Privacy Policy

1. Scope and controller

This Privacy Policy explains how FluxoKit, LLC (FluxoKit, we, or us) handles personal information collected through fluxokit.ai, the FluxoKit workspace, related tools, support channels, and marketing activities for the English-market service, including Stripe billing. It also serves as our notice at collection: the categories of personal information we collect and the purposes for which we use them are described below.

Paid checkout is live. FluxoKit accepts paid subscriptions billed in U.S. dollars through Stripe, and these policies govern that paid checkout.

FluxoKit is the controller of the personal information described in this policy. The Brazil market surface at /pt-br publishes its own Portuguese privacy notice; this policy governs the English-market service.

2. Personal information we collect

Information you provide: contact and account data (name, email address, password or sign-in provider identifier), profile and workspace settings, communications with support, transactional records (plan, credits, invoices, receipts), marketing preferences, and the inputs you submit, including prompts, uploads, references, and the generated outputs stored in your workspace.

Payment data: payment card and billing details are collected and stored by Stripe, not by FluxoKit. FluxoKit stores Stripe customer, subscription, invoice, event, and entitlement identifiers rather than full card numbers.

Information from other sources: when you sign in with a third-party provider such as Google, we receive the account identifier, name, email address, and profile image that provider makes available under your settings. We may also receive data from analytics, fraud-prevention, and advertising partners as described below.

Information collected automatically: device and browser data (type, operating system, screen size, language, IP address, and approximate location derived from IP address), online activity (pages viewed, referrers, session timing, generations run, and errors), attribution parameters from links you click, security logs, and cookie or similar identifiers. Section 8 describes cookies and advertising choices.

If you upload photos or images of people (including your own likeness), those images may contain facial or other biometric-related features. We process uploads only to provide the generation or edit you request, retain them only as long as needed for the service, your account, and legal or security obligations, and do not use them to build a facial-recognition database or sell them. Depending on your state (for example, Illinois BIPA, Texas CUBI, or Washington My Health My Data), additional consent or limits may apply.

3. How we use personal information

We use personal information to provide the service, process generations, maintain accounts and credits, operate billing, prevent abuse and fraud, secure the platform, support customers, analyze reliability, send service communications, and comply with legal obligations. In more detail, we use it for:

• Service delivery: running generations, maintaining your account, credits, and workspace, and sending service notices such as receipts, security alerts, and support replies.
• Billing: processing subscriptions, top-ups, refunds, taxes, and disputes through Stripe.
• Safety and integrity: preventing abuse, fraud, and violations of our Terms or provider policies, and securing the platform.
• Improvement and analytics: understanding reliability, usage, and product performance so we can improve the service.
• Marketing: sending product updates and promotional messages you can opt out of at any time, and measuring campaigns.
• Compliance and protection: meeting legal, tax, and accounting obligations, responding to lawful requests, and protecting rights, safety, and property.
• Aggregated data: creating de-identified statistics that no longer identify you, which we may use and share for lawful business purposes.

4. AI processing and model training

FluxoKit does not use private customer inputs or outputs to train its own foundation models. Third-party AI providers process submitted content under their own terms, which may include using it to operate or improve their models.

Your inputs and outputs are sent to the third-party model provider you select for the generation you request, together with the technical parameters needed to run it. Each provider processes that content under its own terms; the About page lists the providers FluxoKit integrates. FluxoKit does not sell your inputs or outputs.

5. How we share personal information

FluxoKit shares personal information only as needed to operate the service, as described here, or with your direction. Categories of recipients include:

We do not sell personal information for money. Some analytics or advertising technologies may be considered sharing under certain U.S. state privacy laws; where applicable, you can use the privacy request process below to opt out of sale or sharing.

• AI model and compute providers that run the generation you request.
• Infrastructure and operations providers for authentication, database, hosting, storage, email delivery, analytics, and support tooling.
• Stripe, for payments, tax calculation, fraud checks, invoices, receipts, and the Customer Portal.
• Analytics and advertising partners, subject to the privacy choices described in Section 8.
• Professional advisors, authorities, and other parties where required by law, to protect rights and safety, or in connection with a merger, acquisition, financing, or sale of assets.
• People or services you direct us to share with, such as when you share a workflow or asset by link.

6. Stripe and payment data

Stripe processes payment data for paid checkout. Stripe's hosted payment surfaces handle payment methods, fraud checks, tax calculation, invoices, receipts, refunds, disputes, and customer billing management.

FluxoKit uses Stripe billing events as provider input, then reconciles those events into internal subscription, entitlement, credit, invoice, and refund records.

7. Retention

We keep personal information while needed for your account, service operation, security, billing, tax, legal obligations, fraud prevention, dispute handling, support, and legitimate business records. The retention period depends on the type of information, the purpose for which it was collected, and the applicable legal requirements.

When information is no longer needed, we delete it, anonymize it, or isolate it from further processing. Assets and workflows you delete may persist in backups for a limited period before removal.

8. Cookies, analytics, and advertising choices

We use cookies and similar technologies for authentication, session continuity, security, analytics, attribution, product reliability, and abuse prevention. Essential cookies are required for the platform to work.

Non-essential analytics and advertising technologies are subject to your privacy choices: FluxoKit honors the Global Privacy Control browser signal automatically, and you can opt out of the sale or sharing of personal information for advertising at any time using the Do Not Sell or Share My Personal Information link in the site footer or the Your Privacy Choices page.

9. Your choices

You can exercise the following choices at any time:

• Access and update: review and update account information in your dashboard settings.
• Marketing opt-out: use the unsubscribe link in any marketing email or contact us. Service messages such as receipts and security notices continue while you have an account.
• Cookies and signals: manage cookies in your browser, and use the Your Privacy Choices page or the Global Privacy Control signal for advertising opt-outs.
• Delete content or your account: delete assets and workflows from your workspace, or contact us to delete your account. Deletion removes your content from active systems, subject to backup cycles and records we must keep for legal, billing, or security reasons.
• Declining to provide information: some information is required to provide the service; without it, some features may be unavailable.

10. Security

We use technical and organizational measures such as HTTPS/TLS, access controls, audit logs, provider security controls, and database security controls. No online service can guarantee absolute security. If a breach affects your personal information, we notify you and the relevant authorities where the law requires.

11. International processing

FluxoKit and its providers may process data in the United States, Brazil, and other countries where infrastructure and service providers operate. Data protection laws may differ by location.

12. Children

FluxoKit is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13 without verifiable parental consent. Where the CCPA/CPRA applies, we do not sell or share the personal information of consumers under 16 without opt-in consent. If you believe a child has provided personal information, contact us and we will delete it.

13. Other sites and services

The service links to third-party sites and services, including model providers, Stripe, and FluxoKit's social profiles. Their privacy practices are their own, and a link is not an endorsement. Read the privacy policies of the services you use.

14. U.S. state privacy rights

This section supplements the rest of this policy for residents of California and other U.S. states with comprehensive privacy laws.

Depending on your location and the laws that apply, you may have rights to know, access, delete, correct, port, or limit the use of personal information, and to opt out of sale, sharing, or certain targeted advertising uses.

California residents may have rights to know, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, receive notice at collection, and exercise rights without discrimination. We will not require you to create a new account only to submit a privacy request. To opt out of the sale or sharing of personal information for cross-context behavioral advertising, use the Do Not Sell or Share My Personal Information link in the site footer or the Your Privacy Choices page; FluxoKit also honors the Global Privacy Control browser signal.

To exercise these rights, submit a request to support@fluxokit.ai or use the Your Privacy Choices page. We may verify your identity and, where permitted, ask for the information needed to locate your data. You may use an authorized agent with proof of authorization. If we deny a request, you may appeal by replying to our response.

California Shine the Light: California residents may request information about disclosures of personal information to third parties for those parties' own direct-marketing purposes. FluxoKit does not make such disclosures.

15. Users outside the United States

FluxoKit is based in the United States and processes personal information there. If you use the English-market service from another country, your information is transferred to and processed in the United States, where privacy laws may differ from those of your country.

Customers of the Brazil market surface at /pt-br are covered by the Portuguese privacy notice and can submit rights requests under Brazilian data-protection law through the contact details below.

16. Changes to this Privacy Policy

We may update this policy from time to time. For material changes, we provide notice by email or in the product before the change takes effect and update the date above. Continued use of the service after the effective date is your acknowledgment of the updated policy.

17. Requests and contact

To submit a privacy request, contact support@fluxokit.ai, call +1 (302) 444-2862, or write to FluxoKit, LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States. We may verify your identity before acting on a request. Where the CCPA applies, we aim to respond within 45 days unless a permitted extension applies; other requests will be handled within the legally applicable period.