Privacy Policy
Last updated: October 20, 2026
This Privacy Policy explains what personal data XEO Consistent Inc. ("We", "Us" or "Our") collects when You use Image Fx at https://img-fx.com (the "Service"), how We use and share it, and the choices and rights You have. It should be read with Our Terms and Conditions.
1. Who is responsible for Your data
XEO Consistent Inc., a Wyoming corporation in the United States, is the controller of the personal data described in this policy. You can reach Us about privacy at [email protected].
2. What We collect
Account data. Your email address, and, if You sign in with Google, the name and profile picture Google shares with Us. We also keep Your plan, credit balance, check-in history and account settings.
Purchase data. What You bought, when, the amount, currency and order or subscription IDs. Card and bank details are collected by Our payment processors; We never see or store Your full card number.
Content. The prompts You write, the images and videos You upload, the settings You choose, and the images and videos the Service generates for You.
Usage and device data. IP address, browser and device type, pages visited, the website or campaign that referred You (including UTM parameters, which We save with Your account when You sign up), and error logs.
Messages. What You send Us when You contact support.
We do not ask for, and You should not upload, sensitive data such as health information or government ID documents.
3. How We use it, and Our legal bases
The legal bases in brackets apply to users in the EU, EEA and UK.
To run Your account, generate Your images and videos, keep Your history and handle payments and credits (performance of Our contract with You).
To check prompts and uploads for prohibited content, prevent fraud and abuse of free credits, and keep the Service secure (Our legitimate interests, and legal obligations where they apply).
To answer support requests and send service emails such as sign-in links, receipts and important changes (contract and legitimate interests).
To understand how the Service is used, measure Our advertising and improve the product (legitimate interests, or Your consent where the law requires it).
To keep tax, accounting and legal records (legal obligations).
We do not use Your prompts, uploads or generated content to train Our own AI models, and We do not make decisions about You that have legal or similarly significant effects based solely on automated processing. Automated safety checks can block a request; if You think a block was wrong, contact Us and a person will review it.
4. Your content and AI processing
To fulfil a request, Your prompt and any uploaded media are sent to the AI model provider that runs the model You chose. Providers process them under their own terms and may keep them for a limited time for safety or abuse monitoring.
Prompts are screened by an automated text-safety check, and some outputs by an image-safety check, before results are shown. Records of blocked requests are kept for abuse prevention.
Uploads and results are stored on Our cloud storage so You can see them in My Images and My Videos. They are not shown in any public gallery. Files are served from hard-to-guess web addresses: anyone who has the exact link to a file can open it, so share links with care.
5. Who We share it with
We do not sell Your personal data for money. We share it only with service providers that help Us run the Service, under contracts that limit their use of it, and otherwise as described below.
Sign-in and email: Google (Google sign-in), Resend (sign-in links and service emails), Cloudflare (Turnstile bot checks).
AI generation and safety: fal.ai, KIE, WaveSpeed AI, BytePlus, Vidu and other model providers that run the models offered on the Service, and an AI provider used for prompt safety checks.
Hosting, storage and infrastructure: Our hosting provider, Cloudflare (R2 storage and content delivery), Upstash (rate limiting) and LogSnag (internal alerts, which can include the email address involved in a payment or error event).
Payments: Our payment processors and resellers, such as Dodo Payments, Creem, PayPro Global, PayPal and Stripe, which process Your payment and may act as merchant of record.
Analytics and advertising: Google Ads, to measure which ads lead to sign-ups and purchases (see section 6), and a web analytics service that counts page views and referrers.
Legal and safety: authorities, courts or other parties when the law requires it, to report child sexual abuse material, or to protect the rights and safety of users, the public or Us.
Business transfers: a buyer or successor if We are involved in a merger, acquisition or sale of assets, under this policy's protections.
6. Cookies, advertising and Your choices
Essential cookies keep You signed in and protect Your account. The Service cannot work without them.
Browser storage remembers things like Your language, Your last prompt and the campaign that brought You to the site.
Google Ads tags set cookies and record visits, sign-ups and purchases so We can measure Our ads. When You sign up or buy, We may send Google a hashed (scrambled) copy of Your email address so Google can match the conversion to an ad ("enhanced conversions").
You can block or delete cookies in Your browser settings, and limit Google's ad personalization at My Ad Center. Some U.S. state laws treat sharing data with advertising partners as a "sale" or "sharing" of personal information. To opt out, email [email protected] with the subject "Do not sell or share my personal information".
7. International transfers
We and Our providers process data in the United States and in other countries where they operate, such as Singapore and Hong Kong. Data protection laws there may differ from those where You live. When We transfer personal data out of the EU, EEA or UK, We rely on safeguards such as the European Commission's Standard Contractual Clauses or the provider's own approved transfer mechanisms.
8. How long We keep it
Account data: while Your account is open, and up to 30 days after You ask Us to delete it.
Prompts, uploads and results: until You delete them or Your account. Deleting an item removes it from Your library straight away; files are erased from storage when Your account is deleted, or sooner if You ask Us.
Purchase records: as long as tax and accounting laws require, usually up to 7 years.
Safety and security logs, including blocked requests: up to 12 months, or longer if needed for an investigation or legal claim.
Copies held by AI model providers and in backups are deleted on their own schedules, usually within a few weeks.
9. How We protect it
Data is encrypted in transit (HTTPS), access to Our systems is limited to people who need it, and We use established cloud and payment providers. No service can be completely secure, so We cannot guarantee absolute security. If a breach affects Your personal data, We will tell You and the authorities where the law requires.
10. Your rights
Wherever You live, You can ask Us to access, correct, export or delete Your personal data, and You can unsubscribe from marketing emails at any time.
EU, EEA and UK: You also have the right to object to processing based on legitimate interests, to restrict processing, to withdraw consent at any time, and to complain to Your local data protection authority.
U.S. states with privacy laws (such as California): You have the right to know what personal information We collect, use and disclose, to delete and correct it, to opt out of its "sale" or "sharing" for advertising, and not to be treated differently for using these rights. The categories We collect are identifiers, commercial information, internet activity, and the content You submit, as described in section 2. If We deny Your request, You can appeal by replying to Our answer.
To use any of these rights, email [email protected] from the email address on Your account. We may need to confirm Your identity, and We answer within 30 days (45 days where U.S. state law allows).
11. Children
The Service is only for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If You believe a minor has given Us personal data, contact Us and We will delete it.
12. Links to other websites
The Service may link to websites We do not control. Their own privacy policies apply there.
13. Changes to this policy
We may update this policy. We will change the "Last updated" date and, for material changes, tell account holders by email or in the product before the change takes effect.
Contact us
XEO Consistent Inc., Wyoming, United States
Email: [email protected]