Oxylabs AI Studio Privacy Policy

Oxylabs Studio AI Privacy Policy (“Privacy Policy”) explains how Oxylabs, UAB, (“Oxylabs”, "we," "us," or "our") collects, uses, discloses, and stores personal data collected from the users (“user”, “users”, “you”) of the Oxylabs Studio AI website (“website”) and in connection with the provision of our services. It also outlines statutory rights under applicable data protection legislation. 

This Privacy Policy does not apply to personal data processed by us on behalf of our customers in the course of providing our services as described in Oxylabs AI Studio Terms of Service. In such cases, Oxylabs acts solely as a data processor, while our customers act as data controllers. The processing and use of such personal data are governed exclusively by the contractual agreements between Oxylabs and our customers, which define the terms of access, handling, and utilization of the services.

1. Data controller 

Name: Oxylabs, UAB, company code 302166536, registered at Švitrigailos g. 32, LT-03230 Vilnius, Lithuania. 

Contact: privacy@oxylabs.io

2. Purposes of processing, legal basis, and categories of personal data 

2.1. Provision of the service purpose: when you are our customer or a representative of a company that is our customer, we will process your personal data to conclude and execute the service agreement, enable you to create and manage your account with us, and provide you access to our services. Categories of personal data processed:
name and surname, email address, telephone number, signature, correspondence, details of the company you represent (e.g., industry), your affiliation with the company, mailing address, account information, payment information (e.g., credit card details) (if applicable), and usage data (e.g., access logs, activity history, and preferences). Legal basis for processing: performance of a contract, compliance with legal obligations, and legitimate interests (such as entering into, conducting, and maintaining the service agreement).

2.2.  Handling your requests and inquiries purpose: We are committed to providing prompt and effective support by addressing any requests, inquiries, or complaints you may submit. In order to properly investigate and respond to your inquiry, we may process your personal data. Categories of personal data processed: name, surname, email address, contact details, date of the inquiry, the content of your request or inquiry and any accompanying attachments, our response to your request or inquiry, as well as any other relevant communications. Legal basis for processing: your consent. 

2.3. Securing and improving our website purpose: we need to keep our website safe and smooth. Thus, please be aware that upon visiting our Website, we automatically gather certain technical Data regarding your device and the use of our website. This is a standard procedure aimed at ensuring optimal functionality and security during your browsing experience. Categories of personal data processed: IP address, log-in information, browser type and version operating system and platform, type of device, a unique device ID, mobile network information, mobile operating system and the type of mobile browser you use, screen resolution, log-in credentials, general information about your use of and actions on our website.  Legal basis for processing: legitimate interest to secure and improve our website. 

2.4. Marketing and communications purpose: when you use our services, consent to receive marketing communications from us, or in situations where we have a legitimate interest in informing you about our services, we will send you newsletters, ask your opinion about our services and/ or conduct other marketing activities. Categories of personal data processed: name, surname, email address, telephone number, preferences for receiving marketing communications and details about how you engage with our marketing communications. Legal basis for processing: consent; legitimate interest in conducting marketing, upholding customer relationship. 

2.5. Purpose of complying with legal obligations and protecting our rights and interests: we retain personal data by applicable statutory limitation periods to enable the protection and enforcement of our rights and legal interests, if necessary. Certain personal data is also retained to fulfil legal obligations in areas such as accounting, archiving, and other regulatory requirements. In rare cases, if you are involved in a legal proceeding or dispute in which we are a party, we may use your personal data for the purposes of that legal process. Categories of personal data processed: name, surname, identification details, information contained in requests or inquiries, legal documents, accounting records, and other information required by law. Legal basis for processing: compliance with legal obligations; legitimate interest in safeguarding our rights and legal interests. 

3. Data sources 

The vast majority of the personal data we process is collected directly from you. However, in certain situations, we may also receive personal data from other sources. These include state and municipal authorities, such as labour, social security, tax, supervisory authorities, law enforcement agencies, prosecutors, courts, and other government bodies, where the data is provided to comply with legal requirements or to protect our legal rights and interests. We may also receive your personal data from your representative(s), including your employer, if your employer is our customer, in order to perform service agreements and provide our services.

4. Data retention 

We retain personal data in a form that allows individuals to be identified only for as long as necessary to fulfil the purposes for which the data is processed and in accordance with applicable legal requirements. Contractual information relating to our customers is retained for the duration of the customer relationship and for up to ten (10) years after its termination, strictly for legal and compliance purposes. In certain cases, personal data may be retained for a longer period if required to comply with legal obligations, such as statutory retention periods, or for the establishment, exercise, or defense of legal claims. When personal data is no longer needed for these purposes and there is no legal obligation to retain it, it is securely deleted.

5. Share of your personal data 

Where necessary to fulfil the purposes described in this Privacy Policy, and in compliance with applicable data protection legislation, we may share your personal data with relevant third parties. Access to your personal data is strictly limited to individuals and entities that require it to carry out the intended processing activities. We may share your personal data with other third parties, such as: 

• Vendors and service providers: third parties that support our business operations and service delivery. This includes, but is not limited to, providers of Customer Relationship Management (CRM) software, business development services, email and email tracking services, online live chat functionality, customer support services, web hosting, data analytics, payment processing, and other trusted service providers engaged to support our operations. In all such cases, your personal data is shared only to the extent necessary for the provision of their services.

• Affiliated companies: entities under our ownership or control, for purposes consistent with this Privacy Policy.

• Business account administrators: if you access our services through a business account, authorised administrators may access and manage your account information. We may also share relevant account data with your employer or organisation.

• Business transfers: in connection with mergers, acquisitions, reorganisations, bankruptcy proceedings, or other similar events, your personal data may be transferred to relevant third parties, successors, or affiliates.

• Government authorities and legal obligations: we may disclose your personal data to state, governmental, law enforcement agencies, courts, and regulatory authorities when required by law. This includes responding to official requests such as subpoenas or supporting investigations. Such disclosures are made to comply with legal obligations, statutory requirements, or legitimate law enforcement demands, as well as to protect our rights, interests, and the safety of our company, employees, clients, or the public. Additionally, we may share your data to prevent fraud, ensure security, or defend against legal claims.

• Other users and third parties: where you choose to interact with other users or third parties via our services, your personal data may be shared in accordance with the functionality of those services and subject to the respective party's terms and privacy policies.

Transfers outside the European Economic Area (EEA) 

Our business operations are primarily conducted within the EEA. However, in certain circumstances, we may need to transfer your personal data to countries outside the EEA. We strictly adhere to applicable data protection legislation when making such transfers. When transferring personal data outside the EEA, we rely on adequacy decisions issued by the European Commission, which confirm that the destination country ensures an adequate level of data protection. In cases where no such adequacy decision exists, we implement appropriate safeguards in accordance with Chapter V of the GDPR. This includes, but is not limited to, the use of the European Commission’s Standard Contractual Clauses (SCCs) to ensure that your personal data receives an adequate level of protection consistent with GDPR requirements.

6. Your data protection rights 

Under applicable data protection legislation, you have the following rights concerning your personal data: 

• Right of access: you can request confirmation whether your personal data is being processed and obtain access to that data along with information about its processing.

• Right to rectification: you have the right to request correction of any inaccurate or incomplete personal data.

• Right to erasure (“right to be forgotten”): you may request deletion of your data when: it is no longer necessary for the purposes it was collected; you withdraw consent and there is no other legal basis for processing; you object to processing and there are no overriding legitimate grounds; the data has been unlawfully processed;  there is a legal obligation to erase the data; the data was collected in relation to information society services offered directly to a child. 

• Right to restriction of processing: You can request that processing be limited where:  you contest the accuracy of your data; the processing is unlawful but you oppose erasure and prefer restriction; we no longer need the data but you require it for legal claims;  you have objected to processing pending verification of legitimate interests. 

• Right to data portability: you may receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller, provided processing is based on consent or contract and carried out by automated means.

• Right to object: you can object to the processing of your data when it is based on a task in the public interest, official authority, or legitimate interests, including profiling, or for direct marketing purposes.

• Right to withdraw consent: if processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

• Right to lodge a complaint: you have the right to file a complaint with supervisory authority if you believe your data protection rights have been violated.

If you wish to exercise any of these rights or require more information, please contact us using the privacy@oxylabs.io. 

7. Automated decision-making, including profiling

We do not engage in decision-making based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you.

8. Children's data

Our services are not directed at, nor intended for, children. We do not knowingly collect personal data from individuals under the age of 18. If you have reason to believe that a child has provided personal data to us through our website or contact forms, please contact us. We will promptly investigate any such notification and, where appropriate, delete the personal data from our systems in accordance with applicable legal requirements.

9. Cookies 

When you visit our website, we process your data through cookies and other similar technologies. We collect this data based on your consent, except for essential cookies that are necessary for the website’s basic functions and do not require your consent.

Cookies are small text files, usually just a few kilobytes, placed on your device by your web browser when you visit our site. Each cookie falls into one of the following categories:

• Essential cookies: these cookies are necessary for the website to function properly. They enable basic features such as remembering your preferences while you navigate the site. Because they are essential for the operation of the website, these cookies do not require your consent.

• Analytics cookies: these cookies collect information about how visitors use the website. This helps us understand visitor behavior, improve our site, and report on performance. The data collected is aggregated.

• Functionality cookies: these cookies remember information you provide or choices you make, such as your username, preferred language, or region. This allows the website to provide a more personalized experience on your next visit.

• Targeting and advertising cookies: these are third-party cookies placed by advertising networks to deliver relevant ads and track their effectiveness. They may use your browsing activity on our site and others to tailor advertisements. In some cases, ad serving involves automated decision-making.

Cookies enable us to operate the website efficiently and to measure its audience and performance. Technical and functional cookies are essential for the site’s operation and cannot be disabled without affecting functionality. Analytical and advertising cookies are only used with your consent.

You can manage your cookie preferences through your browser settings. Disabling or blocking cookies may affect your experience and prevent certain features from working properly. Please note that withholding consent does not automatically delete cookies already stored on your device; these must be removed manually via your browser’s settings.

10. Updates to this Privacy Policy 

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make significant changes, we will notify you through appropriate channels, such as by email or by posting a prominent notice on our website or within our services. Your continued use of our services after any updates constitutes your acceptance of the revised Privacy Policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your personal data. 

Last updated: June 30, 2025