Privacy Policy

This policy explains what Flux3Max SI (flux3max.si, owned and operated by Lunonia Inc.) keeps about you, why, for how long, and who processes it for us. The short version: your videos are deleted after 30 days, your images with them, and we don't sell your data.

1. What we keep and for how long

• An image you upload (first or last frame): kept in our file storage with its video and deleted 30 days after the video is made.
• Your videos: deleted 30 days after they are made.
• A record of each video, without the files: the model, the mode, your prompt, the format, length, quality and sound setting, whether you uploaded images and confirmed you have the right to use them, its status, why it failed if it did, timings, and the account and device that made it.
• Moderation records: the time, the video they belong to, which check it was, the result and the moderation model's answer. Kept long term, so decisions can be reviewed.
• A random device ID, kept in your browser’s storage and in a cookie: links your videos and history to this browser and helps us limit abuse.
• Your IP address: used to stop abuse (rate limits) and to tell which country a visit comes from. Where we keep it, we store a salted hash of it, not the address itself.
• Your account: your email address (and, with Google sign-in, the name and profile picture Google shares), your sign-in sessions, your credits and credit history.
• Payments: Stripe handles your payment details. We receive the payment ID, the product or plan, the billing period, the amount, the status, renewal and cancellation dates, and the email address you paid with.
• Usage events, linked to the device ID or your account: the page you landed on, the site and campaign that sent you, device type, country, and actions such as starting a video or opening checkout.

Records without an end date above are kept until you ask us to delete them (section 5).

2. Your images

An image you upload is shrunk in your browser before uploading. It is sent to fal.ai for an automated moderation check and then to the video model to make your video. We do not use it to train AI models.

3. Who processes data for us

• Cloudflare runs the Service: hosting, the database (in eastern North America), file storage and sign-in emails.
• fal.ai (Features & Labels Inc., United States) runs the AI models: the image check and the video model, using your choices, your prompt and your images. How long fal keeps requests is set out in fal's privacy policy.
• Inworld (Theai, Inc., United States) passes your prompt to an AI safety model (OpenAI’s gpt-oss-safeguard) that checks it against our content rules. When you press Improve prompt, Inworld also passes the prompt, with the length, format and sound you picked, to Anthropic’s Claude Haiku model, which rewrites it. Your images and your account details are not sent to either. How long they keep requests is set out in Inworld’s privacy policy.
• Stripe runs checkout, payments, receipts and refunds and receives your payment details directly.
• Google: if you sign in with Google, Google sends us your name, email address and profile picture. Google Analytics, on flux3max.si only, records which pages are visited and where visitors come from.

We don't sell your data.

4. Cookies and browser storage

• Device ID (browser storage and a cookie of the same name): links your videos to this browser and helps limit abuse. Kept until you clear your browser data.
• Bot-check pass (cookie): shows you passed the Turnstile check; 24 hours.
• Your choices in the tool (browser session storage): so sign-in and checkout bring you back to the same video; cleared when you close the tab.
• Sign-in session cookies: only if you sign in; until you sign out or the session expires.
• Google Analytics cookies (_ga and _ga_*): only on flux3max.si, to count visits. We don't turn on Google's advertising features.
• YouTube videos on the “Is it real?” page: nothing loads from YouTube until you press play. When you do, the video plays from youtube-nocookie.com and YouTube (Google) receives your IP address and may set its own cookies, under Google’s privacy policy.

5. Your rights

You can ask for a copy of the data we hold about you, or ask us to correct or delete it: email support@flux3max.si from the address on your account. We complete requests within 30 days. Deleting your account removes your videos, images and credits.

We keep moderation records after an account is deleted, without your email address. Payment records kept by Stripe follow Stripe's own policy and legal retention rules.

6. Children

The Service is not meant for anyone under 13, and we don't knowingly collect their data. If you believe a child has given us personal data, email support@flux3max.si and we will delete it.

7. Changes

We may update this policy. Changes are posted on this page with a new date. See also the Terms and the Refund Policy.