Version 1.0, effective November 1, 2026. This policy explains how Flux3Max.io processes personal information when you use our website and service. Questions and requests go to privacy@flux3max.io.
1. Who is responsible for your data
The data controller is Code Canyon LLC, a limited liability company registered in Wyoming, United States, with its address at 30 N Gould St Ste N, Sheridan, WY 82801, USA. We have not appointed a data protection officer. The privacy contact is privacy@flux3max.io.
2. What we collect
- What you submit: the description you type, your first and last frame photos and the options you choose.
- What we generate: generated videos with sound, and the status of each clip.
- Account data: the email address you sign in with, the name your Google account shares if you sign in with Google, and your credit balance.
- Order data: the plan you bought, the amount, the order reference and the payment status. We never see your card number.
- Technical data: request logs, IP address, browser type and security events.
- Support messages and the references you send with them.
We do not collect your contacts, location, precise device identifiers for advertising, or any biometric template. A check of a photo of a person assesses the image. It does not identify who the person is, and we keep no face-recognition data.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Produce generated videos with sound from what you submit, and deliver the result | Performing our contract with you |
| Check what you submit and what we generate for content we do not allow | Our legitimate interest in keeping the service safe, and our legal duties |
| Sign you in, keep your balance and process payments and refunds | Performing our contract, and legal obligations for accounting |
| Investigate reports, prevent abuse and fraud, and keep the service secure | Our legitimate interests and legal obligations |
| Measure which sources bring visitors and buyers (first-party attribution) | Our legitimate interest in understanding our own site |
4. How we process what you submit
When you start a clip, what you submit is sent to our servers and processed to produce generated videos with sound. Videos are made by FLUX 3 Max, a video model from Black Forest Labs and fal, run on fal's servers. Your description and your first and last frame are sent to fal, only to make your result. The description you type is checked automatically before any video is made; a request that breaks the Content Policy is refused and costs no credits. Every photo you upload as a first or last frame is checked automatically before it can be used, and a photo that fails is deleted straight away.
These providers process the content needed for their functions. We do not use your content or results to train any model, and we do not sell them. We cannot promise what a third-party provider does with content it processes, and we choose providers that process content only to provide their service.
5. Cookies and tracking
Strictly necessary cookies keep you signed in and protect your account. They cannot be switched off. First-party attribution records an anonymous visitor ID, the time of your first visit, the landing page, the referring website and campaign parameters, and can link them to your account when you register or buy. Site statistics come from Plausible Analytics, a privacy-focused service hosted in the EU. We use it to count visits and to see how many visitors reach each step of using the service, such as signing in or buying credits. Plausible sets no cookie and stores nothing on your device. It receives the page address, the referring website, campaign parameters, your browser and device type and an approximate country. It uses your IP address and browser type only to create a daily anonymous identifier and does not store them. It never receives what you submit, your name, your email address or an order number. We do this because of our legitimate interest in understanding and improving the service, and we honour the Do Not Track setting of your browser. We do not use advertising or other third-party tracking scripts, so there is no optional cookie to accept or decline.
6. Who we share data with
We do not sell personal information. We share it only with service providers that help us run the service, and they are bound to protect it: Cloudflare (hosting, storage and delivery), the AI providers described above, Google (sign-in), Plausible Analytics (cookieless site statistics), Link by Stripe (checkout and payment, as the reseller) and our support and email provider. We may disclose information when the law requires it or to protect people from harm, for example to report child sexual abuse material to the authorities.
Purchases are sold through Link, Stripe's checkout service, which acts as the reseller and merchant of record for your order. Link collects your payment details, billing address and any sales tax or VAT. We receive the order status, the amount and the email on the order, but never your full card details.
7. Security
Data is encrypted in transit. What you submit and the results we generate are kept in private storage and are reachable only through your signed-in account or short-lived signed links. Access to production systems is limited. If a breach affects your personal information we will tell you and the relevant authority without undue delay and, where the law sets a deadline, within it (for example 72 hours).
8. How long we keep data
| Data | Kept for | Then |
|---|---|---|
| What you submit | About 1 day after upload | Deleted from storage |
| Results we generate | 30 days after delivery | Deleted from storage |
| Diagnostic logs | About 14 days | Deleted |
| Account data | While your account is open, and up to 2 years after it is closed | Deleted or anonymized |
| Order, credit and refund records | As long as tax and accounting law requires, normally 7 years | Deleted or anonymized |
| Support messages | 2 years after the case closes | Deleted |
| Reports of misuse and the decisions on them | 3 years | Deleted |
Download the results you want to keep, because storage is temporary.
9. Your rights
You can ask us to give you access to your data, correct it, erase it, restrict its use, give you a portable copy, object to its use, and withdraw consent you gave. You also have the right to know how your data is used. Write to privacy@flux3max.io from the email address of your account. We answer within 30 calendar days and may need to verify that the account is yours. You may complain to your local data protection authority. Some data, such as payment records, must be kept by law, and a request does not override that.
10. Marketing
We do not send marketing email. We send only messages that the service needs, such as sign-in codes, order receipts and replies to your support requests.
11. Transfers across borders
Our providers operate in several countries, so your data can be processed outside the country where you live, including in the United States. Where the law requires it, we rely on appropriate safeguards for these transfers.
12. Children
The service is for adults only. You must be at least 18 years old. Do not submit a photo, video or recording of a child or of anyone under 18. If you believe content showing a minor was submitted, tell us at privacy@flux3max.io and we will review and remove it.
13. Links and changes
Our pages may link to other websites that have their own policies. We may update this policy when the service or our processing changes. For material changes we post the new version with its date at least 14 days before it applies, and we tell signed-in users where the law requires it.
14. Contact
Code Canyon LLC, 30 N Gould St Ste N, Sheridan, WY 82801, USA. Privacy: privacy@flux3max.io. General support: support@flux3max.io. We monitor both mailboxes on business days.