Privacy Policy

Last updated: 2 July 2026

This Privacy Policy describes how Fluxx ("we", "us", "our") handles your information when you use fluxx.work (the "Service"). By using the Service you agree to this policy.

1. What we collect — and what we do not

We operate on a strict data-minimisation principle. We collect only:

• Account credentials — your email address and a bcrypt-hashed password. Plain-text passwords are never stored.
• Credit balance & usage — the number of credits allocated to your account and a log of credits consumed, for billing and support purposes.
• Referral and payment metadata — plan purchased, amount paid, and referral code used (if any), for accounting and commission calculations.

We do not permanently storethe product images, garment images, model images, or AI-generated output images that you upload or generate. These files are transmitted to Google's Gemini AI service solely to produce your output, and are not retained on our servers beyond the duration of the API call. We do not build profiles from your image content.

2. How we use your data

• To authenticate you and keep your account secure.
• To track credit balances and ensure accurate billing and deduction.
• To calculate and pay referral commissions where applicable.
• To respond to support requests.
• To prevent abuse, fraud, and Terms violations.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

3. Third-party processors

• Google Gemini— AI image generation. Your uploaded and generated images pass through Google's API during processing and are subject to Google's applicable usage policies.
• Supabase — Database and authentication infrastructure, hosted on ISO-27001-certified cloud infrastructure.
• Vercel — Application hosting and edge delivery.

4. Data retention

• Account credentials and credit records are retained for as long as your account is active, or as required for legal and accounting obligations.
• Image data is not retained beyond the processing request — we hold no long-term copies of your uploads or generated images.
• You may request deletion of your account and all associated personal data by emailing fluxx.contactus@gmail.com. Deletion requests will be processed within 30 days, subject to any outstanding legal or accounting obligations.

5. Security

• Passwords are hashed with bcrypt and never stored or transmitted in plain text.
• All communication is encrypted over HTTPS/TLS.
• Database access is restricted to authenticated server-side processes.
• No method of electronic storage or transmission is 100% secure. We take commercially reasonable measures to protect your data, but cannot guarantee absolute security.

6. Cookies and tracking

We use a single session cookie to keep you logged in. We do not use third-party advertising trackers or analytics cookies.

7. Your rights

• Access — you may request a copy of the personal data we hold about you.
• Correction — you may update your email or request correction of inaccurate records.
• Deletion — you may request erasure of your account and personal data (see Section 4).

To exercise any of these rights, email fluxx.contactus@gmail.com.

8. Changes to this policy

We may update this policy from time to time. Continued use of the Service after changes are posted constitutes acceptance of the updated policy. The "Last updated" date above indicates when this version was last revised.

9. Contact

For any privacy-related questions or concerns, contact us at fluxx.contactus@gmail.com.

Fluxx.work is operated by Puneet Dugar. This business is not registered under GST; PAN CCMPD4031J is provided in lieu of GSTIN where a tax identifier is required.