model or uploads. We never use them in marketing without your separate written OK.
- We don't train our own AI on them.
- We delete them on the schedule in section 7, or sooner when you ask.
- You can withdraw your consent any time by deleting your face model and uploads in settings or emailing support@cristinalab.com.
3. What we collect
You give us:
- Account details: name, email, password (stored scrambled) or login links, Instagram handle if you give it.
- Purchase details: what you bought, when, the price, country and postal code. Stripe handles your card. We see only the card type, last 4 digits and expiry.
- Glam Room uploads: selfies, talking clips, the audio in those clips (your voice), and the looks, prompts and settings you choose.
- Outputs: the AI photos and videos made from your uploads.
- Face model: a model or set of reference data made from your selfies so outputs keep looking like you.
- Messages: emails to support, comments and posts in community spaces, challenge submissions, survey answers.
- Instagram messages: if you comment a keyword or DM us on Instagram, our messaging tool receives your handle, your messages and the email you give us.
We collect automatically:
- Usage data: pages visited, features used, token balance and history, generation history, errors.
- Device data: IP address, browser, device type, rough location from the IP.
- Cookies: see section 9.
- Email data: whether you opened or clicked an email, so we can stop sending what isn't wanted.
AI Editing Lab: the skill runs on your own computer through your own Claude account. We don't receive the videos you edit with it. Anthropic handles that under its own privacy policy. We only know you downloaded the skill and which course videos you've opened.
4. Why we use it (and the legal basis)
| Purpose | Data | Legal basis (EU/UK) |
|---|---|---|
| Give you access to what you bought, run your account | Account, purchase, usage | Contract |
| Make your Glam Room photos and videos | Uploads, voice, face model, outputs | Your explicit consent (and contract) |
| Take payments, prevent fraud, handle chargebacks | Purchase, device | Contract, legitimate interests, legal duty |
| Send access emails, receipts, login links, service notices | Contract | |
| Send launch, challenge and offer emails | Email, purchase, tags | Consent, or legitimate interests for buyers (you can unsubscribe any time) |
| Enforce our rules (own face only, 18+, no sexual content) and keep the platform safe | Uploads, outputs, usage | Legitimate interests, legal duty |
| Fix bugs and improve the platform | Usage, device, errors | Legitimate interests |
| Keep tax and accounting records | Purchase | Legal duty |
5. Who we share it with
We share data only with service providers who help us run the platform, under contracts that limit what they can do with it:
- Stripe (payments and saved cards for the one-click offer).
- Resend (sending email).
- Hetzner Online GmbH (our servers and database).
- Hetzner Online GmbH (storing uploads and outputs, on our own servers).
- Third-party AI providers (making your photos and videos). They receive the upload, the chosen look and instructions needed for each generation and send back the result.
- Our Instagram messaging tool (our own software, working through Meta's messaging platform) when you message us on Instagram.
- Cristina Becher, the program host, may see your name, Instagram handle and community posts so she can run the challenge. She does not get your uploads or face data.
We may also share data:
- If the law requires it, or to protect people's safety (for example reporting child sexual abuse material).
- To answer a chargeback or legal claim.
- If the business is sold or reorganized. The buyer must keep this policy's promises.
We don't sell your personal data or share it for cross-context behavioral advertising.
6. Where your data goes
We and our providers may process data in the United States, the EU and other countries. When EU or UK data leaves those areas, we rely on the safeguards the law allows, such as the EU Standard Contractual Clauses or the provider's certification under the EU-US Data Privacy Framework.
7. How long we keep it
| Data | Kept for |
|---|---|
| Uploads (selfies, clips, voice) and outputs | While your account is open, or until you delete them. Deleted within 30 days after you delete them or close your account. |
| Face model and face data | Until the first of: you delete it, you close your account, 12 months with no login, or 3 years after your last use. Then deleted within 30 days. |
| Copies held by AI providers | As short as each provider allows. |
| Backups | Roll off within 14 days. |
| Account details | While your account is open, then up to 12 months. |
| Purchase and tax records | 7 years, because tax law requires it. |
| Email list | Until you unsubscribe. We then keep only your email on a "do not email" list so we never email you again. |
| Server logs | 30 days. |
8. Email marketing
- If you join a waitlist, download a freebie or comment a keyword on Instagram, we email you about the challenge and offers. If you buy, we may also email you about similar products.
- Every marketing email has an unsubscribe link that works with one click. You'll still get emails you need (receipts, access, important account notices).
- Every marketing email shows our postal address.
9. Cookies
- Needed cookies: keep you logged in, remember your checkout and keep the site secure. The site doesn't work without them.
- Preference storage: remembers small settings like your theme.
- Analytics or advertising cookies: We don't use any. If we add any, we'll ask first where the law requires (EU and UK) and update this section.
10. Your rights
Depending on where you live, you can ask us to:
- See the personal data we hold about you and get a copy.
- Correct it.
- Delete it.
- Download it in a portable format.
- Object to or limit how we use it.
- Withdraw consent (for example to face processing or marketing) at any time. This doesn't affect what we did before.
- Not be discriminated against for using your rights.
California (CCPA/CPRA): you have the rights above, including to know, delete, correct, and limit use of sensitive personal information. We use sensitive data (face, voice) only to provide the service you asked for. We don't sell or share personal data.
EU and UK (GDPR): you can also complain to your local data protection authority.
Other US states with privacy laws (for example Virginia, Colorado, Connecticut, Texas, Oregon): you have similar rights, and you can appeal if we say no by replying to our answer.
How to ask: email support@cristinalab.com from your account email. We may need to confirm it's you. We reply within 30 days (45 for California, extendable where the law allows). Most face and upload deletions you can do yourself in settings, right away.
11. Face data notice (Illinois BIPA and similar laws)
- What: a face model, and face geometry the third-party AI providers may derive, from the selfies and clips you upload.
- Why: only to make photos and videos of you that look like you.
- How long: see section 7. We permanently destroy it when the purpose is done and no later than 3 years after your last interaction with Glam Room.
- Consent: we ask for your written consent (the checkbox in the AI and Likeness Consent) before collecting any.
- Sharing: only with the third-party AI providers that make your content, with your consent, and as the law requires. We never sell, lease or trade it, or profit from it beyond providing you the service you paid for.
- Security: we protect it at least as carefully as our other sensitive data.
12. Security
We use encrypted connections (HTTPS), restricted server access, encrypted secrets, scrambled passwords, private storage for uploads and signed, expiring links for downloads. No system is perfect. If a breach affects your data, we'll tell you and the authorities as the law requires.
13. Children
The platform is for adults 18 and over. We don't knowingly collect data from anyone under 18. If we learn that we have, we delete it and close the account. If you think a child has used the platform, email support@cristinalab.com.
14. Changes
We'll update this policy when our practices change and change the date at the top. If a change is significant, we'll email you or show a notice in the app first.
15. Contact
Cristina Becher, doing business as AI Lab, 1005 Claremont St, Lincoln, NE 68508, support@cristinalab.com