Privacy Policy

Last updated: 26 September 2026

This Privacy Policy explains how FluxArt ("we," "us," or "our") collects, uses, discloses, and protects your information when you visit and use our website FluxArt.ai (the "Website") and our AI art generation services (the "Services").

Please read this Privacy Policy carefully. By accessing or using the Website or Services, you agree to be bound by the terms and conditions of this Privacy Policy. If you disagree with any part of this Privacy Policy, then you may not access the Website or use the Services.

1. Information We Collect

We collect information that you provide directly to us, as well as information automatically collected when you use the Website or Services.

1.1 Information You Provide:

• Account Information: When you create an account, you may provide us with your email address, username, and password. You may also choose to provide us with your name and other profile information.
• Acceptance Records: The version of our Terms and Acceptable Use Policy you accepted, when you accepted them, how you signed up, and your confirmation that you are 18 or older.
• Prompts and Generated Images: The text prompts and settings you submit and the images you generate.
• Uploaded Photos: Photos you upload as a source for an edit, together with your confirmation that you have permission to use them. Uploaded Photos are stored privately, are never shown to other users, and are deleted automatically within 7 days.
• Communications: If you contact us directly, we will collect any information that you provide to us, such as your name, email address, and the content of your message.

1.2 Information Automatically Collected:

• Usage Data: We collect information about your use of the Website and Services, such as the features you access, the pages you visit, the time and date of your visit, and the links you click.
• Device Information: We collect information about the device you use to access the Website and Services, such as the device type, operating system, browser type, IP address, and mobile network information.
• Log Data: We automatically collect log data, which is information that your browser or device automatically transmits to us when you visit the Website or use the Services. This information may include your IP address, browser type, operating system, referring/exit pages and URLs, number of clicks, domain names, landing pages, pages viewed, and other such information.
• Device Fingerprint and IP Address (abuse prevention): When you sign up, sign in, and generate images, your browser computes a one-way hash of limited technical details (browser user agent, language, time zone, screen size and colour depth, and platform). The hash is stored in your browser (local storage, IndexedDB, and a first-party cookie) and sent to us, and we store a keyed version of it together with your IP address. We use it only to prevent abuse of free promotional credits: if a new account appears to duplicate another account, its welcome bundle is withheld and it cannot claim daily Basic Credits. This check never affects credits you have paid for. An automated match can be wrong; if you think it affected you by mistake, contact us at support@fluxart.ai and we will review it. We delete these records after 12 months.
• Cookies and Similar Technologies: We use strictly necessary cookies and browser storage for sign-in, security, remembering your cookie choices, and the abuse prevention described above. With your permission, we also use analytics and diagnostics tools: Google Analytics, and LogRocket, which records how you interact with our pages (session replay), with the text you type masked. You can allow or refuse these, and change your choice at any time, using "Cookie settings" in the site footer. We do not currently use advertising cookies.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and improve the Website and Services;
• Process and fulfill your requests for AI art generation;
• Send you technical notices, updates, security alerts, and support and administrative messages;
• Respond to your comments, questions, and requests and provide customer service;
• Monitor and analyze trends, usage, and activities in connection with the Website and Services;
• Detect, investigate, and prevent fraudulent transactions and other illegal activities and protect the rights and property of FluxArt.ai and others;
• Personalize your experience on the Website and Services;
• Send you news about FluxArt features and offers as an account holder. Every marketing email includes an unsubscribe link that works without signing in;
• For any other purpose for which you provide it;
• For any other purpose disclosed by us when we collect the information;
• With your consent.

2A. Automated Content Safety Checks

To keep FluxArt safe-for-work, we check content automatically:

• every prompt, before anything is generated;
• every Uploaded Photo, before it can be used;
• every requested edit of an Uploaded Photo, before generation, and its result afterwards;
• every generated image, before it is saved or shown, including private generations.

These checks use our own rules and the service providers listed in Section 3A. Content that breaks our rules is refused or discarded; borderline images may be held privately for review for up to 30 days, and their credits are returned. We keep a record of each decision (for example the category and the result) to operate our safeguards and enforce our Terms. For prompts refused before anything is generated, we store only a one-way keyed fingerprint and the length of the prompt, not the prompt text. Images refused by our checks are never saved to FluxArt's image storage or shown to anyone; Section 3B lists the records we do keep.

FluxArt does not use facial recognition, biometric identification, face templates, or age estimation.

Generated images we store include machine-readable metadata identifying them as AI-generated, where the file format supports it.

Repeated violations may pause or suspend an account automatically. If you believe a decision was wrong, contact us at support@fluxart.ai.

3. Sharing Your Information

We may share your information with third parties in the following circumstances:

• Service Providers: We share information with the service providers listed in Section 3A, who help us provide the Website and Services.
• Payments: Purchases are sold and processed by Dodo Payments, our reseller and Merchant of Record. Dodo Payments collects and processes your payment and billing details as an independent controller under its own Privacy Policy. We receive order details such as the plan, amount, and payment status, but not your full card details.
• Business Transfers: If FluxArt.ai is acquired by or merged with another company, your information may be transferred to the acquiring company.
• Legal Requirements: We may disclose your information if required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, (ii) protect and defend the rights or property of FluxArt.ai, (iii) act in urgent circumstances to protect the personal safety of users of the Website or Services, or the public, or (iv) protect against legal liability.
• Aggregate or De-identified Information: We may share aggregate or de-identified information about our users with third parties for marketing, advertising, research, or similar purposes.

3A. Service Providers We Use

We share the information needed for each purpose with these service providers:

• Replicate: Runs our image generation and editing models, including models from Black Forest Labs (FLUX), Google (Imagen, Nano Banana) and ByteDance (Seedream). Replicate deletes API inputs and outputs after about an hour. Prompts sent to Black Forest Labs' FLUX1.1 Pro models are also covered by Black Forest Labs' terms, which allow it to use inputs and outputs to improve its models.
• fal: Runs the image upscaling model. fal keeps request data for up to 30 days and makes the upscaled result available at an unlisted link for at least 7 days.
• OpenAI: Moderation of prompts and uploaded photos, and automated review of requested edits and their results. OpenAI does not use this data to train its models and may keep it for up to 30 days to monitor abuse.
• TypeSafe: Classification of prompt text for policy violations. TypeSafe does not use it to train its models.
• Amazon Web Services (Rekognition): Content moderation labels for generated images. Images are used only to return moderation labels, not to improve Amazon's services.
• Cloudflare: Image storage (R2) and content delivery.
• Supabase: Database and account authentication.
• Vercel: Website and API hosting.
• Upstash: Rate limiting.
• Brevo: Service emails and FluxArt product news.
• Google Analytics, LogRocket: Analytics and product diagnostics, including LogRocket session replay, only if you allow analytics cookies.

3B. Retention

• Uploaded Photos: deleted automatically within 7 days. We keep a record of each upload (a one-way fingerprint of the file, the check results, and your permission confirmation) as long as needed to enforce our Terms.
• Images held for review: deleted within 30 days unless released to you.
• Prompts refused before generation: the prompt text is not stored (only a keyed fingerprint and its length).
• Refused images: never saved to FluxArt's image storage. The image provider's job record described below may include a temporary link to the result, and the provider may keep its own copy for the periods in Section 3A. Content that may be illegal may be preserved privately and reported to the authorities.
• Image-provider job records: when a request is sent to an image provider, we keep the provider's record of that job (including the prompt, the settings and temporary links to the input and result) for 90 days for auditing, troubleshooting and billing disputes. This applies even if the result was later refused. For Unlimited Relax generations, a copy of the job record is also kept with your usage records while your account is active. These records are accessible only to our servers.
• Image-check records: we keep one-way fingerprints of checked images with their results so the same image is not checked twice; fingerprints of refused images are kept to stop them being uploaded again.
• Device fingerprints and related IP addresses: deleted after 12 months.
• Generated images and account data: kept while your account is active. When you delete content, we stop showing it; when you ask us to delete your account, we delete its data within 30 days of verifying the request. Database backups may keep copies for a limited period afterwards.
• Content-safety decision records: kept as long as needed to enforce our Terms, prevent abuse, and meet legal obligations. Content that may be illegal may be preserved and reported to the authorities as required by law.

4. Third-Party Services

The Website and Services may contain links to or integrate with third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of these third parties before providing them with any personal information.

5. Data Security

We have implemented reasonable security measures designed to protect your information from unauthorized access, use, or disclosure. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, we cannot guarantee its absolute security.

6. Your Privacy Rights

You may have certain rights with respect to your information, such as the right to access, correct, or delete your information. To exercise these rights, email us at support@fluxart.ai from the email address on your account. We delete account data within 30 days of verifying a deletion request. You can unsubscribe from marketing emails at any time using the link in any of them.

7. Children's Privacy

The Website and Services are only for people aged 18 or older. We do not knowingly collect personal information from anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its data. If you are a parent or guardian and you believe that your child has provided us with personal information, please contact us.

8. International Transfers

We and our service providers process information in the United States, the European Union and other countries where they operate. For example, OpenAI, Replicate, TypeSafe and LogRocket process data in the United States, and Brevo in the European Union. These countries may have data protection laws that differ from those where you live. Where the law requires safeguards for these transfers, we rely on our service providers' contractual commitments, such as standard contractual clauses in their data processing terms.

9. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on the Website. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

10. Contact Us

If you have any questions about this Privacy Policy, or want to exercise your privacy rights, please contact us at: support@fluxart.ai

FluxArt

support@fluxart.ai