Last updated 21 September 2026
This Data Processing Addendum (“DPA”) is part of the Terms of Service (the “Agreement”) between LensLab, the company that operates lenslab.dev, and the customer who uses Daydreamers (the photography workspace at lenslab.dev/daydreamers). Capitalized terms not defined here have the meaning in the Agreement. Questions: hello@lenslab.dev.
1. Definitions
“Customer Data” means personal data LensLab processes on the customer’s behalf through Daydreamers, as described in Annex A.
“Data Protection Laws” means laws that apply to that processing, including the GDPR, UK GDPR and Data Protection Act 2018, the Swiss Federal Data Protection Act, the CCPA, PIPEDA, Brazil’s LGPD, and the Australian Privacy Act 1988, where they apply.
“Security Incident” means unauthorized access to, or accidental or unlawful loss of, Customer Data on systems LensLab manages.
“Sub-processor” means a third party LensLab engages to process Customer Data in order to run the Service. It does not include LensLab staff.
“Sensitive Data” means government IDs, full payment-card numbers, health or biometric data, passwords, or special categories of data under GDPR. Do not send those to Daydreamers on purpose. Photographs and footage may show people; the customer is responsible for that content.
2. Roles
For Customer Data processed to run Daydreamers for the customer, LensLab is a processor and the customer is the controller (or a processor for their own client). This DPA does not cover processing where LensLab is the controller, such as the public site, billing records LensLab keeps as a merchant, or optional analytics after cookie Accept — those sit in the Privacy Policy.
LensLab processes Customer Data only to provide Daydreamers as configured by the customer, to follow documented instructions in the Agreement, or to comply with law.
Original photographs stay on the machine you use unless you choose to publish a gallery or connect a service that sends copies.
The customer warrants they have the rights and notices needed for LensLab to process Customer Data as described here, including people who appear in photographs or footage.
3. Sub-processors
LensLab currently uses:
- Cloudflare — host, CDN, and bot check (Turnstile) for lenslab.dev.
- Stripe — paid plans and invoices.
Social network logins are not held by Daydreamers as a publisher. Connect tokens the customer pastes are stored on the device, encrypted. Footage and original photographs are not handed to a Sub-processor to “run the cut” or the cull.
LensLab will put written data-protection terms on Sub-processors that match this DPA for the work they do, and remains responsible for that work. Email hello@lenslab.dev to be told before a new Sub-processor is added.
4. Security
LensLab uses TLS on lenslab.dev, hashed passwords, account session cookies, and access controls on the Worker. Original photographs stay on the machine you use unless you choose to publish a gallery or connect a service that sends copies. Local social records use on-device encryption. Stripe handles card data; LensLab does not store full card numbers.
LensLab does not claim a named third-party audit report on this page. Security measures change as the service does, without lowering the overall protection described here.
If LensLab becomes aware of a Security Incident, it will email the account contact without undue delay — and where feasible within 48 hours — with what it knows and what it is doing. That notice is not an admission of fault.
The customer is responsible for account credentials, for what they upload or drop, and for keeping their own copies of originals and footage.
5. Information and audits
On written request to hello@lenslab.dev, LensLab will provide information reasonably needed to show compliance with this DPA, no more than once per calendar year unless a Security Incident or a regulator requires more. LensLab does not publish third-party audit reports it does not have.
6. International transfers
lenslab.dev runs on Cloudflare. Customer Data that leaves the device may be processed in the United States and other regions where Cloudflare or Stripe operate. Where GDPR, UK, or Swiss law requires a transfer tool, LensLab uses Standard Contractual Clauses or another lawful mechanism. Ask hello@lenslab.dev for a copy.
7. Return or deletion
When the account ends, LensLab deletes Customer Data it holds within 30 days, except records the law requires (for example billing) and backups that are isolated until they expire. Originals and footage on the customer’s machine are the customer’s to keep or erase. A written confirmation of deletion is available on request.
8. Data-subject rights
The customer can access, correct, export, or delete much of their workspace from the product. For the rest, email hello@lenslab.dev with the subject “Privacy rights”. If a person contacts LensLab about Customer Data, LensLab will point them to the customer unless law requires a direct reply.
9. California, Canada, and Europe
Where CCPA applies, LensLab acts as a service provider: it does not sell or share Customer Data for cross-context advertising, and it only processes it for the Service. Where PIPEDA applies, Sub-processors are under written terms substantially like this DPA. EEA, UK, and Swiss customers may object to a new Sub-processor within five days of notice; if there is no workable path, they may stop the affected part of the Service.
10. Liability and the Agreement
Liability under this DPA follows the limits in the Terms, except where Data Protection Laws do not allow a limit on an individual’s rights. This DPA lasts as long as LensLab processes Customer Data for the customer. If this DPA and the Terms conflict, Standard Contractual Clauses (where they apply) win, then this DPA, then the Terms.
11. Contact
LensLab · Daydreamers · lenslab.dev · hello@lenslab.dev
Annex A — Processing
Data subjects. photographers who hold a LensLab account and use Daydreamers, and people who appear in photographs they import or galleries they publish.
Personal data. account name and email; photographs imported, picks, and galleries published; billing details handled by Stripe when a plan is bought; device and log data needed to run the site. The customer decides what they import, drop, or publish.
Sensitive data. LensLab does not ask for Sensitive Data. Do not upload it on purpose.
Nature and purpose. Import a shoot, pick keepers, develop, and send a gallery. Originals stay local unless the photographer publishes. Processing is continuous while the account is open, then as in section 7.