Privacy Policy

1. Data Controller

From 26 September 2026, the controller responsible for operating AIFLUX is VALKYRIA STUDIO SRL, with registered office at Viale Monza 12, 20127 Milano (MI), Italy. For privacy requests, contact [email protected].

The change of operator does not by itself authorise new uses of your data. You can contact us at the addresses above about your account, previous processing or your privacy rights.

2. Personal Data Collected

AIFLUX collects the following categories of personal data:

• Registration data: username, email address, password (stored as a one-way password hash).
• Payment data: transactions are handled entirely by Stripe, Inc.. AIFLUX does not store credit card data. We store order and payment identifiers, the purchased package, amount, currency, status, credit records and relevant accounting information.
• Generated content: prompts, generation settings and status, output images, video, audio or 3D assets, and the storage references needed to retrieve them.
• Input files: images, videos, and audio files uploaded by the user as references for content generation. Files may be stored to provide generation, your gallery and Repeat, or processed temporarily depending on the feature. Deletion and backup handling are described in Section 5.
• Custom models: training datasets, captions, trigger words, training progress, previews, selected checkpoints and LoRA weights, used to train and run the model you request.
• Collaboration data: project names and descriptions, member identities, invitations, membership status and project-specific model sharing permissions. Accepted project members can see each other's nickname and email; the owner can also see pending invitations and manage access.
• Browser storage and optional analytics: local drafts and preferences, and consent-based usage events, as detailed in the Cookie Policy.
• Age-verification data: when you complete third-party age verification (Yoti), we receive and store only an "over-18: yes/no" result and an opaque, pseudonymous reference — never your name, date of birth, identity document or biometric data. Identity checks take place with the age-verification provider (see Section 6b).
• Content-safety data: a classification result from the automated content-moderation system (whether an uploaded or generated item is allowed or blocked, and the triggered category) is stored against the relevant generation.
• Technical data: IP address, browser user-agent, access timestamps — used exclusively for security purposes and abuse prevention.
• Technical cookies: session cookies and CSRF tokens strictly necessary for the functioning of the service (see our Cookie Policy).

3. Purposes of Processing

Personal data is processed for the following purposes:

• Service delivery: account creation and management, AI content generation and editing, requested LoRA training, project collaboration, model sharing and credit management.
• Payments: processing credit purchases through Stripe.
• Security: account protection, fraud prevention, rate limiting, detection of unauthorized access.
• Service communications: account verification emails, password resets.
• Marketing (consent-based only): sending promotional communications. You may withdraw your consent at any time.
• Age verification and content safety: verifying that users accessing adult (18+) content are of legal age, and screening uploaded and generated media to prevent and detect illegal content, in particular child sexual abuse material.
• Legal obligations: compliance with legal and tax obligations.

4. Legal Basis for Processing

The processing of personal data is based on the following legal grounds (Art. 6 GDPR):

• Performance of a contract (Art. 6(1)(b)): for the provision of the service and account management.
• Consent (Art. 6(1)(a)): for optional analytics and any consent-based promotional communications. Reading or acknowledging this notice is not marketing consent.
• Legitimate interest (Art. 6(1)(f)): for the security of the service and abuse prevention.
• Legal obligation (Art. 6(1)(c)): to comply with legal obligations (e.g., tax regulations), and any applicable age-verification, preservation and reporting duties. Safety checks also serve our legitimate interest in protecting users and preventing abuse.

5. Data Retention Period

We keep each category of personal data only for as long as necessary for the purpose for which it was collected (Art. 5(1)(e) GDPR). When you delete your account, your data is erased without undue delay (Art. 17 GDPR), except for the limited data we are required or entitled to keep set out below.

• Account data (username, email, hashed password): for the duration of the account and up to 30 days after deletion (technical wind-down).
• Input files (uploaded reference images/videos/audio): retained as needed for the requested feature, then queued for cleanup when the associated generation or account is deleted. Files used by an active task may remain until processing finishes. They are not used for unrelated model training.
• Generated content (prompts + output media): until account deletion or upon user request.
• Custom models and training data: kept as needed for the requested training and saved model. Deleting a model initiates cleanup of its stored files; a minimal record of the action may remain in security or audit records.
• Project data and grants: kept while the project, invitation or membership remains active. Revoked sharing permissions no longer allow model use in that project; separate security records may remain for the periods below.
• Payment & accounting records (Stripe session id, plan, amount, invoices): 10 years (Art. 2220 of the Italian Civil Code + tax law — legal obligation; kept even after account deletion).
• Security logs (IP address, user-agent, access timestamps, abuse/rate-limit events): up to 12 months (legitimate interest — security and abuse prevention).
• Audit logs (account and safety-relevant actions): up to 24 months for security, accountability and abuse prevention, then deleted or anonymised.
• Age-verification status (the "over-18" result + opaque reference): stored while valid (you may be asked to re-verify periodically) and cleared on account deletion.
• Content withheld by moderation: media blocked because it may be unlawful is not published and is kept in restricted storage only as long as necessary for safety and to comply with legal obligations. Material that is, or may be, child sexual abuse material is preserved and, where required by law, reported to the competent authorities — this retention is a legal obligation and applies even after account deletion.

Deletion from the live service and expiry of recovery backups are distinct. Residual copies may remain in restricted backups for their applicable retention period and must not be used for normal product access. A recovery must account for deletion requests before data is made available again. Contact support for the scope and retention applicable to a particular request.

Where a longer retention is required by a legal obligation, or to establish, exercise or defend a legal claim (Art. 17(3) GDPR), the relevant data is kept only for that purpose and for the period strictly necessary (e.g. until the applicable limitation period expires), and is then deleted or anonymised.

6. Recipients and Extra-EU Transfers

Data needed to operate the Service may be made available to these categories of recipients:

• Hosting, database, object-storage, backup, network-security and technical-support providers.
• AI generation, editing, model-training and moderation providers. The chosen feature determines which prompts, reference files, datasets or model weights must be transmitted for processing.
• Payment and transactional-email providers. Card details are handled by the payment provider, not stored by AIFLUX.
• Age-verification providers, for the checks you initiate; their separate notice is available during verification.
• Optional analytics providers, only after consent, as identified in the Cookie Policy. The current analytics integration uses PostHog's US service and links signed-in events to the account identifier; these events are not anonymous.
• Authorised project collaborators for the content and model use you share, and authorised staff, professional advisers or authorities where necessary for support, security or legal obligations.

Some providers process data outside the European Economic Area. Such transfers require an applicable GDPR safeguard, such as an adequacy decision or Standard Contractual Clauses with any necessary supplementary measures. A provider's location alone does not establish that a safeguard applies. You may request details of the recipients and safeguards applicable to your data, and a copy of relevant safeguards, from [email protected].

6b. Age Verification and Automated Content Moderation

Age verification. Eligible adult features require third-party age verification. AIFLUX receives a verification result and an opaque reference, rather than the identity document submitted to the provider.

Content safety. Prompts and media may be classified automatically to detect prohibited content. A classification can block a request or withhold a result. Automated classifications can be wrong: you may contest a decision and request human review at [email protected]. Age verification does not authorise unlawful content or waive safety rules.

Child safety. Suspected child sexual abuse material is not allowed. Access may be restricted and relevant information preserved or reported where required by applicable law.

7. Your Rights

In accordance with the GDPR (Articles 15-22), you have the right to:

• Access — obtain confirmation of processing and a copy of your personal data.
• Rectification — correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") — request the deletion of your data.
• Restriction — restrict processing in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interest.
• Withdrawal of consent — withdraw your consent at any time, without affecting the lawfulness of processing carried out prior to the withdrawal.

To exercise your rights, write to [email protected]. We will respond without undue delay and normally within one month. If an extension is necessary because of the complexity or number of requests, we will inform you within that month of the reasons and the applicable extension.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (www.garanteprivacy.it).

8. Minors

The service is intended only for adults: you must be at least 18 years of age (the age of majority) to create an account, consistent with our Terms of Service. Access to adult (18+) content additionally requires third-party age verification (see Section 6b). We do not knowingly collect data from anyone under 18. AIFLUX operates a zero-tolerance policy on child sexual abuse material: any such content is blocked, preserved and, where required by law, reported to the competent authorities. If you believe a minor has provided personal data, please contact us for removal.

9. Changes to This Policy

We reserve the right to update this privacy policy. In the event of substantial changes, we will notify you through the service or by email. The date of the last update is indicated at the top.

10. Contact

For questions about this notice or to exercise your privacy rights, email [email protected].