Privacy Policy

1. Information We Collect

1.1 Information You Provide

• Account information: Name, email address, and password when you register
• Profile information: Profile photo, display name, and preferences you set
• Payment information: Billing details processed by Stripe (we do not store full card numbers)
• Content inputs: Text prompts, reference images, and other creative inputs you submit for AI generation
• Generated content: Images, videos, and other media created through the Service
• Communications: Messages you send to us via email or support channels

1.2 Information Collected Automatically

• Usage data: Features used, generation history, credit consumption, and interaction patterns
• Device information: Device type, operating system, browser type, and screen resolution
• Log data: IP address, access times, pages viewed, and referring URLs
• Cookies and similar technologies: Essential cookies for sign-in, payments and bot protection, and (subject to your choices) analytics cookies for service improvement — see Section 6.5
• Error reports: When something breaks, technical details of the error (browser, page, stack trace) are sent to our error-monitoring provider, with prompt text and email addresses removed
• Session recordings (only with your consent): If you turn on "Session replay" in Cookie settings, we record how you interact with pages (clicks, scrolling, page changes) to find and fix problems. Everything you type is masked, and text that looks like an email address, phone number or card number is masked. Recording never starts without your opt-in, and it stays off whenever your browser sends a Global Privacy Control or Do Not Track signal

1.3 Information from Third Parties

• Authentication providers: If you sign in with Google, Apple or Microsoft, we receive your name and email address from that service
• Fraud and abuse prevention: When you sign up, your email address may be checked with an email-reputation service to detect disposable or abusive addresses
• Payment processor: Stripe provides us with transaction confirmations and subscription status
• Operational notifications: When you sign up, a notification containing your name and a redacted form of your email address may be sent to our team's internal messaging channel (Telegram) so we can monitor new registrations. This is used only for operational awareness and abuse monitoring
• YouTube (optional): If you connect a YouTube account to publish content, we store the OAuth access and refresh tokens needed to upload on your behalf. We request only the upload scope, and tokens are revoked and deleted when you disconnect or delete your account

Google API Services. FXI Studio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use YouTube data only to upload the videos you choose to publish; we do not use it for advertising, sell it, or use it to train AI models.

1.4 Biometric and Facial Information

If you use features that register a character from a selfie or photo (e.g. Cast registration, subject segmentation), you provide images that contain facial features. We use these solely to generate and edit your requested content. To do so, these images are transmitted to third-party AI processors (our image-generation and image-segmentation providers — see Section 3) that perform the generation or segmentation on our behalf. We do not use facial data for identification, and we do not sell it. Facial source images and derived character media are deleted when you delete your account or the associated character.

2. How We Use Your Information

We use collected information for the following purposes:

• Provide the Service: Process your prompts through AI models, store your generated content, manage your account and credits
• Improve the Service: Analyze usage patterns to optimize features, fix bugs, and develop new capabilities
• Billing and support: Process payments, manage subscriptions, and respond to your inquiries
• Communication: Send transactional emails (account verification, password reset, billing receipts) and, with your consent, marketing communications
• Safety and compliance: Detect and prevent fraud, abuse, and violations of our Terms of Service
• Legal obligations: Comply with applicable laws and respond to legal requests
• Public showcase (free tier): On free accounts, your generations and the text prompts used to create them are public and may be displayed in featured or community areas of the Service. Do not include personal or sensitive information in prompts or uploads on a free account. On paid tiers, generations are private by default and become public only when you choose to publish or share them

2.1 AI Content Processing

Your text prompts and reference images are transmitted to third-party AI model providers solely for the purpose of generating content you request. We do not use your prompts or generated content to train our own AI models. Third-party providers may have their own data processing practices — see Section 3 for details.

2.1A AI Content Labels

Files generated through the Service carry a machine-readable label identifying them as AI-generated (an industry-standard "digital source type" value and the tool name "FXI Studio"). The label does not contain your name, email, account ID, prompt, or location. It stays in the file when you download or share it, so anyone who receives the file can see that it was made with AI.

2.2 Automated Safety Scanning

All generations, including private ones, are automatically scanned for safety and legal compliance. The scan looks at the prompt and the generated image or sampled video frames (for audio, the prompt). Our trust and safety team may review content the scan flags, and we keep records of enforcement decisions. Scanning never makes private work public: your visibility settings still decide who can see it.

3. Third-Party Services

We share information with the following categories of service providers, each acting on our behalf under its own privacy terms. We describe recipients by category (GDPR Art. 13(1)(e)); a current list of the specific providers is available on request from privacy@fxi.studio.

4. Data Storage and Retention

4.1 Storage

Your data is stored with our cloud database, storage and hosting providers, primarily in the United States. Generated media files are stored with access controlled by Row Level Security policies tied to your account.

4.2 Retention

• Account data: Retained while your account is active and for 30 days after deletion
• Generated content: Retained while your account is active; deleted upon account deletion
• Usage logs: Retained for up to 12 months for analytics and debugging
• Signup and security logs: The IP address, browser details and email address recorded at signup or during abuse checks are removed after 90 days, or as soon as you delete your account if sooner. A one-way hash of the email address may be kept to block repeat abuse
• Payment records: Retained as required by tax and financial regulations (typically 7 years)
• Waitlist data: Email addresses retained until the waitlist is closed or you request removal

We keep records of content moderation and enforcement decisions for as long as needed to enforce our policies, handle appeals, and meet legal obligations: generally 3 years after a warning expires and 7 years after an account is terminated. Content reported to the National Center for Missing & Exploited Children is preserved as the law requires. Content subject to a legal hold is kept until the hold is released.

5. Data Security

We implement industry-standard security measures to protect your information, including:

• Encryption in transit (TLS/HTTPS) for all data transmission
• Encryption at rest for stored data
• Row Level Security (RLS) policies ensuring users can only access their own data
• Secure authentication with hashed passwords and optional social sign-in
• API keys stored in encrypted secrets management, never exposed to clients

No system is completely secure. While we strive to protect your data, we cannot guarantee absolute security and are not responsible for unauthorized access resulting from factors beyond our reasonable control.

6. Your Rights and Choices

6.1 Access and Portability

You may access your account data, generation history, and stored content through the Service at any time. You may export your generated media from the library.

6.2 Correction

You may update your account information through your profile settings.

6.3 Deletion

You may delete your account in your account settings (accounts that use Google, Apple or Microsoft sign-in confirm with a code we email to you), or request deletion by contacting privacy@fxi.studio. We will process deletion requests within 30 days, except where retention is required by law. Account deletion removes your profile, generated content, and uploaded media; cancels any active subscription; and deletes your customer record (including billing email) at our payment processor, which keeps its own invoice and transaction records as tax and financial law require. Signup and security logs are de-identified, and content-safety logs are retained without your media, as described in Section 4.2.

6.4 Marketing Opt-Out

You may unsubscribe from marketing emails at any time using the unsubscribe link in any marketing email. Transactional emails (billing, security alerts) cannot be opted out of while your account is active.

6.5 Cookie Controls and Session Recording

Essential cookies (sign-in, payments, bot protection) are always on. Analytics is off by default for visitors in the EU, EEA and UK until they accept it, and can be turned off by anyone. Session recording is off for everyone until you opt in. You can change these choices at any time with the Cookie settings link in the site footer. We honor Global Privacy Control and Do Not Track signals by keeping session recording off. You may also control cookies through your browser settings; disabling essential cookies will break sign-in.

7. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know: Request disclosure of the categories and specific pieces of personal information we collect
• Right to delete: Request deletion of your personal information
• Right to opt-out: Opt out of the "sale" of personal information (we do not sell personal information)
• Non-discrimination: We will not discriminate against you for exercising your rights

To exercise these rights, contact us at privacy@fxi.studio or use the mechanisms described in Section 6.

8. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. By using the Service, you consent to this transfer.

For users in the European Economic Area (EEA) or United Kingdom, we process personal data based on: (a) your consent, (b) contractual necessity to provide the Service, (c) our legitimate interests in operating and improving the Service, and (d) compliance with legal obligations.

9. Children's Privacy

The Service is not directed to children under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete such information promptly. If you believe a child has provided us with personal information, please contact us at privacy@fxi.studio.

10. Using FXI from AI Assistants (MCP Connector)

FXI Studio can be connected to AI assistants such as ChatGPT and Claude through a hosted connector at mcp.fxi.studio, built on the Model Context Protocol. This section describes what happens when you use FXI through that connector, in addition to the rest of this Policy.

10.1 Connecting and Signing In

Adding the FXI connector in a supported assistant takes you to a sign-in and consent screen hosted on fxi.studio. You sign in to your existing FXI account (or create one) and approve access for that assistant. Approving issues the assistant a short-lived access token and a longer-lived token it can use to stay connected without asking you to sign in again, both scoped only to using FXI's tools. We never share your FXI password or browser session with the assistant, only these scoped tokens, and we store only a one-way hash of each token, never the plaintext value. Some AI coding tools (for example Claude Code or Cursor) instead use a personal key you generate yourself in FXI account settings, which works the same way and can be managed from the same place described in Section 10.5 below.

10.2 What We Receive

• Tool requests: Each action you ask the assistant to take (for example, generating an image or video, checking your credit balance, or looking up a past generation) sends us only the specific fields that action needs, such as a text prompt, a reference image URL, a model choice, or a generation ID
• What we do not receive: The connector does not give FXI access to the rest of your conversation with the assistant. We see only the structured request for the specific action you invoke, not your broader chat history with ChatGPT, Claude, or any other assistant

10.3 What We Store

• Access and refresh tokens: The access token issued at sign-in expires after 1 hour. The refresh token that renews it expires after 60 days and can only be used once; using it issues a new one and invalidates the old one, and any attempt to reuse an already-used refresh token automatically ends that assistant's access as a safeguard against theft
• Prompts and generated media: Requests made through the connector create the same kind of generation record described in Sections 1.1 and 4.2 above (prompt, model, resulting media URL, credits used), stored and retained the same way as generations made through the website or app
• Connection activity log: We keep a record of each tool call (which action was used, your account ID, whether it succeeded, the generation ID and error code if any, credits spent, response time, and basic connection details such as IP address and user agent when the assistant provides them) for security and debugging. This log stores a hash of the request parameters rather than the raw prompt text, and it is deleted automatically after 90 days
• In-progress task state: Multi-step actions, such as chaining several video scenes together, are tracked in a temporary task record so the assistant can check on progress. This record holds the planned steps and their progress and is kept alongside your generation records

10.4 Moderation

Prompts and requests sent through the connector pass through the same automated safety and content-moderation checks described in Section 2.2, regardless of which assistant you used to send them.

10.5 Revoking Access

You can disconnect an assistant at any time from Settings → Connect to Claude → Connected apps in your FXI account. Disconnecting there immediately revokes its access and refresh tokens, ending its ability to act on your behalf. If you connected using a personal key instead, you can revoke that key from the same settings page. You can also remove the connector from within the assistant itself, though disconnecting it in FXI settings as well ensures the underlying token stops working. Questions can be sent to privacy@fxi.studio.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Service and updating the "Last updated" date. For significant changes, we may also notify you by email. Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

12. Contact Us

For questions or concerns about this Privacy Policy or our data practices, contact us at:

Fueled by Imagination, LLC
PO Box 25553, Newark, NJ 07101
Email: privacy@fxi.studio