Black Forest Labs Privacy Policy

We’ve updated our Privacy Policy below. At Black Forest Labs, we respect your privacy and are strongly committed to keeping secure any information we obtain from you or about you.

This Privacy Policy describes how we collect, use, disclose, and process your personal data when you use our websites (www.blackforestlabs.ai; www.bfl.ai), Playground, available at https://dashboard.bfl.ai/(“Playground”), APIs, AI models, applications, services, features, tools or otherwise interact directly with us (collectively, the “Services”).

This Privacy Policy does not apply to content that we process on behalf of customers of our business offerings pursuant to an enterprise contract. Our use of that data is governed by our customer agreements covering access to and use of those offerings.

This Privacy Policy also describes your privacy rights. More information about your rights, and how to exercise them, is set out in Section 8. Please read this Privacy Policy carefully. By using any of the Services, you agree to the collection, use, and disclosure of your Personal Data as described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access the Services.

1. COLLECTION OF PERSONAL DATA

When you use or access the Services, we collect certain categories of information about you (”Personal Data”) from a variety of sources.

Information You Provide to Us

Some features of the Services may require you to directly provide us with certain information you provide us about yourself. Personal Data you provide includes:

• Communication Information , such as name, address, phone number, and email, which we use to provide the Services and to communicate with you.
• Account information, such as username and password.
• Payment information, such as bank account, credit or debit card information, and billing address, which we collect and share with a third-party payment processor. We use this information to process your payment and provide the Services.
• Your interactions with our Services, which may include prompts, reference files and other content that is submitted to the Services and the output that is created through our Services.
• Applicant details, such as information included in your resume of CV, references, and job history. We use this information to assess your candidacy, in our legitimate interests to operate a successful business.
• Any other information you choose to include in communications with us, for example, when sending a message through the Services, when using our alpha or beta products and services, interacting with us online or offline, or confirming your identity.

Our Services may use recordings of your image, likeness or voice and data derived from such recordings which may be considered biometric data in some jurisdictions, to generate and synthesize media at your direction, for example, to produce speech, translation, or other audio-visual content. We do not process image, likeness or voice data to identify, authenticate, recognize or infer any characteristics about you or any other real individual.

Information We May Collect Automatically

We may also automatically collect certain information about your interaction with the Services, including emails that we send you (“Usage Data”). To do this, we may use various tracking technologies, including cookies (“Tracking Technologies”). Usage Data may include:

• Device information, such as device type, operating system, unique device identifier, and internet protocol (IP) address.
• Location information, such as approximate location, if you choose to provide it.
• Other information regarding your interaction with the Services, such as browser type, log data, date and time stamps, clickstream data, interactions with marketing emails, ad impressions, and other preference data.

For more information on how we use Tracking Technologies and your choices, see the section below, Cookies and Other Tracking Technologies.

Information Collected From Other Sources

We may obtain information about you from outside sources, including information that we collect directly from third parties and information from third parties that you choose to share with us. Such information may include:

• Analytics data we receive from analytics providers such as Metabase/PostHog. We use this information to understand how the Services are used and to improve the Services, in our legitimate interests to operate a successful business.
• Information we receive from career websites, such as LinkedIn, Monster, or Indeed, which we use to process your application for employment, in our legitimate interests to operate a successful business.

2. HOW WE USE YOUR PERSONAL DATA

We may use Personal Data for the following purposes:

• To provide and maintain our Services;
• To improve and develop our Services and new features and conduct research;
• To communicate with you, including to send you information or marketing about our Services and events;
• To prevent fraud, criminal activity, or misuses of our Services, and to protect the security of our systems and Services; and
• To comply with legal obligations and to protect the rights, privacy, safety, or property of our users, us, our affiliates, or any third party.

We may aggregate or de-identify Personal Data so that it can no longer be used to identify you within our system. We may use this data to assess the security, efficacy and safety of our systems and to improve and add features to our Services, to conduct research and for other similar purposes.

Any information we receive from outside sources will be treated in accordance with this Privacy Policy. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for any third party’s policies or practices. For more information, see the section below, Third Party Websites and Links.

In addition to the specific uses described above, we may use any of the above information to provide you with the Services, in order to perform a contract entered into with you, and in our legitimate interests to maintain our business relationships, including by enhancing the safety and security of our Services (e.g., troubleshooting, data analysis, testing, system maintenance, content moderation, and reporting), providing customer support, sending service and other non-marketing communications, monitoring and analyzing trends, conducting internal research and development, complying with applicable legal obligations, enforcing any applicable terms of service, and protecting the Services, our rights, and the rights of our employees, users or other individuals.

We may collect, store and use information you provide via the Services, including text prompts, uploaded content (like images) (together, the “Inputs”), tasks the Service undertakes on your behalf, such as system interactions, research activities and visual grounding (“Tasks”) and the corresponding generated outputs to train and improve our AI models after implementing appropriate technical safeguards like data minimisation and deidentification techniques. This training serves important purposes that benefit you and society: make our models more accurate, useful and reliable so you get better results; improve our content moderation tools, enhance performance so the Services run faster and more efficiently; fix errors; address limitations you and other users experience; and develop new features and capabilities that expand what you can create. If you object to us using your data for training and improvement purposes, you can contact us at privacy@blackforestlabs.ai using the subject heading “Training Opt Out” and providing your account details. You can also stop using the Services entirely and request deletion of your data at any time. You have additional rights to access your information and complain to the relevant supervising data protection authority.

For users residing in Switzerland, UK or the EEA, the information we collect from you may be transferred to, and stored at/processed in countries outside the country they were collected from. We take steps to ensure that any international data transfers are conducted in accordance with applicable law. For instance, when transferring your information outside the EEA or UK, the transfer is conducted under the European Commission’s standard contractual clauses for the transfer of personal data to third countries, or the UK Information Commissioner’s international data transfer addendum to the EU standard contractual clauses, as relevant, unless the data transfer is to a country that has been determined by the European Commission or the relevant UK authorities, as applicable, to provide an adequate level of protection for individuals’ rights and freedoms for their personal data.

3. COOKIES AND OTHER TRACKING TECHNOLOGIES

We use cookies to understand aggregate website usage and improve our Services. No advertising cookies are used. Information can be found by clicking on the cookie banner on our website. When you visit our site, a banner asks whether we may set the PostHog or Clay analytics cookie. We only place it if you choose Accept. You can withdraw consent at any time via the banner’s settings (or by clearing cookies).

• Your choices. You can refuse consent in the banner, or block/delete cookies in your browser at any time. Declining or removing the analytics cookie will not affect core site functionality. Blocking the strictly necessary mintlify-auth-key (on the docs subdomain) may prevent access to protected documentation.
• “Do Not Track.” Our website is not configured to respond to “Do Not Track” or similar opt-out preference signals unless required by law. We rely on the banner for consent to any non-essential cookies.

Your browser settings may allow you to transmit a “do not track” signal, “opt-out preference” signal, or other mechanism for exercising your choice regarding the collection of your information when you visit various websites. Like many websites, our website is not designed to respond to such signals, and we do not use or disclose your information in any way that would legally require us to recognize opt-out preference signals. To learn more about “do not track” signals, you can visit http://www.allaboutdnt.com/.

4. DISCLOSURE OF YOUR INFORMATION

We may disclose your information as follows to:

• Our affiliates or others within our corporate group.
• Vendors or other service providers who help us provide the Services, including for system administration, cloud storage, security, customer relationship management, marketing communications, web analytics, content moderation, payment networks, and payment processing.
• Third parties to whom you request or direct us to disclose information.
• Professional advisors, such as auditors, law firms, or accounting firms.
• Third parties, if we are involved in strategic transactions, reorganization, bankruptcy, receivership, or transition of service to another provider (collectively, a “Transaction”), your Personal Data may be disclosed in the diligence process with counterparties and others assisting with the Transaction and transferred to a successor as part of that Transaction along with other assets.

We may also disclose your information as needed to comply with applicable law or any obligations thereunder or to cooperate with law enforcement, judicial orders, and regulatory inquiries, to enforce any applicable terms of service or policies, and to ensure the safety and security of our Services, business, employees, and users.

5. THIRD PARTY WEBSITES AND LINKS

We may provide links to third-party websites or platforms. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms. Information you provide on public or semi-public venues, such as third-party social networking platforms, may also be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.

6. CHILDREN’S PRIVACY

Our Services are not directed towards, and we do not knowingly collect, use, disclose, sell, or share any information from children under the age of 18 (“Minors”). If you are the parent or guardian of a Minor who has provided us with their personal information, you may notify us via email (privacy@blackforestlabs.ai) to request appropriate action.

7. DATA SECURITY AND RETENTION

Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee “perfect security.” Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

We retain your information for as long as is reasonably necessary to provide our Service to you, or for other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations.. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, communicate with you, comply with our legal obligations, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products.

8. YOUR RIGHTS

You may have certain rights in relation to your information, to the extent provided by applicable law:

• Access: You have the right to access information we hold about you, how we use it, and who we share it with.
• Portability: You have the right to receive a copy of the information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions.
• Correction: You have the right to correct any of your information we hold that is inaccurate.
• Erasure: In certain circumstances, you have the right to delete the information we hold about you.
• Restriction of processing to storage only: You have the right to require us to stop processing the information we hold about you, other than for storage purposes, in certain circumstances.
• Objection to marketing: You can object to marketing at any time by opting-out using the function described in our communications to you or by contacting us at privacy@blackforestlabs.ai.
• Withdrawal of consent: Where we rely on consent to process your information, you have the right to withdraw this consent at any time by contacting us.

Please note that a number of these rights only apply in certain circumstances, and all of these rights may be limited by law. For example, where fulfilling your request would adversely affect other individuals or our trade secrets or intellectual property, where there are overriding public interests or where we are required by law to retain your information.

To exercise any of these rights, you can contact us as specified in the ‘How to Contact Us’ section. We will respond to requests to exercise these rights without undue delay and at least within one month (though this may be extended by a further two months in certain circumstances).

As noted above, if you are an end user of a service that incorporates or integrates our Services, the service provider is the controller of your personal data, and you should contact them to exercise any privacy rights.

If you have complaints about how we process your information, please contact us as specified in the ‘How to Contact Us’ section and we will respond to your request as soon as possible.

If you think we have infringed data protection laws, you can file a claim with the data protection supervisory authority in the country in which you live or work or where you think we have infringed data protection laws.

9. CHANGES TO THIS PRIVACY POLICY

We may modify this Privacy Policy from time to time, in which case we will update the “Last Updated” date at the top of this Privacy Policy. If you do not agree to any updates to this Privacy Policy, please do not continue using or accessing the Services.

10. HOW TO CONTACT US

If you live in the European Economic Area (EEA), Switzerland, or the United Kingdom, BFL GmbH is the data controller and is responsible for the processing of your Personal Data as described in this Privacy Policy. If you live outside the European Region, the data controller responsible for your personal data is Black Forest Labs Inc.

Should you have any questions about this Privacy Policy, wish to report an incident or would like to request a copy of data associated with your account, please email us at privacy@blackforestlabs.ai and contact our Data Protection officer dpo@blackforestlabs.ai.

You can contact us as described below:

• Black Forest Labs Inc, 2261 Market Street STE 22997, San Francisco, CA 94114
• BFL GmbH, Ingeborg-Krummer-Schroth-Straße 18, 79106 Freiburg im Breisgau, Germany