Privacy Policy

Product usage analytics

We record page visits and selected feature, template and download clicks using a random identifier stored for your browser session. Activity in the same browser session before and after sign-in may be associated with your account. We record a broad acquisition channel and a campaign identifier, when supplied, without retaining the referring URL. We use these records with task outcomes to understand popular features and improve the product. Analytics records do not include prompt text, uploaded media, passwords, full URLs, or IP addresses.

Optional click records are retained for up to 90 days, subject to a 100,000-event storage cap. You can disable optional analytics below. We also respect browser Do Not Track and Global Privacy Control signals. Necessary task, credit and order records continue to support the service; disabling analytics does not delete those business records.

Information we process

Account information includes your email address, display name, sign-in method and profile image if you provide one. When you use Google sign-in, we receive the identity information needed to authenticate your account, such as your Google account identifier, email address and name.

Workspace information includes prompts, reference files, uploaded media, generated results, folders, task history and your actions within the service. When you use credits or purchase a plan, the related credit, order and subscription records are associated with your account.

Our hosting and security services may process technical information such as IP addresses, browser details, request timestamps and error information to deliver and protect the website.

How we use information

We use information to sign you in, maintain your workspace, process requested tasks, show your credit and order history, respond to support requests, prevent misuse and troubleshoot failures.

Where applicable law requires a legal basis, processing may be necessary to provide a requested service, comply with legal obligations, protect the security and operation of the service, or act on consent where required.

Service providers and disclosures

Flumi AI uses infrastructure and service providers to operate the website. These include Cloudflare for network delivery and security, hosting infrastructure, Google when you choose Google sign-in, and Resend for account emails.

When an AI task is available and you submit it, the prompt and necessary reference content are sent to the selected processing provider, which may be accessed through fal.ai. Provider processing is subject to the applicable provider terms and privacy practices. Do not upload sensitive information you are not authorized to share.

When safety checks are enabled, uploading media or preparing a creation can send prompts, reduced-size images or sampled video frames to OpenAI for content moderation. Generated results may also be checked before delivery. Audio is not included in these checks. Our moderation cache stores content hashes, categories and decisions without storing raw prompts or media in that cache. Cached decisions expire after 24 hours; expired records are removed when subsequent checks complete. Processing by OpenAI is subject to its API data policies.

When a paid checkout is offered, payment processing is handled through Stripe. Flumi AI receives transaction and subscription information needed to manage purchases; payment card entry is handled by the payment provider. We may also disclose information where required by law or to investigate fraud and protect users.

Content enforcement and human review

To enforce content rules, we record the account identifier, content hash, detected category, policy version and time of counted violations, together with restriction, suspension and release actions. These enforcement records do not copy raw prompts or uploaded media. Enforcement records are separate from the 24-hour moderation cache and may be retained for security, dispute handling and review as described under Retention and account controls.

When automatic enforcement is enabled, three distinct prohibited submissions within 24 hours can suspend an account until manual review. Repeated content is deduplicated within the counting window. Safety-service errors and generated outputs do not count against the user. You can request human review through the public contact page without signing in. We use the information you provide to investigate and decide whether to restore access.

When operational notifications are enabled, we send aggregate daily counts of violations, affected users, restrictions, suspensions and manual releases to an administrator through Telegram. These notifications contain no account identifiers, email addresses, prompt text, uploaded media or media links. Telegram processes the notification and bot delivery metadata under its own policies.

Cookies and local storage

We use session cookies to keep you signed in and authentication cookies to complete sign-in securely. Browser local storage saves preferences such as language, appearance and creative drafts. It also keeps up to 100 account-scoped hashes of inputs explicitly rejected by our content checks for up to 24 hours, so repeated attempts can be stopped before upload. This cache contains no raw prompts or media, and may be cleared when you sign in or sign out. A cache miss does not bypass server-side review. Disabling or clearing this storage can sign you out or remove locally saved preferences and drafts.

Retention and account controls

We retain account and workspace information as needed to provide the service, address disputes, maintain security and meet legal obligations. Retention depends on the type of information and its purpose; account closure does not necessarily erase required billing or security records.

You can manage your profile and assets in your account. Account security settings include data export and account closure options that may require reauthentication. If you cannot complete a request through the account, contact us for assistance. Deleted information may remain temporarily in backups until those backups are replaced.

Your privacy choices

Depending on your location, you may have rights to access, correct, delete or receive a copy of personal information, object to or restrict processing, and withdraw consent where processing relies on it. We may need to verify your identity before fulfilling a request. You may also contact your local data protection authority.

International processing and security

Infrastructure and providers may process information outside your country. Applicable protections depend on the provider, processing location and legal requirements. We use measures intended to protect information, including HTTPS and access controls, but no online service can guarantee absolute security.

Children and updates

Flumi AI is not intended for children under 18. Please contact us if you believe a child has provided personal information.

We may update this policy as the service changes. The date above identifies the current version; material changes will be communicated as required by applicable law.

Usage analytics preferences