Privacy Policy

This Privacy Policy ("Policy") applies to your use of the www.thinklab-ai.com website and ODIS, our AI-powered video creation platform, including any features, content, or applications offered by ThinkLab, Lda. ("ThinkLab", "we", "us", "our") (collectively "Platform"). By using the Platform in any manner, you agree to be bound by this Policy and ThinkLab's Terms ("Terms"). This Policy is part of, and is incorporated into, the Terms.

We will uphold the privacy of our users by fighting against ads, trackers, and other impingements on privacy. We will never profit by monetizing your data but instead seek to fulfill our company mission by delivering a great product and service.

What that means in practice, so that the sentence above is not contradicted further down this page. We run no advertising on the Platform and we are not in any advertising network. We do not track you across other websites, we set no third-party cookies, we build no advertising or cross-site identifier, and we neither sell nor share your personal information for anyone else's marketing. We do measure our own website — with cookieless analytics and with two first-party cookies that record which channel brought you here — and we do send marketing email, but only to people who have asked for it twice. All three are described in full below, by name, with their retention and their lawful basis. Every cookie this site sets is named there too, and the one our short-link provider sets when you open one of our short links is described there as well.

Our commitment to privacy and data protection is reflected in this Policy which describes how we collect and process "personal information" that identifies you, like your name or email address. Any other information besides this is "non-personal information". If we store personal information with non-personal information, we will consider that combination to be personal information.

Third-party services that we integrate with the Services are governed under their own respective privacy policies.

The controller of the personal data described in this Policy — the party that decides why and how it is processed — is:

Firm

ThinkLab, Lda.

NIPC / VAT number

518707946 (PT518707946)

Registered office

Rua das Rodas, n.º 557, Hab. 42, 4740-331 Esposende, Portugal

Share capital

€6,900.00

Incorporated

22 March 2025

Activity (CAE)

62100 — computer programming activities

Email

general@thinklab-ai.com

That address reaches us for general correspondence. To exercise any of the rights set out below, or for anything else about how we handle your personal data, write to privacy@thinklab-ai.com, which is read by named people at ThinkLab. We have not appointed a Data Protection Officer: we are not a public authority, our core activity is not large-scale monitoring, and we do not process special categories of data at scale, so Article 37 GDPR does not require one.

We collect information about you when you directly provide it to us. We collect your name and contact information, including your email address, as part of account creation. If you use paid features of ODIS, we collect payment information through our secure payment processor. When you use ODIS, we collect the inputs, prompts, and content you provide to create videos, including text, images, and other materials you upload.

We collect information about you automatically through our Platform. When you visit our website or use ODIS, our servers log your Internet Protocol (IP) address and information about your device, including device identifiers, device type, operating system, browser, and usage patterns. We collect analytics data about how you interact with ODIS, including features used, videos created, and session duration. Separately, we measure our public website and record which channel brought you to it — that is described in full under Analytics, cookies and attribution below.

We collect information about you when someone else tells us such information. We may collect information about you from third-party authentication services, payment processors, or other services you choose to connect with ODIS.

Website analytics — Plausible. Our website analytics run on Plausible Analytics, hosted in the European Union. Plausible sets no cookie, stores no personal data, and builds no identifier that could follow you to another website. To count a visit as unique it receives your IP address and browser user agent, derives a daily-rotating salted hash from them, and discards the IP address. To the extent that handling amounts to processing of your personal data, we rely on our legitimate interest (Article 6(1)(f) GDPR) in understanding how our website is used. Because Plausible stores no personal data, there is nothing about you for it to retain.

Attribution cookies. We set two first-party cookies on thinklab-ai.com so that we can tell which channel brought somebody to us:

• tl_first_touch — written once, on the first visit that carries campaign parameters, and not overwritten afterwards.
• tl_last_touch — written on every visit that carries campaign parameters, overwriting the previous value.

Each one holds the same short record: the campaign parameters in the link you followed (utm_source, utm_medium, utm_campaign, utm_content), the referring page, the page you landed on, and a timestamp. Both are first-party, both are set with SameSite=Lax, and both expire 90 days after they are set. They are not extended and not refreshed beyond the last-touch overwrite.

They contain no name, no email address, no IP address, no device fingerprint, no cross-site identifier and no advertising identifier. No advertising network or data broker is anywhere in this chain, and we do not permit any third-party script on our site to read their values — an undertaking we hold ourselves to, since a cookie readable by our own pages is technically readable by anything we choose to load onto them.

Purpose and lawful basis. The purpose is channel measurement: knowing which channel produced a signup. The lawful basis is our legitimate interest under Article 6(1)(f) GDPR, assessed in a written Legitimate Interest Assessment that we keep and review. If you submit our waitlist form, the values are carried with your submission and stored alongside your email address — at that point they are linked to you, and we treat them as personal data rather than as anonymous statistics.

The cookie we set when you log in. If you log in, we set account_name so that the site can greet you by your account name. It is first-party, lasts up to a year, and is cleared when you log out. It plays no part in analytics, attribution or marketing. Your light-or-dark preference is kept in your browser's local storage rather than in a cookie. Those two, plus the two attribution cookies above, are everything this site stores on your device, apart from the short-link cookie described next.

Our short links. Most campaign links we share start with go.thinklab-ai.com and are run by our short-link and click-measurement provider. When you open one, that provider sets a single cookie on go.thinklab-ai.com. It holds a random identifier, lasts one hour, and is sent back only when that same link is opened again, never to thinklab-ai.com. It exists so that opening the same link twice within the hour counts as one click. We do not connect it to your email address or your waitlist record, and it is used for nothing else. The provider sets it on every short link and it cannot be switched off, but blocking it does not stop the link working. Measuring the click serves the same channel-measurement purpose as the attribution cookies, on the same basis: our legitimate interest.

You can clear or block these cookies in your browser at any time and the site keeps working: nothing you use depends on them. You can also object to this processing — see Your right to object below.

Every marketing email we send runs on your consent — Article 6(1)(a) GDPR — and on nothing else. We do not send marketing email on the basis of a legitimate interest.

Consent is double opt-in. Our waitlist form tells you, right above its submit button, that joining means we will email you a link to confirm your place and then occasional updates about ODIS. When you submit it, we email you that confirmation link. Until you click that link, you receive no marketing email from us. We record the moment you gave consent and the moment you confirmed it, so that we can show consent existed.

Withdrawing consent is as easy as giving it (Article 7(3) GDPR). Every marketing email carries a one-click unsubscribe link, and you can withdraw at any time by writing to privacy@thinklab-ai.com. Withdrawal stops every marketing send immediately and permanently. Withdrawing consent is not the same request as asking us to erase your data: on its own it stops the sending and leaves the business-contact record described below in place. If you want the record removed as well, say so and we will treat it as an erasure request.

Service and transactional messages — a password reset, a security notice, something you asked us to send you — are not marketing and do not depend on this consent.

We keep a business-contact record — a CRM record — for the people who join our waitlist, contact us, or whom we approach in a business capacity. In substance it holds: your email address, your name and role or job title where we know them, the company and company domain inferred from a corporate email address, an inferred business segment with a confidence score, the stage of our relationship and how it has changed, the channel you first arrived through and the channel you most recently arrived through, any source you told us about yourself, your country and language, and any referral link between your record and another.

We collect and infer no special-category data — nothing about health, beliefs, politics, ethnicity, sex life or trade-union membership — and no field in the record is designed to reveal any.

The lawful basis for keeping this record is our legitimate interest under Article 6(1)(f) GDPR in administering our business relationships and measuring which acquisition channels work. That is a separate basis from the consent above, and it does not authorise sending you marketing email. We also keep a short exclusion list of organisations we will not contact, on the same basis, so that we do not cut across an existing relationship — being on it means we contact you less, not more.

The following rights are granted under the European General Data Protection Regulation ("GDPR") and California Consumer Privacy Act ("CCPA"), and ThinkLab applies these rights to all users of our products, regardless of location: (i) the right to know what personal information we collect from you; (ii) the right to know if your personal information is being shared and to whom; (iii) the right to access your personal information; and (iv) the right to exercise your privacy rights without being discriminated against.

Under the GDPR, EEA, UK, and Swiss users have the following rights in full: access to your personal data (Article 15), including the right to be told where we obtained it if it did not come from you; correction of data that is wrong (Article 16); erasure (Article 17); restriction of processing (Article 18); portability of the data you gave us on the basis of consent (Article 20); withdrawal of consent to marketing email at any time (Article 7(3)); and the right to object described separately in the next section.

How to exercise them, and how long we take. Write to privacy@thinklab-ai.com. We answer within one calendar month of receiving your request (Article 12(3) GDPR). Where a request is unusually complex we may extend that by up to two further months, and if we do, we will tell you and give our reasons inside the original month. We may ask you for enough information to be sure the request is yours — enough to avoid handing one person's data to another, and no more.

If you are not satisfied, you have the right to lodge a complaint with your local data protection authority. Ours is the Portuguese Comissão Nacional de Proteção de Dados (CNPD), and you may complain to it, or to the supervisory authority where you live or work, at any time.

California Users: Under the CCPA, California residents have additional rights, including: (i) the right to request personal information to be deleted; (ii) the right to opt-out of the sale of personal information; and (iii) the right to designate an authorized agent to make requests on your behalf. We do not sell personal information.