Privacy Policy

Last updated: July 2, 2026

This Privacy Policy describes how Flo AI, operated by Giant Bison LLC ("we", "our", "us"), collects, uses, and protects information when you use the Flo AI mobile application. Flo AI does not require you to register or create an account.

Information We Collect

• Content you provide — the photos you upload and the text prompts you write for AI generation. For the birthday and photoshoot features, you may also enter a name and age for the person in the scene, which we use to personalize the generated result.
• Device and technical data — a vendor identifier (IDFV) generated by Apple that persists while you keep the app installed, a stable user ID we assign to keep your credits and subscription tied to your device, and basic device and technical information such as your device model, operating-system version, app version, and language/region. These identifiers do not include your name or email, but they are persistent and can be used to recognize your device, so we describe them as pseudonymous rather than anonymous.
• IP address and approximate location — when your app contacts our servers, our backend and our processor SalesCentral automatically receive your device's IP address. It is used transiently to apply rate limits and protect Flo AI against abuse and automated scraping, and to derive an approximate location (your country, and in some cases region) for analytics and security. We do not use your IP address to build an advertising profile.
• Subscription and credit status — derived from your Apple StoreKit purchases, used to determine your access level and credit balance.
• Prompt-unlock history — a record of which prompts you have unlocked, and the credits spent to unlock them, kept so you keep access to those prompts across reinstalls and devices.
• Push token — if you enable notifications, the Apple Push Notification service (APNs) token for your device.
• Usage and analytics data — product-analytics events (for example, opening the app, starting and completing a generation, and viewing the paywall), a small set of behavioral properties (such as whether you have completed onboarding or generated content, and your last-used generation mode), an A/B experiment assignment, and your app version.
• Generated content — the images and videos you create, stored on your device.

Aside from a name and age you may enter for the birthday and photoshoot features, we do not ask for your name, email address, or other directly identifying information.

How We Use Your Information

• To provide the AI features you request — generating images and videos from your photos and prompts.
• To operate your credits and subscription and determine your access level.
• To send the notifications you have enabled.
• To understand how Flo AI is used, run A/B experiments, and improve the app.
• To keep Flo AI secure — applying rate limits and detecting and preventing abuse, fraud, and automated scraping, using your IP address and device identifiers.

We do not sell your personal information, and we do not sell your content.

Legal Bases for Processing (EU/UK)

Where the GDPR, UK GDPR, or similar laws apply, we rely on the following legal bases:

• Performance of a contract — to provide the AI features you request and to operate your credits, subscription, and access level.
• Legitimate interests — to run product analytics and A/B experiments and to keep Flo AI secure and improve it, balanced against your rights and freedoms.
• Consent — to send the push notifications you enable. You can withdraw this consent at any time in iOS Settings.

AI Generation

Our app uses fal.ai to generate images and videos and to process the prompts and photos you submit. When you use AI features, your prompts and uploaded photos are sent to and processed by fal.ai to produce your generated output. (Our backend also briefly stores your prompt and the media links — see Data Retention.) We do not sell your content.

fal.ai receives your prompts and uploaded photos in order to generate your results. The data fal.ai holds is kept on its own infrastructure and governed by fal.ai's own data-retention and privacy practices, which we do not control — see fal.ai's Privacy Policy for how it handles, and how long it keeps, this data. Our own backend stores your prompt and the links to your input and output media only briefly, to run and recover the generation (see Data Retention), and your generated images and videos are stored on your device, not on our servers.

By using the AI features, you acknowledge that your content is processed by fal.ai to generate your results.

Service Providers

We share data with a limited set of service providers strictly to operate Flo AI:

• fal.ai — our generative-AI infrastructure partner, which receives your prompts and uploaded photos to produce your results (see AI Generation).
• Cloudflare — hosts our backend infrastructure (servers, database, and storage). Your requests — including prompts, links to your input and output media, and request metadata — pass through and are processed on Cloudflare.
• Apple — processes your subscription purchases through StoreKit and delivers your notifications through the Apple Push Notification service.
• SalesCentral — our third-party subscription, entitlement, and product-analytics platform, acting as our data processor (see International Data Transfers for where this data is stored). When you purchase, use credits, or use the app, SalesCentral receives the signed Apple transaction record, your subscription and credit status, the IDFV (the Apple vendor identifier), the pseudonymous user ID we assign, device and technical data (such as device model, OS version, app version, and language/region), an approximate location (country) derived from your IP address, your push token if notifications are enabled, and your in-app analytics events. It processes this data only on our instructions to manage your subscription and credits and to provide our analytics, and does not sell, share, or use it for its own purposes. See SalesCentral's Privacy Policy.

We do not sell your personal information to anyone.

Analytics

We use analytics to understand how Flo AI is used and to improve it. We record product events (such as app opens, generation starts and completions, and paywall views), a small set of behavioral properties, an A/B experiment assignment, and your app version, tied to your pseudonymous user ID. These analytics are collected through SalesCentral, our third-party subscription and analytics processor (see Service Providers), which processes them only on our instructions and does not use them for its own purposes or share them with other companies. We do not use advertising identifiers and we do not track you across other companies' apps or websites.

Push Notifications

If you enable notifications, Apple issues a push token for your device. This token is registered with our subscription and analytics processor, SalesCentral (see Service Providers), which holds it on our behalf and delivers the notifications you have enabled, such as reminders and product updates; it is not stored on our own backend. The token is refreshed each time you open the app. You can turn notifications off at any time in iOS Settings → Notifications → Flo AI.

Data Retention

Account and activity records. We keep your data only as long as needed to operate Flo AI. Records tied to your access — such as your purchase and prompt-unlock history and your device registry — are kept until you ask us to delete them. Operational logs, such as your generation history, are kept for a limited period and then deleted.

Your generations. The images and videos you create are stored on your device, not on our servers. To run a generation and keep the app working reliably, our backend temporarily holds your prompt and the media links for as long as needed to process the request and support retry and recovery, then deletes them. Your prompts and photos are also processed by fal.ai under its own retention policy (see AI Generation).

Security and rate-limiting. Your IP address is used transiently by our backend to apply rate limits and may appear in backend security logs used to detect and prevent abuse. We do not use it to build an advertising profile of you.

Deletion. You can ask us to delete your data at any time by emailing contact@giantbison.com. When you do, we will delete your account and activity records — your credit and subscription status, prompt-unlock history, device registry, and generation log — from our own backend without undue delay, within the timeframe required by applicable law. We also instruct SalesCentral to delete the data it holds about you, which it removes on its own deletion schedule and purges from its backups in the ordinary course. Content you sent to fal.ai expires under fal.ai's retention policy, and purchase records held by Apple are governed by Apple's policies.

Your Rights

You can request access to, correction of, or deletion of the data we hold about you at any time by emailing contact@giantbison.com. You can disable notifications (iOS Settings → Notifications) at any time.

Residents of the EU, UK, California, and other jurisdictions have rights under the GDPR, the CCPA/CPRA, and similar laws — including the rights to access, correct, delete, restrict, object to, and port your data, and, where applicable, to opt out of the "sale" or "sharing" of personal information. Where we process your data on the basis of our legitimate interests (including product analytics and A/B experiments), you have the right to object to that processing; to do so, email contact@giantbison.com. We do not sell or share your personal information for cross-context behavioral advertising. Depending on where you live, you also have the right to lodge a complaint with your local data-protection supervisory authority; where our processing relies on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Age Requirement

Flo AI is intended for users 16 years of age or older. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has provided us with data, please contact us and we will delete it.

Security

We use industry-standard security practices including HTTPS for all network traffic and Apple's iOS Keychain and Data Protection APIs for on-device sensitive data.

International Data Transfers

Your data is processed in several countries. Wherever it is processed, we rely on appropriate safeguards where required — including the European Commission's Standard Contractual Clauses (and the UK Addendum) incorporated into SalesCentral's Data Processing Agreement; a copy of the safeguards we rely on is available on request at contact@giantbison.com. fal.ai and Cloudflare operate on infrastructure in the United States and other countries, Apple operates globally, and SalesCentral stores your subscription, credit, and analytics data on its own infrastructure in the Republic of Armenia — a party to Council of Europe Convention 108/108+ — where we are also based. SalesCentral's sub-processors (including Apple and Cloudflare) are located in the United States. These countries may have data-protection laws that differ from those where you live. By using Flo AI, you understand that your information may be transferred to and processed in these locations.

Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the app or via the contact below.

Contact

Questions about this Privacy Policy? Contact us at contact@giantbison.com.