Privacy Policy
Effective 18 August 2026
MixLabs Studio is a post-production workspace operated by Mixlabs Creative Private Limited ("MixLabs", "we", "us"), a company registered in India.
This policy explains what we hold, why, and what you can ask us to do about it. It is written to be read, not to be survived.
The short version
- We collect what an account needs to work: your name, email, and what you do on the projects you're part of.
- We do not track you. No analytics, no advertising pixels, no third-party cookies. The only cookie we set keeps you signed in.
- We never sell or share your personal information, in the sense those words carry under the CCPA or any other law.
- Your footage is yours. We store it so the product works. We don't licence it, train on it, or look at it except when you ask us to fix something.
1. What we collect
Account information — name, email address, and optionally company and role, provided by you or by whoever invited you. Passwords are hashed by our authentication provider; we never see them.
Project content — everything you or your collaborators upload: video and audio drafts, editorial turnovers, reference documents, deliverables, and the comments, timecodes, milestones and approvals recorded against them.
Usage records — which projects you belong to, your role on each, and a record of actions such as uploading a draft or resolving a note, so the project history is accurate.
Technical data — standard server logs (IP address, browser type, timestamps) kept for security and troubleshooting.
Billing information — if you subscribe to a paid plan, our payment processor handles your card details. We never receive or store card numbers.
We do not collect location data, biometric data, advertising identifiers, or special-category data as defined by the GDPR. We do not knowingly collect data from anyone under 18.
2. Why we hold it
| Purpose | Basis |
|---|---|
| Running your account and projects | Performing our contract with you |
| Notifying you of drafts, comments and approvals | Performing our contract |
| Keeping the service secure and diagnosing faults | Our legitimate interests |
| Billing and tax records | Legal obligation |
| Answering your support requests | Performing our contract |
We do not use your data for automated decision-making or profiling, and we do not use customer content to train machine-learning models.
3. Who else touches it
We use a small number of infrastructure providers. Each is bound by contract to
process data only on our instructions. A current list, with what each one
handles and where, is published at /legal/subprocessors and updated when it
changes.
We share personal information with no one else — not advertisers, not data brokers, not analytics companies. We disclose data to authorities only where legally compelled, and we will tell you unless prohibited from doing so.
4. Where your data lives
MixLabs is operated from India. Our infrastructure providers store data in the United States, so using the service involves an international transfer of your data.
Where the GDPR applies, these transfers rely on Standard Contractual Clauses. Where India's Digital Personal Data Protection Act applies, transfers are made in accordance with its cross-border provisions.
If your organisation requires data residency in a specific region, contact us before subscribing — we would rather tell you no than surprise you later.
5. How long we keep it
Project content stays until you delete it, or until you ask us to close your account. There is no self-service account deletion yet — email us and we will action it. Once closure is requested we delete content within 30 days, except where we're required to keep records for longer.
Account records are deleted within 30 days of a closure request.
Billing records are kept as long as tax law requires, typically eight years in India.
Server logs are kept for 90 days.
Deleted files are removed from our storage. Encrypted backups may persist for up to 30 days before rotating out.
6. Security
- Everything is encrypted in transit (TLS) and at rest.
- Access is enforced at the database level, per project and per role — not merely hidden in the interface.
- Media is served through short-lived signed links, not public URLs.
- Staff access to customer content is restricted and only occurs in response to a support request or a specific security investigation.
No system is perfectly secure, and we don't claim otherwise. If a breach affects your personal data we will notify you and the relevant authority as required — within 72 hours where the GDPR or DPDP Act applies.
7. Your rights
Whatever jurisdiction you're in, you can ask us to:
- Tell you what we hold about you
- Correct anything wrong
- Delete your personal data
- Export your data in a portable format
- Object to or restrict processing
- Withdraw consent where processing relies on it
Email info@mixlabscreative.com. We respond within 30 days — and within 7 days for erasure requests where the DPDP Act applies. We will not charge you for this or treat you differently for asking.
California residents: we do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. You retain the rights to know, delete, correct, and to non-discrimination.
EU/UK residents: you may complain to your local supervisory authority.
Indian residents: you may nominate another person to exercise your rights should you be unable to, and you may complain to the Data Protection Board of India.
8. Cookies
We set one cookie, and it keeps you signed in. That's it.
We use no analytics, advertising, or third-party tracking cookies. Because we set nothing beyond what is strictly necessary to deliver a service you asked for, no consent banner is required — and we'd rather not show you one.
9. Changes
If we change this policy materially, we'll email account holders and update the date above before the change takes effect. Continuing to use MixLabs afterwards means you accept the revised policy.
10. Contact
Mixlabs Creative Private Limited, India info@mixlabscreative.com
Our registered office address is available on request, and to any supervisory authority that asks for it.