Privacy Policy
Last Updated: July 6, 2026 | Effective Date: July 6, 2026 | Version: 2.0
1. Introduction
Welcome to FlowPic.ai, an AI creative platform for generating product photos, ad creatives, thumbnails, landing page visuals, and short-form video concepts.
This Privacy Policy explains how FlowPic.ai ("FlowPic," "we," "our," or "us") collects, uses, stores, shares, and protects your personal information when you use our services, and describes the rights you have regarding your data.
By accessing or using FlowPic.ai, you agree to the collection and use of information as described in this policy.
2. Information We Collect
2.1 Account Information
- What We Collect: Name, email address, profile picture (if using social login), and any other information you voluntarily provide during account creation.
- Purpose: To create and manage your account, authenticate your identity, and provide customer support.
2.2 Usage Data
- What We Collect: Information about how you interact with FlowPic.ai — features accessed, prompts submitted, generation history, click events, session duration, and usage frequency.
- Purpose: To analyze user engagement, improve our services, detect abuse, and personalize your experience.
2.3 Device and Technical Information
- What We Collect: IP address, browser type and version, operating system, device identifiers, referring URLs, and access timestamps.
- Purpose: To optimize our services for different devices, ensure security, and diagnose technical issues.
2.4 Cookies and Tracking Technologies
- What We Collect: Cookie identifiers, pixel tags, and similar tracking data placed on your device.
- Purpose: To maintain session state, remember preferences, measure platform performance, and enable analytics.
- Your Control: You may manage cookies through your browser settings. Disabling certain cookies may affect platform functionality. For EU/UK users, we obtain cookie consent per applicable law.
2.5 Payment and Billing Information
- What We Collect: Transaction amounts, billing dates, payment method type (last 4 digits only), and subscription status. We do not store full credit card numbers — all payment data is processed and stored by our third-party payment processors (Creem, PayPal).
- Purpose: To process payments, manage subscriptions, and detect fraudulent transactions.
2.6 AI Generation Content
- What We Collect: Text prompts you submit, generated image/video/music outputs, and associated metadata (timestamps, model used, generation parameters).
- Purpose: To deliver the service, improve AI model quality (where legally permitted and with appropriate consent), and maintain your generation history.
- Retention: Generation history is retained for the duration of your account. You may delete individual items at any time.
2.7 Communications
- What We Collect: Email correspondence with our support team, feedback submissions, and survey responses.
- Purpose: To respond to your inquiries and improve our services.
3. Legal Basis for Processing (GDPR — EU/UK Users)
For users in the European Union and United Kingdom, we process your personal data on the following legal bases under GDPR/UK GDPR:
| Processing Activity | Legal Basis |
|---|---|
| Account creation and management | Contract performance (Art. 6(1)(b)) |
| Service delivery and generation | Contract performance (Art. 6(1)(b)) |
| Payment processing | Contract performance (Art. 6(1)(b)) |
| Security and fraud prevention | Legitimate interests (Art. 6(1)(f)) |
| Analytics and service improvement | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)) — you may withdraw at any time |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
| Cookie consent | Consent (Art. 6(1)(a)) |
4. How We Use Your Information
We use collected data to:
- Provide, operate, and maintain our services
- Process transactions and manage subscriptions
- Send transactional emails (receipts, renewal notices, security alerts)
- Send marketing communications (only with your consent, and you may opt out at any time)
- Detect, investigate, and prevent fraudulent, harmful, or illegal activity
- Comply with legal obligations and enforce our Terms of Service
- Improve AI model outputs and platform features (using aggregate, anonymized data)
5. Data Sharing and Disclosure
We do not sell your personal information. We may share your data in the following limited circumstances:
5.1 Service Providers (Data Processors)
We share data with trusted third-party vendors who process it on our behalf, subject to contractual data protection obligations:
| Provider | Purpose |
|---|---|
| Creem, PayPal | Payment processing |
| Replicate, OpenRouter | AI model inference |
| Vercel, AWS, Cloudflare | Infrastructure hosting |
| Resend | Transactional email delivery |
| Microsoft Clarity, Vercel Analytics | Usage analytics |
5.2 Legal Requirements
We may disclose your information when required by law, court order, or government authority, or when necessary to protect the rights, property, or safety of FlowPic.ai, our users, or others.
5.3 Business Transfers
In the event of a merger, acquisition, or sale of assets, your personal data may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our website before such transfer occurs and any change in data controller takes effect.
5.4 Aggregate/Anonymized Data
We may share aggregated, de-identified statistics (e.g., "10,000 images generated per day") that cannot reasonably identify any individual.
6. International Data Transfers
FlowPic.ai operates primarily from the United States. If you are located in the EU, UK, or other regions with data transfer restrictions, your data may be transferred to and processed in the United States or other countries.
For transfers of EU/UK personal data, we rely on:
- Standard Contractual Clauses (SCCs) approved by the European Commission, or
- Adequacy decisions where applicable.
You may request a copy of our data transfer safeguards by contacting support@flowpic.ai.
7. Data Retention
We retain your personal data for as long as necessary to provide our services and comply with legal obligations:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account + 3 years after closure |
| Generation history | Duration of account (deletable by user at any time) |
| Payment records | 7 years (tax/legal compliance) |
| Support communications | 3 years |
| Analytics data (anonymized) | Up to 5 years |
| Server logs (IP, access logs) | 90 days |
Upon account closure, we will delete or anonymize your personal data within 30 days, except where retention is required by law.
8. Your Privacy Rights
8.1 Rights for All Users
Regardless of location, you have the right to:
- Access a copy of the personal data we hold about you
- Correct inaccurate or incomplete data
- Delete your account and associated personal data
- Opt out of marketing communications at any time (via unsubscribe link or email)
8.2 EU/UK Users — GDPR Rights
If you are in the EU or UK, you additionally have the right to:
- Data Portability — receive your data in a structured, machine-readable format (Art. 20)
- Restriction of Processing — limit how we use your data in certain circumstances (Art. 18)
- Object to Processing — object to processing based on legitimate interests (Art. 21)
- Withdraw Consent — where processing is based on consent, withdraw at any time without affecting prior lawful processing
- Lodge a Complaint — with your local Data Protection Authority (DPA). A list of EU DPAs is available at edpb.europa.eu. UK users may contact the ICO at ico.org.uk.
8.3 California Residents — CCPA/CPRA Rights
If you are a California resident, you have the right to:
- Know what personal information we collect, use, disclose, and sell
- Delete personal information we have collected from you
- Correct inaccurate personal information
- Opt-out of Sale or Sharing — We do not sell personal information. We do not share personal information for cross-context behavioral advertising.
- Limit Use of Sensitive Personal Information — We do not use sensitive personal information for purposes beyond those permitted by the CPRA.
- Non-Discrimination — We will not discriminate against you for exercising your CCPA rights.
Authorized Agents: California residents may designate an authorized agent to submit requests on their behalf by providing written authorization.
8.4 How to Exercise Your Rights
Submit a privacy rights request to:
Email: support@flowpic.ai
Subject Line: Privacy Rights Request — [Right You Are Exercising]
We will respond within 30 days (GDPR) or 45 days (CCPA), with the possibility of a single 45/90-day extension if necessary. We may need to verify your identity before fulfilling your request.
9. Data Security
We implement commercially reasonable technical and organizational security measures, including:
- TLS/SSL encryption for data in transit
- Encryption at rest for sensitive data
- Access controls and authentication requirements for internal systems
- Regular security reviews and vulnerability assessments
No method of transmission or storage is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify affected users and relevant authorities as required by applicable law (within 72 hours for GDPR-reportable breaches).
10. Children's Privacy
FlowPic.ai is not directed to children under the age of 13 (or 16 in the EU). We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided personal data, we will delete it promptly. If you believe a child has provided data to us, please contact support@flowpic.ai.
11. Third-Party Links and Services
Our platform may contain links to third-party websites or integrate third-party services. This Privacy Policy applies only to FlowPic.ai. We are not responsible for the privacy practices of third-party sites or services. We encourage you to review their privacy policies before providing any personal data.
12. Cookie Policy Summary
We use the following categories of cookies:
| Category | Purpose | Can Be Disabled? |
|---|---|---|
| Strictly Necessary | Session management, security, authentication | No |
| Functional | User preferences, language settings | Partially |
| Analytics | Usage statistics, performance monitoring | Yes (via cookie settings) |
| Marketing | Only used with explicit consent | Yes (withdraw consent) |
EU/UK users will see a cookie consent banner on first visit. You may update your preferences at any time.
13. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes (those that significantly affect your rights or how we use your data), we will:
- Post a prominent notice on our website, and
- Send email notification to registered users at least 14 days before the changes take effect (for EU/UK users) or 30 days in advance for material changes affecting GDPR legal bases.
Your continued use of FlowPic.ai after the effective date constitutes acceptance of the updated policy.
14. Contact Us
For privacy-related questions, data subject requests, or concerns:
Data Controller: FlowPic.ai
Email: support@flowpic.ai
Subject Line: Privacy Inquiry
Response Time: Within 2 business days (initial acknowledgment); within 30 days (substantive response)
Contact Page: flowpic.ai/contact
For EU/UK users who are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority.
By using FlowPic.ai, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your information as described herein.