GenFlexSummary
- Who is responsible. Extramile Limited, a company registered in Cyprus, is the controller of your personal data when you use GenFlex.ai.
- What we collect. Account and payment details, the prompts and images you submit, the images and videos you generate, how you use the Service, and technical data from your device.
- How generation works. To create an output, we send your prompt (which we may rewrite) and any uploaded image to a third-party AI model provider, who returns the result to us. We store your outputs in your account.
- No training on your content. We do not use your prompts, uploads or outputs to train AI models, and we require our model providers not to do so either, unless we tell you otherwise for a specific model before you use it.
- Safety review. Prompts, uploads and outputs are checked by automated systems, and in some cases by trained staff, to prevent illegal and harmful content.
- Your rights. You can access, download, correct and delete your data, and object to or restrict certain processing. See Section 10 (all users) and Section 15 (US residents).
1. Who we are and what this policy covers
1.1. Controller. GenFlex.ai is operated by Extramile Limited, a company incorporated in Cyprus with registration number HE445953 and registered office at 75 Prodromou Avenue, Oneworld Parkview House, 2063 Nicosia, Cyprus (“GenFlex”, “we”, “us”). GenFlex is the controller of the personal data described in this policy, which means we decide how and why it is processed. Merchant of record. If Fulfilling Inc. (Delaware, USA) processes a order for you pursuant to our Terms, it operates as an separate data controller regarding the transactional and payment details required for that transaction.
1.2. Scope. This policy applies to the GenFlex.ai website, web application, iOS and Android apps, and related communications and support (the “Service”). It applies to users worldwide. Section 15 adds information for residents of US states with consumer privacy laws. Terms used here have the same meaning as in our Terms and Conditions.
2. Personal data we collect
2.1. Information you give us
- Account information: email address, name or display name, password (stored as a secure hash) or sign-in credentials from a third-party login provider such as [Apple / Google], your date of birth or confirmation that you are 18 or over, and your settings and preferences.
- Communications: messages you send to support, reports you submit (for example, about content or copyright), feedback, and survey responses.
- Marketing preferences: your choices about marketing emails and advertising.
2.2. Content you submit and generate (“Your Content”)
- Prompts and settings: the text you type, the templates, styles and parameters you select, and any rewritten version of your prompt that our systems create (Section 3).
- Uploaded content: images and other files you upload, for example to edit an image or generate a video from it.
- Outputs: the images, videos and audio generated for you, together with their metadata (such as creation time, model used and content credentials).
Your Content may include personal data about you or other people, for example a photo of a person or a prompt that names someone. See Section 5.
2.3. Payment and transaction information
- Purchases and billing: your plan, subscription status, renewal dates, purchases of refill tokens, amounts paid, currency, taxes, invoices and receipts, billing country, and refund and chargeback records.
- Payment details: your payment card or other payment details are collected and processed directly by our payment service providers or the app stores. We receive only limited information, such as the card type, the last four digits, the expiry date, the country of issue and the result of the payment.
- Token ledger: a record of every token credit and debit on your account (source, amount, time and the generation it relates to).
- Consent records: records of the terms, consents you accepted at purchase, with the date, time and version.
2.4. Information collected automatically
- Device and technical data: IP address, approximate location derived from the IP address (country and region), device type, operating system, browser, app version, language, time zone and device identifiers including, where you allow it, the mobile advertising ID.
- Usage data: the features and models you use, generations requested, token costs, errors, response times, pages and screens viewed, and clicks.
- Logs and security data: access logs, login events, security events, and signals used to detect fraud, abuse and automated access.
- Cookies and similar technologies: see Section 11.
2.5. Information generated by the Service
- Moderation and safety records: results of automated checks on prompts, uploads and outputs (for example, a category and confidence score), actions taken (such as a block or removal), reviewer notes, reports about your account and your appeals.
- Account status: warnings, restrictions, suspensions and their reasons.
2.6. Information from third parties
- Sign-in providers: if you sign in with Apple / Google, we receive your name and email address and an account identifier.
- Payment providers and app stores: payment status, fraud-screening results, refunds and chargebacks.
- Advertising and attribution partners: information about the ad campaign that brought you to GenFlex (such as a click identifier or campaign name), where you have consented or have not opted out.
- Model providers: the outputs they generate, prompt and technical information about the request (for example, processing time and errors).
- Other users and third parties: reports about content or accounts, including copyright and non-consensual imagery notices.
3. How AI generation works and what happens to your content
3.1. The generation process. When you submit a request:
- We receive your prompt, settings and any uploaded image.
- Our systems and providers check the request against our safety rules and may block it. Our systems may rewrite, expand or translate your prompt, choose a model and set parameters, based on the content of your request, the options you chose, your plan and the availability, quality and cost of the models.
- We send the request (the final prompt, settings and any uploaded image) to the provider that operates the selected model. We do not send your name or email address to model providers, and we use request identifiers that do not reveal who you are.
- The provider generates the output and returns it to us. We check the output, apply AI-content marking (Section 3.5), store it in your account and deliver it to you.
3.2. Model providers. We do not operate most of the AI models available in the Service. We use fal (fal – Features & Labels, Inc., United States), an AI inference and model-hosting platform, to power our core generation features, including image generation, video generation, image-to-image editing, templates and post-processing tools such as upscaling. When you use these features, we send fal your final prompt, settings and any uploaded image, and fal returns the output to us. Some models available through fal are operated by their developers (for example, where a model is available only through the developer's own system). In that case, fal passes your request to that developer to generate the output.
fal and these model developers (together, “model providers”) process your requests as processors, with fal serving as our main data processor and external model creators acting as its sub-processors. They may use Your Content only to generate outputs and to keep their services secure and operational. They must protect it, and they may not use it for their own purposes, including to train or improve their models. We do not send model providers your name or email address. The model providers we use, and where they process data, are listed in Section 7.3. fal's own practices as a company are described in the fal Privacy Policy, but its processing of your data for GenFlex is governed by our contract with fal and by this policy.
3.3. Use of your content by GenFlex. We use Your Content to provide the Service to you, to keep it safe (moderation, abuse and fraud prevention), to provide support when you ask us to, and to comply with the law. We also use information about your requests that does not include the content itself, such as the model used, token cost, success or failure and processing time, to operate and improve the Service.
3.4. No training on your content. We do not use your prompts, uploads or outputs to train or fine-tune AI models, and we do not provide them to others for that purpose.
3.5. AI-content marking. To meet transparency requirements, outputs contain machine-readable information showing that they were generated by AI. This information identifies GenFlex and the type of model used. It does not contain your name, email address or account identifier.
3.6. Human review. Our staff do not routinely look at Your Content. Authorised and trained members of our trust and safety, support and legal teams, and our moderation service providers, may review specific prompts, uploads or outputs when: an automated system flags them; someone reports them; you ask us for support concerning them; or we need to investigate a suspected breach of our Terms or comply with the law.
3.7. Your control. You can delete individual outputs and uploads, or your whole account, at any time. Outputs are private to your account unless you choose to share them.
4. How we use personal data and our legal bases
We use personal data only for the purposes below. Where we rely on legitimate interests, we have balanced them against your rights and you can object (Section 10). Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.
| Purpose | Personal data | Legal basis (GDPR) |
|---|---|---|
| Creating and managing your account, including authentication and age confirmation | Account information, device and log data | Contract (Art. 6(1)(b)); for age confirmation, legitimate interests in keeping minors off an 18+ service (Art. 6(1)(f)) |
| Providing AI generation: checking, rewriting and routing requests, selecting models, sending requests to model providers, receiving, marking and delivering outputs | Your Content, technical data | Contract (Art. 6(1)(b)) |
| Storing and displaying your outputs and history | Your Content | Contract (Art. 6(1)(b)) |
| Processing subscriptions, refills and payments; managing token balances; maintaining the token ledger; refunds and withdrawals | Payment and transaction information, ledger, account information | Contract (Art. 6(1)(b)) |
| Keeping accounting, tax and transaction records, and records of consumer disclosures and consents | Payment and transaction information, ledger, consent records | Legal obligation (Art. 6(1)(c)) |
| Sending service messages, such as purchase confirmations, renewal reminders, security alerts and changes to our terms | Account information | Contract (Art. 6(1)(b)); legal obligation where the law requires the notice (Art. 6(1)(c)) |
| Customer support and handling complaints | Communications, account, transaction and usage data, relevant Your Content | Contract (Art. 6(1)(b)); legitimate interests in resolving complaints (Art. 6(1)(f)) |
| Content moderation and preventing illegal or harmful content, including handling reports, statements of reasons and appeals | Your Content, moderation records, account and usage data | Legitimate interests in keeping the Service and its users safe and preventing the generation of illegal content (Art. 6(1)(f)); legal obligation under the EU Digital Services Act for notice handling, statements of reasons and reports of threats to life or safety (Art. 6(1)(c)) |
| Reporting child sexual abuse material to NCMEC and competent authorities, and preserving related evidence | Relevant Your Content, account, technical and moderation data | Legitimate interests in protecting children and complying with reporting obligations that apply to us under US law (Art. 6(1)(f)); legal obligation where EU or Member State law requires it (Art. 6(1)(c)) |
| Security, fraud prevention and preventing misuse (including payment fraud, account takeover, scraping and token abuse) | Technical, log, usage, transaction and account data | Legitimate interests in protecting the Service, our users and our business (Art. 6(1)(f)) |
| Enforcing our Terms and establishing, exercising or defending legal claims | Any relevant data | Legitimate interests (Art. 6(1)(f)) |
| Complying with legal obligations and requests from competent authorities | Any relevant data | Legal obligation (Art. 6(1)(c)) |
| Operating and improving the Service using aggregated or de-identified usage data (for example, model performance, error rates, feature use, token economics) | Usage data, technical data, ledger data (not Your Content) | Legitimate interests in running and improving our Service (Art. 6(1)(f)) |
| Product analytics using cookies or SDKs on your device | Usage and device data | Consent (Art. 6(1)(a)), where ePrivacy rules require it; otherwise legitimate interests |
| Developing future features and our own AI models using Your Content | Your Content | Consent (Art. 6(1)(a)), where ePrivacy rules require it; otherwise legitimate interests |
| Marketing emails about GenFlex | Email address, marketing preferences, engagement data | Consent (Art. 6(1)(a)); or, for existing customers, legitimate interests in promoting similar services (Art. 6(1)(f)) |
| Measuring the effectiveness of our advertising (Section 12) | Hashed email, click identifiers, conversion events, device data | Legitimate interests, subject to your opt-out |
5. Sensitive information and information about other people
5.1. We do not ask for sensitive data. We do not ask for, and the Service is not designed to process, special categories of personal data (such as data about health, ethnic origin, religion, sexual life or orientation, political opinions or biometric data), or data about criminal offences. Please do not include such information in your prompts or uploads.
5.2. If you include it. If you choose to include sensitive information about yourself, we process it only to carry out your request and to keep the Service safe, and we do not use it for any other purpose, analyse it or use it to profile you. Where the law treats this as processing of special category data, we rely on your explicit consent, which you give by deliberately including the information. You can withdraw it by deleting the content.
5.3. Images of people. Photos of people are personal data. We do not use facial recognition, do not create facial templates or biometric identifiers, and do not try to identify the people shown in your images or outputs. Our moderation systems may analyse images to detect prohibited content (for example, whether a person appears to be a minor), without identifying anyone.
5.4. Other people’s data. Only upload images of other people, or include information about them, if you have the right to do so and, where required, their consent. Our Terms and AUP prohibit creating content that depicts real people in an intimate, sexual, degrading or misleading way. If you believe that content involving you has been created on GenFlex, you can report it at support@genflex.ai.
6. Automated processing and moderation
6.1. What is automated. We use automated systems to: select models and parameters for your requests; rewrite prompts; classify prompts, uploads and outputs against our content rules; detect fraud, abuse and automated access; and calculate token costs and balances; and provide automated support where applicable. Payment providers carry out their own automated fraud checks when you pay.
6.2. Effects on you. An automated system may block an individual request, withhold an output, flag content for review or temporarily limit your usage. Decisions to suspend or close your account are always reviewed by a person before they take effect, except where immediate action is needed to prevent serious harm (for example, suspected child sexual abuse material), in which case a person reviews the decision promptly afterwards. We do not make decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you within the meaning of Article 22 GDPR.
6.3. No profiling for advertising within the Service. We do not show third-party advertising within the Service, and we do not build profiles of your interests from Your Content.
7. Who we share personal data with
7.1. We do not sell your personal data for money. We share personal data only as described below. (For the meaning of “sale” and “sharing” under US state laws, see Section 15.)
7.2. Recipients
| Recipient | Why | Data | Role |
|---|---|---|---|
| AI model and inference providers (Section 7.3) | To generate outputs | Final prompt, settings, uploaded images, outputs, request identifiers, limited technical data | Processors (and their sub-processors) |
| Cloud hosting, storage and content delivery | To host the Service, store Your Content and deliver outputs to you | All categories stored in the Service | Processors |
| Content moderation and safety providers | To classify prompts, uploads and outputs and detect known illegal images | Your Content, request identifiers | Processors |
| Payment service providers Primer ( https://primer.io/privacy ) Stripe Privacy Policy ( https://stripe.com/en-pl/privacy ) PayPal Privacy Policy ( https://www.paypal.com/us/legalhub/paypal/privacy-full ) |
To process payments, refunds and chargebacks and prevent payment fraud | Transaction data, billing country/state, email, device and IP data | [Primer]: processor. Card acquirers and payment service providers: independent controllers for their own legal and card-scheme obligations (for example, anti-money-laundering and fraud prevention) |
| Apple App Store and Google Play | To process in-app purchases and subscriptions | Purchase and subscription data | Independent controllers under their own privacy policies |
| Sign-in providers Apple sign-in Google sign-in |
To let you sign in | Account identifier, email | Independent controllers |
| Product analytics and error monitoring Firebase Amplitude Applovin Appsflyer Sentry Google Tag Manager |
To understand how the Service is used and fix errors | Usage, device and technical data (not Your Content) | Processors |
| Email and messaging providers Reteno |
To send service and marketing emails | Email address, message content, delivery data | Processors |
| Customer support tools Zendesk |
To manage support requests | Communications, account data | Processors |
| Security and fraud prevention providers. | To protect the Service against attacks and abuse | Technical, log and device data | Processors |
| Google Ads | To measure the effectiveness of our advertising (Section 12) | Hashed email, click identifiers, conversion events | See Section 12 |
| Affiliates and related parties | To provide engineering and support services to us | As needed for the service provided | Processors |
| Professional advisers (lawyers, accountants, auditors) and insurers | For advice, audits and insurance | As needed | Independent controllers bound by confidentiality |
| Authorities, courts and reporting organisations | Where required by law, to respond to valid legal requests, to report illegal content, or to protect someone from serious harm | As required | Independent controllers |
| Other parties to legal claims | To handle notices and disputes | Limited information necessary for the notice or dispute | Independent controllers |
7.3. Model providers. The providers that currently process requests for generation are:
| Provider | Service | Location of processing | Transfer mechanism |
|---|---|---|---|
| fal – Features & Labels, Inc. https://fal.ai/legal/privacy-policy |
Inference platform giving access to image and video models | United States and other regions. | Data Protection Agreement with Standard Contractual Clauses (Module 2) |
8. International transfers
8.1. Where your data goes. We are based and store Your Content in the EU. Several of our service providers, including our main model provider, are located in the United States, and some model developers are located in other countries. Transferring personal data to them means it may be processed in countries whose data protection laws differ from those in the EEA.
8.2. Safeguards. We transfer personal data outside the EEA or Switzerland only where:
- the country has an adequacy decision (for example, the EU–US Data Privacy Framework, where the recipient is certified under it); or
- we have entered into the European Commission’s Standard Contractual Clauses with the recipient, and assessed the transfer and put in place any additional safeguards needed, such as limiting the data sent to model providers, not sending account identifiers, encryption in transit and at rest, and limits on how long providers keep data.
9. How long we keep personal data
9.1. Principle. We keep personal data only as long as needed for the purposes in this policy. When it is no longer needed, we delete it, if possible, or anonymise it so that it can no longer be linked to you. Deleted data may remain in encrypted backups for up to 90 days until the backups are overwritten.
9.2. Retention periods
| Data | How long we keep it |
|---|---|
| Account information | While your account is open. Deleted within 90 days after you close your account, except as set out below. |
| Prompts and settings | Stored with the related output in your history until you delete that output or close your account. Prompts for which no output was stored (for example, failed or blocked requests) are kept for 90 days, unless the moderation retention below applies. |
| Uploaded images and files | Kept for 90 days. |
| Outputs | Until you delete them or close your account. Deleted from our storage within 90 days after that; links to deleted outputs stop working immediately. |
| Copies held by model providers | We configure our model providers not to store request data where their service allows it. Some model developers keep inputs for a limited period to detect abuse. |
| Transaction records, invoices and token ledger | For 6 years after the end of the financial year of the transaction. After your account is closed, these records are kept in a form that separates them from your profile, and are used only for accounting, tax, audit and legal purposes. |
| Consent and disclosure records | For the life of your account and 2 years afterwards, to demonstrate compliance and defend claims. |
| Moderation and safety records | 24 months from the event. Records of serious violations and account terminations: up to 5 years, to prevent re-registration by banned users. |
| Security and access logs | 90 days, or longer where needed to investigate an incident. |
| Fraud prevention records | Up to 3 years after the relevant event. |
| Support communications | 1 year after the request is closed. |
| Marketing preferences | Until you unsubscribe or withdraw consent. |
| Advertising measurement data | Hashed emails are not stored by us beyond the upload process; upload logs are kept for 24 months. Retention by Google is governed by its terms (Section 12). |
| Analytics data | 36 months in identifiable form, then aggregated or deleted. |
9.3. Longer retention. We may keep specific data for longer where needed to comply with the law, to respond to a legal request, to resolve a dispute, to enforce our Terms, or to investigate security incidents, fraud or abuse. We keep it only for as long as that purpose requires.
10. Your rights
10.1. Your rights. Depending on where you live, you have the right to:
- access your personal data and receive a copy;
- correct inaccurate or incomplete data;
- delete your data where possible;
- restrict our processing, for example while we check a complaint;
- object to processing based on legitimate interests, including profiling, and at any time to direct marketing;
- data portability: receive data you provided to us (including your prompts, uploads and outputs) in a structured, commonly used format, or have it sent to another controller;
- withdraw consent at any time, where we rely on consent;
- not be subject to decisions based solely on automated processing that significantly affect you (we do not make such decisions, see Section 6); and
- complain to a supervisory authority (Section 10.4).
10.2. How to exercise your rights. You can: (i) download your outputs, and delete outputs, uploads or your account, in User Gallery; (ii) manage marketing emails through the unsubscribe link; (iii) through the “Cookie settings” link in the footer of our website and through your device settings in the apps; (iv) for anything else, email support@genflex.ai.
10.3. Our response. We respond within one month. We may extend this by up to two further months for complex or numerous requests, and will tell you if we do. To protect your account, we may ask you to confirm your request from the email address linked to your account or to provide other information needed to verify your identity. We will not ask for more information than necessary. Some rights have limits: for example, we must keep transaction records for the legally required period even if you ask us to delete your account (Section 9), and we cannot give you data that would reveal personal data about someone else.
10.4. Complaints. If you have concerns, please contact us first so that we can try to help. You also have the right to lodge a complaint with the data protection authority where you live or work, or where you think an infringement occurred.
10.5. Residents of other countries. Depending on where you live, you may have the following additional rights. You can exercise them as described in Section 10.2, and we respond within the time limits set by your local law.
- Canada (PIPEDA). You can access and correct your personal information and withdraw consent, subject to legal or contractual restrictions. You can complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
- Brazil (LGPD). You can: (i) confirm whether we process your data, and access and correct it; (ii) ask us to anonymise, block or delete data that is unnecessary, excessive or unlawfully processed; (iii) receive a portable copy of your data; (iv) ask which third parties we share it with; (v) withdraw consent. You can complain to the Autoridade Nacional de Proteção de Dados (gov.br/anpd).
- Australia (Privacy Act 1988). You can access and correct your personal information. You can complain to the Office of the Australian Information Commissioner (oaic.gov.au).
- Japan (APPI). You can: (i) ask us how we use your personal data and request its disclosure; (ii) correct, add to or delete inaccurate data; (iii) ask us to stop using, delete or stop sharing it with third parties where the APPI allows. You can complain to the Personal Information Protection Commission (ppc.go.jp).
- Mexico (LFPDPPP). You have the ARCO rights: access, rectification, cancellation and objection. You can also withdraw your consent, subject to legal exceptions. You can complain to the competent Mexican data protection authority.
11. Cookies and similar technologies
11.1. What we use. Our website uses cookies, pixels and local storage, and our apps use software development kits (SDKs) and device identifiers, which work in a similar way. Together we call these “cookies”.
| Category | Purpose | Examples |
|---|---|---|
| Strictly necessary | Sign-in, security, fraud prevention, load balancing, remembering your cookie choices, payments | Session cookie, CSRF token, bot-protection cookie |
| Preferences | Remembering settings such as language | [Language] |
| Analytics | Understanding how the Service is used and improving it | [Analytics events] |
| Advertising and attribution | Measuring which ads bring people to GenFlex | Meta Pixel https://www.facebook.com/privacy/policy/ Google Ads and Tag Manager: https://policies.google.com/privacy TikTok Pixel https://www.tiktok.com/legal/page/us/privacy-policy/en Pinterest Tag https://policy.pinterest.com/en/privacy-policy X Pixel https://x.com/en/privacy Snapchat Pixel (applovin, appsflyer) https://values.snap.com/privacy/privacy-policy |
11.2. Your choices.
- Website: we ask for your consent to non-essential cookies. Until you accept, we do not set them, and Google tags run in a mode that does not store advertising cookies.
- iOS app: we ask for permission through Apple’s App Tracking Transparency prompt before any tracking. If you decline, we do not access your advertising identifier or share app data with advertising partners for tracking.
- Android app: you can reset or delete your advertising ID in your device settings, and we ask for your consent to non-essential SDKs in the EEA and Switzerland.
12. Advertising and measurement
12.1. What we do. We advertise GenFlex on Google’s services. To understand which campaigns lead to sign-ups and purchases, we use Google Ads conversion measurement. When you sign up or buy something, we may send Google, from our servers: (i) your email address in hashed form; (ii) the type, time and value of the conversion (for example, “subscription purchase”); and (iii) where available, the Google click identifier from the ad you clicked. Google matches the hashed email with signed-in Google accounts to attribute the conversion to an ad, and gives us aggregated reports. We do not send Google your prompts, uploads, outputs or payment details.
12.2. Hashing is not anonymisation. A hashed email address can be matched with the same email address held by Google, so it remains personal data and we treat it as such.
12.3. Google’s role. For enhanced conversions, Google processes the hashed data on our behalf under the Google Ads Data Processing Terms. Google may also use data from the Google tag on our website, and data it already holds about its own users, for its own purposes as an independent controller, as described in Google’s privacy policy and at How Google uses information from sites that use its services. Where the Google tag on our website collects data, we and Google may be joint controllers for that collection.
12.4. Your choices.
- Websites: we only send hashed emails and conversion data to Google if you have consented to advertising measurement.
- iOS: we do not send data from the iOS app for this purpose unless you have allowed tracking in the App Tracking Transparency prompt.
- Android: we do send data from the Android app for this purpose only.
You can also control personalised ads from Google in your Google account ad settings.
13. Children
13.1. GenFlex is for adults. You must be 18 or older to use it, and it is not directed to children. We ask for your date of birth or confirmation that you are 18 or over when you sign up, and our app store listings are rated for adults. We do not knowingly collect personal data from anyone under 18, including children under 13 as defined by the US Children’s Online Privacy Protection Act. If we learn that someone under 18 has created an account, we close it and delete the associated data, except where we must keep it to comply with the law or protect children. If you believe a child is using GenFlex, please contact support@genflex.ai.
14. Security
14.1. Measures. We use technical and organisational measures appropriate to the risk to protect personal data, including: encryption in transit and at rest; access controls based on need-to-know, with controls for Your Content and moderation records; logging and monitoring of access; separating payment data from our systems (card details are handled by our payment providers); security reviews of our service providers and contractual security obligations for them; and staff training. If a personal data breach occurs that is likely to put your rights at risk, we will notify the competent authority and, where required, you, in line with the law. No system is completely secure. You help protect your account by using a strong, unique password and keeping your login details confidential.
15. Additional information for US residents
15.1. Scope. This section applies to residents of California and of other US states with comprehensive consumer privacy laws (including Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia). It supplements the rest of this policy.
15.2. Personal information we collect and disclose. In the last 12 months we collected the following categories of personal information, from the sources described in Section 2, for the purposes described in Section 4, and disclosed them for business purposes to the categories of recipients in Section 7. We keep each category for the periods in Section 9.
| Category (California law) | Examples | Disclosed for a business purpose to | |
|---|---|---|---|
| Identifiers | Email address, account ID, IP address, device identifiers, hashed email | Service providers, payment providers, app stores, sign-in providers | |
| Customer records (Cal. Civ. Code § 1798.80(e)) | Name, email, limited payment details | Service providers, payment providers | |
| Commercial information | Plans, purchases, token ledger, refunds | Service providers, payment providers | |
| Internet or other electronic network activity | Usage data, logs, interactions with ads | Service providers | |
| Geolocation data (approximate only) | Country and region from IP address | Service providers | |
| Audio, electronic, visual or similar information | Uploaded images, generated images and videos | Model providers, hosting and moderation providers | |
| Sensitive personal information | Account login credentials | Service providers (for authentication only) | |
| Inferences | None, other than the classification of content for moderation | — |
We do not collect precise geolocation, biometric information or government identifiers. We use sensitive personal information only for purposes permitted by law (such as authentication and security) and not to infer characteristics about you, so we do not offer a separate “limit the use” option. We do not knowingly sell or share personal information of consumers under 16.
15.3. Sale, sharing and targeted advertising. We do not sell personal information for money. Sending hashed emails and conversion data to Google for advertising measurement may be considered “sharing” for cross-context behavioural advertising under California law, and “targeted advertising” or a “sale” under other state laws. You can opt out by:
- using our cookie and privacy settings in the footer of our website
- enabling the Global Privacy Control in your browser, which we treat as a valid opt-out for that browser and, if you are signed in, for your account.
15.4. Your rights. Subject to legal exceptions, you have the right to: know what personal information we collect, use and disclose, and access it; correct inaccurate information; delete it; obtain a portable copy; opt out of the sale or sharing of personal information and of targeted advertising; and not be discriminated against for exercising these rights. We do not use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects.
15.5. How to exercise them. Email support@genflex.ai. We will verify your request by matching it with information in your account, usually by confirming it from your account email. You may use an authorised agent; we may ask the agent for proof of authority and ask you to verify your identity directly. We respond within 45 days, which we may extend by a further 45 days where permitted.
15.6. Appeals. If we decline your request, you can appeal by replying to our decision or emailing support@genflex.ai with the subject “Privacy appeal” within 45 days. We will respond within the period required by the law of your state (normally 45 or 60 days). If you are not satisfied, you may contact your state Attorney General.
15.7. De-identified data. Where we de-identify data, we maintain it in de-identified form and do not attempt to re-identify it, except as permitted by law.
16. Changes to this policy
16.1. We may update this policy to reflect changes in our Service, our providers or the law. We will post the updated version with a new date. If the changes are significant, for example a new use of Your Content or a new category of recipient, we will strive to notify you in advance by email or in the Service, and ask for your consent where the law requires it.
17. Contact
Extramile Limited: 75 Prodromou Avenue, Oneworld Parkview House, 2063 Nicosia, Cyprus
Contact: support@genflex.ai
Data Protection Officer: dpo@extramile-cy.com