Flami privacy policy

Flami helps create and process images, video, audio, and text using AI tools. This document describes the information associated with using the service, the purposes for which it is needed, and how users can manage their data.

This document applies to the flami.pro website, the account area, support requests, and materials that users provide for the tools to operate. It concerns website visitors, account holders, and people whose information is contained in uploaded materials.

The personal data controller is individual entrepreneur Igor Evgenyevich Litvintsev, INN 781394158508, OGRNIP 326784700142011. Region of registration: St. Petersburg. Questions about personal data processing can be sent to support@flami.pro.

This policy explains processing but does not in itself constitute consent to any and all actions involving data. Where consent is required for a particular purpose, it must be requested separately. Declining optional processing does not automatically mean declining the entire service.

The data involved depends on what the user does. Simply browsing the website does not require providing the same information as registering, paying, or processing your own video.

Account and sign-in. A name or chosen profile name, email, information about the sign-in method, the user identifier in an external service, an available avatar, and account settings. When registration uses a password, the service uses a protected representation of it to verify sign-in.

Tool operation. Entered prompts, uploaded images, video and audio, task parameters, execution history, and generated results. These materials may contain information about their author or other people even if their names are not specified separately.

Payments and requests. Information about the selected plan, payment, and the allocation and use of credits; contact details, correspondence, and attachments that users provide to support. The payment method may involve additional data processing by the payment organization.

Website operation. IP address, browser and device information, request times and addresses, technical events, cookies, and session identifiers. Analytics tools may also receive information about pages viewed and interactions with the interface.

Users choose the materials for a task themselves and are responsible for the lawfulness of providing them, including having the necessary permissions for other people's data. Before submitting, remove or obscure document numbers, addresses, payment details, and other information that is unnecessary for image processing or another selected function. Do not upload health information, information about intimate life, or other special categories of personal data unless a separate lawful basis and processing procedure are provided for the relevant function. These user obligations do not release Flami from its own obligations as a personal data controller.

Providing account access. Profile and sign-in data is needed for registration, access verification, sign-in recovery, linking an external account to a Flami profile, and saving settings. The principal basis for necessary processing is entering into and performing a contract with the user; separate consent applies to actions requiring consent.

Performing the user's task. Materials, the prompt, and parameters are sent to the selected tools for processing, linked to the task, and used to return the result. The scope of processing is determined by the function the user runs. The basis for processing other people's data must be assessed separately: a contract with the account holder does not constitute consent from every person depicted or mentioned.

Processing payments and recording services provided. Transaction data is used to apply the plan, account for credits, verify payment status, issue refunds, and fulfill statutory obligations. The specific information involved depends on the payment method.

Responding to a request. Contact details and message contents are needed to verify the circumstances of a request, resolve problems, and send a response. Optional information that users choose to attach does not become necessary for all the other functions of the service.

Ensuring stability and security. Technical information helps verify access, investigate errors, and prevent abuse.

Understanding website usage. Visit and interaction statistics help identify interface problems. Permission for analytics processing does not constitute permission for promotional mailings.

You can sign in using VK ID or Yandex ID. After selecting the relevant button, users authenticate with the selected service. The permissions involved are displayed in that service's interface and depend on the integration settings and the access granted.

Flami receives an account identifier, information for displaying the profile, and, if the service provides them within the permitted access, an email and profile image. This information allows Flami to create a profile or locate an account that is already linked. A VK or Yandex password is entered with the relevant provider and is not passed to Flami as the social network password.

You can manage external account links in the available profile settings. Disconnecting a link does not delete the account at VK or Yandex. Revoking permissions with the provider also does not replace a request to delete data that Flami has already received.

VK and Yandex process information about the operation of their own services under their own documents. Their permission to transfer data at sign-in does not replace a separate basis for analytics, mailings, or transferring materials to AI providers.

To fulfill a request, a tool needs the source text, selected settings, and files required by the function. For example, processing an image may require the image itself, while working with sound may require an audio recording and task text. File contents may constitute personal data if they make it possible to identify a person.

Images that users attach to generation parameters are used to perform the selected task. If the selected tool operates through an external API, the attached image is sent to that tool along with the prompt and generation settings. The purpose of this request is to process the materials selected by the user.

Account data and the contents of an attached image are different categories of information. An image may contain personal data, such as a recognizable face. In that case, providing it to an external tool constitutes personal data processing even if the account holder's name and email are not included in the generation parameters.

If information about a person is unnecessary for the task, remove it from the text or file before submitting. Transferring another person's face, voice, or correspondence requires the same attention to the basis for processing as transferring any other personal data.

Flami's main servers, database, and storage are located in the Russian Federation. To perform generation, the service also uses foreign APIs, to which task parameters and attached materials are sent.

Certain website functions involve external services: VK and Yandex provide sign-in, Yandex Metrica provides visit statistics, and payment organizations process payments. The information used to perform these functions is determined by the relevant operation.

For authentication, an external service receives information about the sign-in attempt and passes profile data authorized by the user to Flami. For payment, the payment service receives transaction information; it does not receive source images merely because it participates in payment processing. For analytics, Yandex receives browser technical information and visit events, rather than access to the entire Flami account. An external generator receives materials for a specific task, rather than the platform's user database.

Information about personal data recipients and the terms of specific processing can be requested at support@flami.pro. The scope of disclosure and response times are determined by law. A model name alone does not identify the legal entity processing the request.

Where attached materials contain personal data and are sent to a foreign recipient, their transfer is subject to statutory requirements for cross-border transfers of personal data.

Information is provided in response to a lawful request from a government authority within the scope of that request and the powers provided by law.

Flami uses technical cookies and similar technologies for sign-in, request protection, language preferences, and interface operation. Disabling these technologies in the browser may affect sign-in and certain website functions.

On public pages, Flami offers a single analytics choice for the website and account area: "Allow all" or "Allow necessary". The question is not repeated in the account area: the same choice applies there. The Yandex Metrica counter is not loaded until permission is granted. Continuing to browse a page or accepting the public offer does not in itself enable analytics.

"Allow all" enables the technologies necessary for website operation and analytics cookies. "Allow necessary" keeps analytics disabled. These buttons do not grant permission for promotional mailings or other independent processing purposes.

When analytics is allowed, Yandex Metrica is used to record visits and navigation on public pages and in the account area. Public pages additionally use Session Replay and click maps to analyze interactions with the interface. Session Replay and click maps are disabled in the account area; URL parameters are not included in the page view events sent. To operate the counter, the browser contacts Yandex servers. The terms of permission are set out separately in the Analytics consent.

You can change your choice using the "Cookie settings" button on public pages. After analytics is declined, sending new events from the current page stops. Other open tabs receive the change through a browser notification or another server check; the check is also performed when returning to a tab and at least once a minute when the browser allows background code to run. The choice is stored in a protected cookie together with the server time and consent version number; after sign-in, this information is linked to the account. For signed-in users, valid consent is verified against the account record, and the acceptance mark is removed upon withdrawal. Withdrawal does not automatically delete previously collected information: you can contact support to request this.

Processing by Yandex is also governed by its documents: the Yandex Metrica terms and Yandex privacy policy.

The retention period depends on the purpose and category of information. Data for account operation is needed while access is provided; materials are needed to perform tasks and store results as provided by the service; requests are needed to resolve the problem described; and payment information may be retained to meet statutory requirements.

Temporary files from the Imagine image generation and marketplace listing tools are assigned a deletion deadline of one day. Source images for the Market Video tool are assigned a deadline of 30 days. Cleanup is carried out by a technical procedure after the deadline, so the expiration date and the time of physical deletion may differ. These periods do not mean that all generation results are deleted: no general automatic retention period is established in the service for other materials; they are stored to provide the selected functions until deletion or the end of the relevant processing purpose.

Deleting an account and terminating access are not equivalent to revoking all permissions previously granted to external services. When deletion is requested, Flami identifies information, materials, and transactions associated with the account, stops processing for which no lawful basis remains, and explains the exceptions provided by law. For a shared workspace, other participants' rights and independent lawful grounds for retention are taken into account.

Technical copies and backups are not used as an independent basis for retaining deleted data indefinitely. The deletion procedure applies to the relevant copies; the periods and limitations of specific processing can be clarified with support. Copies previously downloaded by the user or lawfully received by another independent controller are not automatically deleted when a Flami account is deleted.

After the purpose has been achieved, consent has been withdrawn, or a user request has been received, processing stops and data is destroyed or anonymized in the cases and within the periods established by law. If an independent lawful basis remains for retaining certain information, it is assessed separately; withdrawal of consent does not require the destruction of payment documents contrary to statutory requirements.

Data protection measures include access restrictions, authority checks, security measures during transfer and storage, and handling identified violations.

For questions about personal data, contact support@flami.pro with the subject "Personal data". Describe the information or actions you are interested in and provide details that make it possible to locate your account or request.

Users are entitled to obtain information about processing, request correction of inaccurate data, and, where grounds provided by law exist, request blocking, cessation of processing, or destruction. Consent may be withdrawn for processing based on that consent. The controller's actions may be challenged before Roskomnadzor or a court.

To prevent disclosure of information to an unauthorized person, confirmation of the applicant's authority may be required. The form of this confirmation depends on the type of request and statutory requirements. Do not send a passport scan by ordinary email on your own initiative.

Requests for information about processing are considered within ten business days; the law allows an extension of no more than five business days with a reasoned notification. Correction, cessation of processing, and destruction are subject to the relevant statutory periods, rather than a single general response period for all requests.