Privacy Policy

dGEN Productions (Oudekerkstraat 45, 5507 LB Veldhoven, Netherlands, Chamber of Commerce 97916137) is the controller for the personal data described here. For anything in this document, write to legal@dgenvisual.com.

• Your account. Email address, an optional name, and a hashed password. We need this to give you an account at all , performing the contract.
• What you make. Your prompts, your settings, the images and video you generate or upload, and your flows. If you put a person in a prompt or upload a photo of one, that is personal data too, and you are the one who decided to put it there.
• Your credit history. Every deduction and refund, with the reason. We keep this because you are entitled to check what you were charged for, and because we have to account for it.
• Runs. Which model ran, when, what it cost, whether it succeeded, and the error if it did not.
• Connected AI agents. Which application you granted access to, what permissions, and every action it took on your behalf , including the ones we refused. That audit trail is the point: an agent that tried something ten times without permission is exactly what you want to see.
• The waitlist, if you signed up: your name and email address, plus a one-way hash of your IP address. The hash exists only to slow down mass sign-ups , we cannot turn it back into an address.

We do not use tracking cookies, we run no advertising network, and we do not build a profile of you. The only cookies we set are the ones that keep you signed in.

• Performing our contract with you: your account, your work, your credits, your runs.
• Our legitimate interest in a service that keeps working and is not abused: the rate limits, the agent audit trail, and error logging.
• Your consent: the waitlist, which you confirm by clicking a link in an email, and which you can withdraw at any time.
• A legal obligation: financial records we have to keep, and reports we are required to make.

To run the studio we use the parties below. Each of them processes only what its job needs, on our instructions.

We do not sell your data and we do not hand it to anyone for advertising. We hand it over to authorities only when the law requires it.

Your account, your files and your history sit in the European Union , our database and storage run in Ireland. Two things do leave: the material a generation needs goes to fal.ai in the United States, and the text you send to the AI assistant goes through OpenRouter, also in the United States. Those transfers rest on the European Commission’s standard contractual clauses.

Only what a single generation needs goes out, and only at the moment it runs. Your library, your flows, your credit history and your account never leave the EU.

We do not use your material to train models, and we do not let anyone else use it for that either, as far as it is in our hands. Every call to the assistant carries an instruction to route only to providers that do not collect data and only to endpoints that retain nothing. That is in our code, on every request.

What we cannot do is audit a provider’s internal systems. fal.ai states it deletes data tied to an account within 30 days of that account closing, or after two years of inactivity. We pass on your material for a single generation and keep the result on our side.

• Your account and everything in it: as long as your account exists.
• Delete your account and it is gone , the account, the flows, the runs, the credit history, and the files in storage, which we remove explicitly because storage does not follow a database cascade.
• Uploads that never completed: removed automatically after 24 hours. Those are files with no entry in your library, invisible to you and costing us.
• Waitlist sign-ups that are never confirmed: they expire and are cleaned up. Confirmed sign-ups stay until the studio opens or until you ask us to remove yours.
• Financial records: kept for as long as Dutch tax law requires, currently seven years.

Your files sit in private storage; they are only reachable through short-lived signed links. The database enforces per-row access rules, so one account cannot read another’s data even if our own code made a mistake , and we test that against the real database rather than assuming it.

A connected AI agent gets only the permissions you ticked, its actions are logged, and revoking it takes effect immediately for access already issued , not when some token happens to expire.

If a breach occurs that is likely to affect your rights, we notify the Dutch data protection authority within 72 hours and tell you when the rules require it.

You can ask us to show you what we hold, correct it, delete it, limit what we do with it, hand it to you in a portable form, or object to us holding it. Where we rely on your consent, you can withdraw it at any time without affecting what came before.

Some of it you can do yourself and immediately: change your name, change your password, and delete your account with everything in it, all from your account page. For anything else, write to legal@dgenvisual.com and we will answer within a month.

Unhappy with how we handled it? You can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), or to the supervisory authority where you live.

The studio is not for people under 16. We do not knowingly hold data about them; if we find that we do, we delete it.

When this policy changes, the date at the top changes with it. For a change that materially affects you, we tell you by email before it takes effect.