Privacy Policy

Effective Date: July 1, 2025  |  Last Updated: July 1, 2025

This Privacy Policy explains how Fluxpool Pte. Ltd. (“Fluxpool,” “we,” “us,” or “our”) collects, uses, stores, shares, and protects your personal data when you use our website (fluxpool.ai), API, playground, and related services (collectively, the “Service”).

By accessing or using the Service, you agree to the practices described in this policy. If you do not agree, please do not use the Service.

If you have questions, contact us at privacy@fluxpool.ai.

1. Information We Collect #

1.1 Information You Provide

When you create an account or use the Service, we collect:

• Account information: Email address, name (if provided), password (hashed), profile information
• Payment information: Billing details and payment method data processed through our payment provider (Stripe). We do not store full credit card numbers.
• Prompts and generation inputs: Text prompts, image inputs (for img2img or img2vid), and generation parameters you submit to create content
• Communications: Messages you send to our support team, feedback, or feature requests
• API credentials: API keys generated for your account

1.2 Information Collected Automatically

When you access the Service, we automatically collect:

• Usage data: Pages visited, features used, models selected, generations created, timestamps, and session duration
• Device information: Browser type, operating system, device type, screen resolution, and language preference
• Network information: IP address, approximate geolocation (country/city level), and referral source
• API usage data: Endpoints called, request frequency, response times, error rates, and model usage patterns
• Cookies and similar technologies: See Section 4 below

1.3 Information From Third Parties

We may receive information from:

• OAuth providers: If you sign in with Google or GitHub, we receive your name, email address, and profile picture from those services. We do not receive your passwords.
• Payment processors: Transaction confirmation and billing status from Stripe
• Analytics providers: Aggregated usage and performance data

2. How We Use Your Information #

We use your information for the following purposes:

We do not sell your personal data.

3. AI Generation Data #

3.1 Prompts and Inputs

When you submit a prompt or input (text, image, or video) to generate content:

• Your prompts and inputs are sent to third-party AI model providers to process the generation (see Section 5)
• We store your prompts and generation parameters in association with your account to provide generation history, enable re-generation, and facilitate your use of the Service
• We do not use your prompts to train our own AI models
• We do not manually review your prompts unless required for safety enforcement or legal compliance

3.2 Generated Outputs

Regarding the images and videos generated through the Service:

• Generated outputs are stored on our infrastructure and associated with your account
• You may download, delete, or share your generated outputs at any time through the playground or API
• We may display generated outputs in our public gallery (“Made with Fluxpool”) only if you explicitly opt in to public sharing. Outputs are private by default.
• We do not claim ownership of your generated outputs. See our Terms of Service for details on output ownership.

3.3 Content Moderation

We use automated systems to detect prompts or outputs that violate our Acceptable Use Policy. This processing may include:

• Automated prompt screening before generation
• Automated output analysis after generation
• Flagging and review of policy violations

Violations may result in content removal, account warnings, or account suspension as described in our Acceptable Use Policy.

4. Cookies & Tracking #

4.1 Cookies We Use

We use the following types of cookies and similar technologies:

4.2 Managing Cookies

You can control cookies through:

• Your browser settings (blocking or deleting cookies)
• Our cookie consent banner (displayed on first visit)
• Opting out of analytics: we respect Do Not Track (DNT) browser signals

Note: Disabling essential cookies may prevent you from using the Service.

4.3 Analytics Tools

We use the following analytics services:

• PostHog — product analytics and session replay (anonymized)
• Google Analytics (if used) — traffic and usage analysis
• Stripe — payment conversion analytics

These services may set their own cookies. Refer to their respective privacy policies for details.

5. Third-Party Services & Model Providers #

5.1 AI Model Providers

To process your generation requests, we transmit your prompts and inputs to third-party AI model providers. These may include:

• Black Forest Labs (Flux models)
• Alibaba Cloud / Qwen (Qwen Image models)
• Alibaba Cloud / Wan (Wan Video models)
• Kuaishou Technology (Kling models)
• Stability AI (Stable Diffusion models)
• Tencent (Hunyuan models)
• Runway (Runway Gen models)
• Luma AI (Dream Machine models)
• Ideogram (Ideogram models)
• Other model providers as we expand our model catalog

Data shared with model providers includes: your text prompt, input images (if applicable), and generation parameters. We do not share your account information, email, or payment details with model providers.

Each model provider has its own data handling practices. We select providers that commit to not using customer prompts for model training, but we encourage you to review the specific privacy practices of the model providers relevant to your usage.

5.2 Other Third-Party Services

We use the following categories of third-party services:

• Cloud infrastructure: Hosting and compute (e.g., AWS, GCP, or regional providers)
• Payment processing: Stripe
• Authentication: Google OAuth, GitHub OAuth
• Email delivery: Transactional email service (e.g., Resend, Postmark, or SendGrid)
• Customer support: Support ticketing system (e.g., Intercom, Crisp, or email-based)
• Monitoring: Uptime and performance monitoring (e.g., BetterUptime, Datadog)

We require all third-party service providers to handle your data in accordance with applicable data protection laws and our contractual obligations.

6. Data Sharing & Disclosure #

We do not sell your personal data. We share your information only in the following circumstances:

• Model providers: As described in Section 5, to process your generation requests
• Service providers: Third-party vendors who help us operate the Service (infrastructure, payments, analytics), under contractual data protection obligations
• Legal requirements: When required by law, regulation, legal process, or enforceable government request
• Safety and enforcement: To investigate or address violations of our Terms of Service or Acceptable Use Policy, fraud, security issues, or to protect the rights, property, or safety of Fluxpool, our users, or the public
• Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, your data may be transferred to the successor entity
• With your consent: When you explicitly authorize us to share specific data

We do not share your data with advertisers for ad targeting purposes.

7. Data Storage & Security #

7.1 Where We Store Data

Your data is stored on servers located in Singapore / Asia-Pacific. Some data may be processed in other regions as needed to deliver the Service (e.g., model providers may process generations on infrastructure in the United States, Europe, or China).

By using the Service, you consent to your data being transferred to and processed in these regions.

7.2 Security Measures

We implement industry-standard security measures to protect your data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• API key hashing — we do not store your API keys in plaintext
• Access controls and least-privilege principles for internal systems
• Regular security assessments and monitoring
• Incident response procedures

No method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it to security@fluxpool.ai.

8. Data Retention #

We retain your data as follows:

When you delete your account:

• Your profile, API keys, and generation history are scheduled for deletion
• Generated outputs stored on our servers are deleted within 30 days
• Outputs you downloaded or shared externally are not within our control
• Some data may be retained longer if required by law (e.g., payment records for tax compliance)
• Anonymized, aggregated data (which cannot identify you) may be retained indefinitely for analytics purposes

9. Your Rights #

9.1 Rights Available to All Users

Regardless of your location, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal data and account
• Data portability: Request your data in a structured, machine-readable format
• Objection: Object to processing of your data for specific purposes (e.g., marketing communications)
• Withdrawal of consent: Withdraw consent where processing is based on consent
• Opt out of marketing: Unsubscribe from product update emails at any time via the link in any email

To exercise any of these rights, contact us at privacy@fluxpool.ai or use the account settings in your dashboard.

We will respond to requests within 30 days (or sooner if required by applicable law).

9.2 Account Deletion

You can delete your account at any time through your account settings or by emailing privacy@fluxpool.ai. Upon deletion:

• Your account and profile are deactivated immediately
• Your data is scheduled for permanent deletion within 30 days
• Any remaining credits in your account are forfeited (see Terms of Service)
• This action is irreversible

10. Regional Privacy Disclosures #

10.1 Thailand — Personal Data Protection Act (PDPA)

If you are a resident of Thailand, the PDPA provides you with additional rights regarding your personal data:

• Right to access, correct, delete, and port your data
• Right to restrict or object to processing
• Right to withdraw consent at any time
• Right to lodge a complaint with the Personal Data Protection Committee (PDPC)

Our legal bases for processing are as stated in Section 2. For questions about PDPA compliance, contact privacy@fluxpool.ai.

10.2 Philippines — Data Privacy Act (DPA)

If you are a resident of the Philippines, the DPA and its Implementing Rules provide you with:

• Right to be informed about data processing
• Right to access, correct, and erase your data
• Right to object to processing
• Right to data portability
• Right to damages for violations
• Right to lodge a complaint with the National Privacy Commission (NPC)

Our designated Data Protection Officer can be reached at dpo@fluxpool.ai.

10.3 Vietnam — Personal Data Protection Decree (PDPD)

If you are a resident of Vietnam, the PDPD provides you with:

• Right to be informed, consent to, access, correct, and delete your data
• Right to restrict processing
• Right to data portability
• Right to object to processing and lodge complaints

Cross-border data transfer disclosures: Your data may be transferred outside Vietnam for processing as described in Section 7. We implement appropriate safeguards for such transfers.

10.4 Indonesia — Personal Data Protection Law (PDP Law)

If you are a resident of Indonesia, the PDP Law provides you with:

• Right to obtain information about processing activities
• Right to access, correct, update, and delete your data
• Right to withdraw consent
• Right to object to automated decision-making
• Right to data portability
• Right to lodge a complaint with the supervisory authority

10.5 Malaysia — Personal Data Protection Act 2010 (PDPA)

If you are a resident of Malaysia, the Malaysian PDPA provides you with:

• Right to access and correct your personal data
• Right to withdraw consent
• Right to prevent processing for direct marketing

For data access requests under Malaysian PDPA, contact privacy@fluxpool.ai.

10.6 Singapore — Personal Data Protection Act 2012 (PDPA)

If you are based in Singapore, the Singapore PDPA provides you with:

• Right to access and correct your personal data
• Right to withdraw consent (with reasonable notice)
• We comply with the Do Not Call (DNC) provisions

Our Data Protection Officer can be reached at dpo@fluxpool.ai.

10.7 European Economic Area (EEA) & United Kingdom

If you are located in the EEA or UK, GDPR provides you with additional rights:

• All rights listed in Section 9.1
• Right to lodge a complaint with your local supervisory authority
• Right to restrict processing
• Right not to be subject to automated decision-making with legal effects

Legal bases for processing: contract performance, legitimate interests (Service improvement, security), consent (marketing), and legal obligations. Cross-border data transfer safeguards: Standard Contractual Clauses (SCCs) where applicable.

10.8 United States — California (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Request deletion of your personal information
• Opt out of the sale or sharing of personal information (we do not sell or share your data for cross-context behavioral advertising)
• Non-discrimination for exercising your rights

To exercise these rights, contact privacy@fluxpool.ai or use the account settings in your dashboard.

11. Children’s Privacy #

The Service is not directed to individuals under the age of 18 (or the applicable age of majority in your jurisdiction). We do not knowingly collect personal data from children.

If we learn that we have collected personal data from a child, we will delete it promptly. If you believe a child has provided us with personal data, contact us at privacy@fluxpool.ai.

12. Changes to This Policy #

We may update this Privacy Policy from time to time. When we make material changes:

• We will update the “Last Updated” date at the top of this page
• We will notify you via email or an in-app notification for significant changes
• Continued use of the Service after changes take effect constitutes acceptance of the updated policy

We recommend reviewing this page periodically.

13. Contact Us #

For questions, concerns, or requests related to this Privacy Policy or your personal data:

We aim to respond to all inquiries within 30 days.