Last updated: August 1, 2026 · Effective: August 1, 2026
FluxGood ("we," "us," or "our") operates the AI generative media platform at fluxgood.com. For purposes of applicable data protection law, FluxGood is the data controller of personal information collected through the Service.
| Category | Examples | When Collected |
|---|---|---|
| Account Information | Username, email address, password (hashed) | Registration |
| Payment Information | Billing email, subscription tier (card details held by payment processor) | Subscription purchase |
| User Content | Text prompts, uploaded reference images | Each generation request |
| Communications | Support emails, feedback messages | When you contact us |
| Category | Examples | Purpose |
|---|---|---|
| Usage Data | Pages visited, features used, generation counts | Service improvement, rate limiting |
| Device & Technical Data | IP address, browser type, operating system | Security, fraud prevention |
| Log Data | API request timestamps, error logs | Debugging, security |
| Geolocation | Country/region derived from IP (city-level, not GPS) | Analytics, compliance |
| Cookies | Session identifiers, preference tokens | Authentication, UX |
If you sign in via Google OAuth, we receive your Google account email, display name, and unique identifier as permitted by Google's OAuth consent. We do not receive your Google password.
We use collected information for the following purposes:
For users in the European Economic Area (EEA), United Kingdom, or Switzerland, we rely on the following legal bases:
| Processing Activity | Legal Basis |
|---|---|
| Providing the core AI generation service | Contract (Art. 6(1)(b)) |
| Processing payments, managing subscriptions | Contract (Art. 6(1)(b)) |
| Fraud prevention, security monitoring | Legitimate interests (Art. 6(1)(f)) |
| Sending transactional emails | Contract (Art. 6(1)(b)) |
| Aggregate analytics and service improvement | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications (if opted in) | Consent (Art. 6(1)(a)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
We use the following types of cookies:
You may control non-essential cookies through your browser settings or by using our cookie preference controls where available. Blocking cookies may affect service functionality.
We do not sell your personal information. We may share information with:
Your information may be transferred to and processed in countries other than your country of residence, including countries that may not provide the same level of data protection as your home country. When we transfer personal data from the EEA or UK to third countries, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other lawful transfer mechanisms.
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account plus 90 days after deletion request |
| Text prompts (generation logs) | 90 days for abuse monitoring, then deleted |
| Uploaded reference images | Deleted immediately after generation completes (not stored) |
| Generated images and videos | Stored in user's library until manually deleted or account closure |
| Payment records | 7 years for tax and accounting compliance |
| Server and security logs | 30 days rolling |
We implement industry-standard technical and organizational measures to protect your personal information, including:
No system is completely secure. In the event of a data breach that poses a high risk to your rights and freedoms, we will notify you and relevant authorities as required by applicable law.
Depending on your jurisdiction, you may have the following rights regarding your personal information:
| Right | Description | Applicable Law |
|---|---|---|
| Access | Request a copy of your personal data | GDPR, CCPA, PIPEDA |
| Rectification | Correct inaccurate or incomplete data | GDPR, PIPEDA |
| Erasure | Request deletion of your personal data | GDPR, CCPA |
| Restriction | Limit how we process your data | GDPR |
| Portability | Receive your data in a machine-readable format | GDPR |
| Objection | Object to processing based on legitimate interests | GDPR |
| Opt-out of sale | Direct us not to sell personal information | CCPA |
| Non-discrimination | Equal service regardless of privacy choices | CCPA |
To exercise any of these rights, contact us at privacy@fluxgood.com. We will respond within 30 days (or as required by applicable law). We may need to verify your identity before fulfilling requests.
The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a person under 18, please contact us immediately at privacy@fluxgood.com and we will delete such information promptly.
Our Service may contain links to third-party websites or integrate with third-party services (e.g., Google OAuth). This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you use in connection with our platform.
As an AI service provider, we are committed to responsible AI data handling:
We may update this Privacy Policy periodically. When we make material changes, we will update the "Last updated" date at the top of this page and notify registered users by email. We encourage you to review this policy regularly. Your continued use of the Service after any changes constitutes acceptance of the updated policy.
For privacy-related inquiries, requests, or complaints:
If you are located in the EEA or UK and believe we have not adequately addressed your privacy concern, you have the right to lodge a complaint with your local data protection authority (e.g., the UK Information Commissioner's Office or your national supervisory authority under GDPR).