Privacy policy

Who we are

Klein Studio (flux3klein.org) is run by Zehong Liu, who is responsible for the personal data described here. Questions about your data: support@flux3klein.org.

Your prompts and images

When you press the button to make an image, your browser sends the prompt to our server. To edit an image, the browser first scales it (to at most 1536 pixels on the long side) and saves it again as a JPEG, which removes most of the information stored inside the file, such as the camera and the GPS location; then it sends it with the prompt.

Our server checks the prompt against our image rules. If you upload an image, it is checked automatically before anything else happens (see “Automatic content checks” below). Then the server sends the prompt and the image to the API of Black Forest Labs (“BFL”), a company in Germany that makes the FLUX 3 Klein model and runs it. BFL returns a link to the finished image, which your browser shows. BFL processes the request under its own terms and privacy policy; we have not been able to confirm from BFL’s public pages how long it keeps API requests and results. If a prompt or an image must not leave your control, do not send it.

We do not store uploaded images on our servers. For each image job we keep a record: when it started, the mode and size, the prompt, whether it worked, and the link to the finished image at BFL. The prompt is deleted from the record after 30 days and the link after 24 hours. We use these records to run the service, to enforce the acceptable use policy and to answer reports (our legitimate interests). We do not use your prompts or images to train AI models.

Automatic content checks

To keep forbidden content off the site, every request is checked automatically, by software and not by a person:

• The prompt is checked against our list of forbidden terms on our server. Then we send the prompt text (never an image) to Waffo Prompt Sift, the content-safety check of our payment provider Waffo; Waffo states that it does not keep the prompt after answering.
• An image you upload to edit is checked before it is sent to BFL, and the finished image is checked before it is shown to you. Both checks run on Cloudflare Workers AI, with the Llama 4 Scout model by Meta, which Cloudflare runs. The image is sent to Cloudflare for the check only, and we do not store it.

For every refusal we keep a log entry: the stage (prompt, uploaded image or finished image), the kind of content, which check refused it and what it matched, the time, the wallet code if you used one, the hashed visitor ID described under “Free use”, and the prompt. The log never contains the image. The prompt is deleted from the log after 30 days and the hashed visitor ID after 7 days; the rest of the entry is deleted after 365 days. We also keep daily counts of how many checks passed or refused, with no personal data, for 365 days. We use the log to enforce the acceptable use policy (refusals pause free images for the day and can block a wallet code), to answer reports and appeals, and to show the payment provider that our checks work (our legitimate interests and our legal obligations).

Free use

To keep the free images fair, we count free images per visitor per day. For this we store a keyed hash of your IP address combined with the date, never the address itself. The hash changes every day, so it cannot be used to connect your visits on different days, and we delete it after 7 days. The same hash is stored with refusals in the moderation log, so that repeated refusals pause free images for that day; it is deleted from them after 7 days too.

Before a free image, Cloudflare Turnstile checks that a person is using the page. Turnstile loads only when you start a free image. Cloudflare processes technical data such as your IP address and browser details for that check under its own Turnstile privacy policy.

Buying images

Checkout takes place on a payment page run by Waffo Pancake, a service of Waffo.com Limited (“Waffo”), which sells the images to you as our merchant of record. Waffo collects your payment details and email address, sends your receipt and processes this data under its own privacy policy. We never see or store your card number.

Your browser creates a random wallet code before checkout. It is not linked to your name. After the payment we store the wallet code, the pack and the images it added; Waffo’s order number, the amount charged and the order status; the email address on the order, as Waffo passes it to us; and a record of images used (as described above). In your browser we keep the wallet code and, while a checkout is open, a note of which pack you are buying.

Where you came from

When you start a checkout, we record the domain of the site that brought you here, the campaign tags on the link (utm_source, utm_medium, utm_campaign), the first page you opened on this site, and your approximate country, which Cloudflare infers from your network. Your IP address is not stored with this information. Your browser keeps these in its session storage until you close the tab. No cookie is set for this.

Hosting

The site, the API and the database run on Cloudflare; the database is hosted in the United States. Cloudflare processes technical data such as your IP address and browser type in its logs.

Analytics and cookies

If you accept analytics cookies in the cookie bar, we use Google Analytics 4 to count visits and see which pages are used. Nothing is loaded from Google before you choose, and you can change your choice with “Cookie settings” at the bottom of every page. Google Analytics is set up without Google’s advertising features.

Who receives data

We do not sell or rent personal data or use it for advertising. It is shared only with the services that run the site: Cloudflare (hosting, database, Turnstile, and the automatic image checks on Workers AI), Black Forest Labs (making the images) and Waffo (payments, receipts, refunds, and the prompt check described above), and Google (analytics, only with your consent). These services may process data outside your country, including in the United States, the European Union and Hong Kong.

How long we keep it

Uploaded images: not kept by us. Finished images that fail our check: not shown, and their link is not kept. Prompts: 30 days. Links to finished images: 24 hours (BFL’s links stop working sooner, so save images you want to keep). Hashed IP addresses: 7 days. Moderation log entries (without images): 365 days; daily check counts: 365 days.

We keep the email address on a purchase while its images can be used and for 12 months after the service closes. After that we delete it and keep only the order number, the pack, the amount and the dates.

You can ask us to delete your purchase record. We then delete the email address and keep only the order number, the pack, the amount and the dates for our accounts.

Your rights

Depending on where you live (for example, the EU, the UK, or California), you can ask to see, correct, or delete your personal data, to receive a copy of it, or to object to how we use it. Write to support@flux3klein.org and we will reply within one month. You can also complain to your local data protection authority.

Children

The site is not aimed at children, and packs are sold by Waffo only to buyers aged 18 or older. If you believe a child has given us personal data, write to us and we will delete what we hold.

Changes

If we change this policy, we will update the date at the top of this page.