Privacy

Shai Snir, Olei Tzion 30, Tel‑Aviv, Israel — the data controller for FLAM (flam.fashion). Write to [email protected] about anything on this page.

Your account. A name and an email address when you sign up, and — if you buy something — the billing details our payment provider needs. We never see or store your card number.

Your work. The photographs you upload: garments, packshots, references, and the images of people you cast as models. Plus everything FLAM develops from them, and the settings you chose.

How you use FLAM, but only after you accept the cookie banner. Analytics stay switched off until you say otherwise, and you can change your mind at any time.

FLAM keeps a model’s appearance consistent across a collection by sending the reference images you supply to the AI providers listed below, where they are processed to develop each frame. If those images show an identifiable person, that is their personal data as well as your file.

So: only upload images of a person you have the right to use. A signed model release, a licence, or your own likeness. You are responsible for having that permission, and for telling the person their image will be processed by the providers named here. Where the law treats facial imagery as a special category of data, that permission has to be explicit.

We do not use your uploads or your outputs to train our own models, and we do not sell them or share them with anyone beyond the processors below.

Your account and your work: to give you the service you asked for — the contract between us. Analytics and non-essential cookies: your consent, withdrawable at any time. Security, fraud prevention and keeping the books: our legitimate interest, and in the case of invoices, the law.

FLAM runs on other people’s infrastructure. Each of these processes data only on our instructions, under a data-processing agreement:

• Neon — the database: your account and the record of your work.
• Cloudflare — the API, the job queue and the object storage your images live in.
• Vercel — hosting for this site and the app, and the AI Gateway that routes image work to the providers below.
• Google, fal.ai, Replicate — the AI providers that develop your images. Your uploads reach them; your account details do not.
• Dodo Payments — checkout, subscriptions and invoices.
• Resend — the emails we send you.
• PostHog and Microsoft Clarity — product analytics. Dormant until you accept the banner.
• Infisical — our own secrets. It holds no data about you.

FLAM is operated from Israel, which the European Commission recognises as providing an adequate level of data protection — so data can move there from the EEA without extra safeguards. Our processors also operate in the United States and elsewhere, under the transfer mechanisms their own agreements provide.

Your account and your work stay while your account is open. Close it and we delete them within 30 days, except invoices and payment records, which tax law makes us keep for seven years. Analytics events expire on our provider’s schedule and are never tied to your uploads.

A copy of your data, a correction, deletion, a portable export, or that we stop a particular use — including withdrawing your analytics consent, which changes nothing about your account. Write to [email protected] and we will answer within 30 days.

If you are in the EEA or the UK and we handle it badly, you can complain to your national data protection authority. In Israel, to the Privacy Protection Authority.

If we change how any of this works we will update this page and, where the change matters to you, tell you directly rather than hoping you re-read it.