Privacy Policy
Last updated: 18 October 2026
This policy explains what personal data Bear Media Lab (“we”, “us”) collects when you use bearmedialab.com and its tools, why we collect it, who we share it with, and the choices you have. Bear Media Lab is operated from Malaysia, and we handle personal data in line with Malaysia’s Personal Data Protection Act 2010 (PDPA). We also respect the privacy rights of users wherever they are.
Questions or requests: admin@bearmedialab.com.
1. What we collect
Account information
You sign in through our single sign-on service (Bear Auth, at auth.anyruok.com). When you sign in, we receive and store your email address, name and profile picture, plus the date you were last active. We do not receive or store the password for your sign-in account.
Payments and balance
Paid features use a prepaid balance that you top up through Stripe. Stripe collects and processes your card details. We never see or store your full card number. We keep a record of each top-up and each charge against your balance (amount, service, date).
Content you upload or create
Our tools process the files and text you give them: images, ZIP archives, audio, video, spreadsheets, PDFs, website addresses, prompts for AI generation, form data, and email templates and recipient lists. We use this content only to run the tool you asked for. See How long we keep data for when it is deleted.
Email Express and Reminder
If you connect a mailbox to Email Express, we store its server settings and your mailbox password. We encrypt the password (AES-256-GCM) and use it only to send the emails you schedule. We also store your campaigns, templates and recipient lists so the tool can send them. You are responsible for having permission to email those recipients. Reminders you set up are stored until they have been sent or you delete them.
Form Express
Form Express fills in web forms for you using data you upload, through a browser running on our servers. If a step fails, we save a screenshot so you can see what went wrong. Those screenshots may show the data you entered.
Usage and technical data
We log which tools you use and when (an activity log), along with standard server logs: IP address, browser type and the pages requested. We use these to run the service, prevent abuse, troubleshoot problems and work out billing.
2. How we use your data
- To provide the tools and features you ask for, and to keep you signed in.
- To process top-ups and charge your balance for paid services.
- To send the emails and reminders you schedule.
- To secure the service, prevent fraud and abuse, and fix problems.
- To meet legal, tax and accounting obligations.
We do not sell your personal data. We do not use your uploaded content to train AI models.
3. Who we share it with
Some features rely on outside providers. We send them only what that feature needs, when you use it:
| Provider | What for | What they receive |
|---|---|---|
| Bear Auth (our sign-in service) | Sign-in | Email, name, profile picture |
| Stripe | Top-up payments | Payment details, email, amount |
| Google (Gemini, Veo, Cloud Speech-to-Text, Cloud Storage) | AI text, images, video, voice-over and transcription | Your prompts, and the images or audio you choose to process |
| DeepSeek | AI text features | Your prompts and the text being processed |
| Venice.ai | Extra AI image and video models | Your prompts and reference images |
| Pexels, Pixabay, Jamendo | Stock photo, video and music search | Your search keywords |
| Google AdSense (where ads are shown) | Advertising | Cookie and device data. See section 4. |
| Our hosting and email providers | Running the site, sending reminder emails | Data stored or sent through the service |
Each provider handles data under its own privacy policy. Some of them process data outside Malaysia, including in the United States. When that happens we rely on the provider’s own safeguards. We may also disclose data if the law requires it, or to protect our rights, our users or the public.
Data you send to other websites yourself is not covered by this policy. That includes forms Form Express submits for you and emails sent from your own mailbox.
4. Cookies and local storage
- Session cookie (essential): keeps you signed in for up to 7 days.
- Remember-me token (essential): keeps you signed in between visits if you choose that option.
- Browser storage: remembers your light or dark theme. Video Express also saves your projects in your browser (IndexedDB). That data stays on your device; we don’t receive it.
- Advertising cookies: on pages that show ads, Google and its partners may use cookies to show ads based on your visits to this and other sites. You can turn off personalised ads at Google Ads Settings or aboutads.info. To learn more, see how Google uses data from partner sites.
We do not use separate analytics or tracking tools.
5. How long we keep data
| Data | Kept for |
|---|---|
| Image Express batch uploads and results | About 2 hours, then deleted |
| Audio to Text audio files | Deleted when the transcription job ends (transcripts are kept until you delete them) |
| Drawing Tool website scans | 7 days after you stop using them |
| AI video generation records | 7 days |
| Form Express failure screenshots | 7 days |
| Account, presets, templates, saved mailboxes, activity log | Until you ask us to delete them, or 2 years after your last sign-in, whichever comes first |
| Payment and balance records | As long as tax and accounting law requires, even after the account is deleted |
6. Your rights
Depending on where you live, you may have the right to:
- access the personal data we hold about you, and get a copy of it;
- correct data that is wrong;
- have your data deleted;
- object to, or limit, how we use it;
- withdraw consent you gave earlier;
- complain to your local data protection authority.
Email admin@bearmedialab.com from the address on your account and we’ll reply within 21 days. Asking costs nothing.
7. Security
We use HTTPS for all traffic, encrypt stored mailbox passwords, limit who can access our systems, and delete working files on the schedule above. No online service is perfectly secure, though. If a breach affects your data, we will tell you as the law requires.
8. Children
Bear Media Lab is not intended for children under 13, and we do not knowingly collect their data. Users under 18 need a parent or guardian’s permission before making payments. If you think a child has given us personal data, contact us and we will delete it.
9. Changes to this policy
We may update this policy as the service changes. The date at the top shows when it was last updated. If we make a significant change, we will tell signed-in users on the site or by email.
10. Contact
Bear Media Lab, Malaysia
admin@bearmedialab.com, or use our
contact form.