PIXI—LABONLINE
PixiLab
Legal

Privacy Policy

Last updated · September 2026

1. Introduction

LABPIXI LTD ("we", "our", "us") is the company behind Pixilab. This site, pixilab.ai, is our front page: it presents our products, hosts our team and contact pages, and the sign-in to your Pixilab account. No product runs here. This policy covers what pixilab.ai itself collects and how we handle it; each of our products has its own privacy policy, listed just below, which governs your data when you use that product.

2. Our products have their own privacy policies

When you use one of our products, that product’s privacy policy applies to your data — what it collects, how it uses, stores, shares and deletes it. This page covers pixilab.ai only.

3. Information we collect on pixilab.ai

On this site itself, we collect only:

  • Contact information — your name, email address and message when you write to us through the contact form.
  • Usage data — how you navigate this site (pages viewed).
  • Technical data — IP address, browser type and device information, in ordinary server logs.
  • Account session — if you sign in to your Pixilab account on this site, the session cookie needed to keep you signed in.

4. How we use your information

We use the data we collect to:

  • Provide and maintain our services
  • Respond to inquiries and support requests
  • Improve product quality
  • Comply with legal obligations

5. Data security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, or destruction. No online system is impenetrable; we do our best and improve continuously.

6. Data retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Messages sent through the contact form are kept for as long as needed to handle your request. Data you entrust to a product is retained and deleted as that product’s privacy policy states.

7. Your rights

Depending on your jurisdiction, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Request deletion of your data
  • Object to specific processing

8. Cookies

pixilab.ai uses a session cookie if you sign in to your Pixilab account, and similar technologies to understand how the site is used. You can control cookies through your browser settings.

9. Sharing your data

We do not sell your personal data. We share it only with the service providers required to operate our services (such as hosting and infrastructure providers), who are bound by confidentiality obligations, or when disclosure is required by law.

10. Google sign-in and Google user data

Several Pixilab products let you sign in with your Google account through one Google sign-in client, shown under the Pixilab name. When you sign in this way to Nemini, SmartDisk or PhotoWiz, that product receives your basic Google profile information — your name, email address and profile picture — and uses it solely to create and secure your account: never for advertising, never sold, never shared with third parties except as described in that product’s privacy policy. You can revoke this access at any time from your Google account’s security settings. pixilab.ai itself does not use Google user data.

Nemini alone can additionally ask, on a separate Google consent screen, for access to your Google Calendar events and your Google Tasks: view and edit events on your Google calendars (calendar.events), create, edit, organize and delete your Google Tasks (tasks), and your email address (to show which account is connected). We request nothing broader — not your full calendar settings, not your contacts, not your mail. The rest of this section states, for Nemini, what Google user data we access, how we use it, how we store and protect it, with whom we share, transfer or disclose it, and how long we keep it and how it is deleted. No other Pixilab product accesses Google user data beyond sign-in. The same commitments appear in Nemini’s privacy policy, section 12.

  • Google user data we access — events on your primary Google calendar (title, time, place, description, link) and tasks on your default Google Tasks list (title, notes, due date, status), read when your companion needs them, at most a couple of weeks ahead, plus a short look-ahead used for the heads-ups described below.
  • How we use Google user data — solely to provide the feature you see in Nemini: your companion reads your calendar and your task list to answer you and to know your day, creates, changes or deletes events and adds or completes tasks when you ask them to or you both agreed, and, if you leave the switches on, gives you a heads-up shortly before an event and once a day when a task is due — on the web or on Telegram. Nothing else.
  • How we store and protect Google user data (data protection mechanisms for sensitive data) — the long-lived Google token that lets your companion act for you is encrypted at rest (AES-256-GCM) with a key that never leaves our server; the short-lived access tokens derived from it are kept in the server’s memory only, for up to one hour. All exchanges with Google and with your browser are encrypted in transit (TLS). We also store the email address of the connected Google account, the permissions you granted, when you connected, when the connection was last used, and your heads-up settings. We do not keep a copy of your calendar or your task list: events and tasks are read from Google when needed. Each account’s data is isolated from every other account, and our staff do not access it except as stated under sharing below.
  • Where Google user data appears in your conversation, and for how long — like any other tool your companion uses, what they read from or write to your calendar and tasks during a conversation is recorded in that conversation, and what they tell you about it can end up in their memory, exactly as anything else you discuss. A pending heads-up keeps the event’s title, place and time until it has fired. This data is kept as long as your companion exists, and goes when you reset them or delete everything.
  • With whom we share, transfer or disclose Google user data — data received from Google APIs is not sold, not shared with third parties, not used for advertising, and not used to build or train AI models. It is processed only by the AI models that run your companion, as a processor, to produce the answer or action you see: by default our self-hosted models on our own servers (never shared with the model providers); for the requests that are redirected to OpenRouter, only providers with a no-training and no-logging policy, as described below; or, if you stored your own key in Nemini, the provider you chose under your own account. Our staff do not read it, except with your explicit permission (for example when you ask for support), when it is necessary for security or abuse investigation, or when the law requires it.
  • Retention and deletion of Google user data — Settings › Channels › Google › Disconnect revokes our access at Google and deletes the stored token and connection at once; Delete everything (Settings › Danger) does the same together with the rest of your data (personal data is removed within 30 days, residual backup copies expire on a rolling schedule); you can also remove Nemini’s access at any time from your Google account permissions page. If Google reports that the permission was revoked, your companion stops using it immediately and the settings page tells you.

AI models and Google user data — self-hosted models. Nemini’s companions run on open-weights language models — GLM 5.2 as the main model, Qwen 36B-A3B for the fast pipeline and Gemma 4 for specific tasks — fine-tuned by us and self-hosted on GPU clusters that we rent and operate ourselves. Google user data is processed locally on that infrastructure and is never shared with the model providers for training or any secondary purpose: nothing is transmitted back to them. Some text requests are redirected to OpenRouter, under our account, and the request itself restricts them to providers with a zero-training and zero-logging policy (OpenRouter’s data-collection setting “deny”, zero-data-retention endpoints only, a fixed provider list with fallbacks disabled). All other models — image generation, voice synthesis, transcription, music, memory and embeddings — run only on our own clusters and never leave our private network. If you stored your own API key in Nemini (Anthropic, OpenAI, xAI, OpenRouter or a custom endpoint), your companion runs on that provider under your own account and its terms instead. We do not use Google user data, or any of your data, to train AI models, and we do not sell it.

Pixilab’s and Nemini’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

Read the Google API Services User Data Policy ↗ · Manage Nemini’s access on your Google account ↗

11. Contact us

For privacy-related questions, please reach out through the contact page.

12. Company details

LABPIXI LTD
Agias Elenis 4
Michaelides Building, 1st Floor, Flat/Office 104
1060, Nicosia, Cyprus