Privacy
Last updated 17 September 2026
Draft — under review by our counsel.
The short version
We hold what we need to run a paid studio for you: who you are, what you asked for, what came back, and what you paid. We do not sell it, we do not rent it, and we do not show you advertising.
If you want it gone, write to hello@innerlabs.ai and we will delete it, apart from the records tax law makes us keep.
What we hold about you
From Google sign-in: your name, your email address, your profile picture and your Google account id. We never see your password and we cannot read anything else in your Google account.
From using Flow: your prompts, the settings you chose, any reference images you upload, and the images and video that come back. Your wallet balance, every credit and debit against it, and the top-ups you have made.
From your browser, automatically: an IP address and a user agent in our server logs, kept briefly so we can see errors and abuse.
Where your renders live
Prompts, settings and renders are stored in our own Google Cloud project — a private bucket and a private database, in India where the service offers it. The bucket is not public: the studio reaches a file through a short-lived signed link that is checked against your account each time.
We keep your renders so your library works. Delete one and it goes; delete your account and they all go.
Who else touches it
fal.ai runs the models. Your prompt, your settings and any reference image you upload are sent to fal to produce the render — there is no way to generate an image without sending it to whoever runs the model.
Razorpay takes the payment. Card and UPI details go to Razorpay directly and never reach our servers; we receive the amount, the payment id and the state you gave for the invoice.
Google Cloud hosts the application, the database and the bucket. An email provider sends your receipts and invoices.
That is the whole list. Each of them is a processor working on our instructions, not a buyer of your data.
What we do not do
We do not sell or rent your data, to anyone, for anything.
We do not run advertising, and there are no advertising or analytics trackers on this site. If that ever changes, this page changes first.
We do not train models on your prompts or your renders. We do not train models at all. We cannot make that promise on behalf of the model vendors — their terms govern what they do with what passes through them — which is why the list above is short and named.
We do not use your work to promote Flow without asking you first, in writing, each time.
How long we keep it
Your account and your renders: until you delete them, or until you ask us to close the account.
Invoices, payments and the wallet ledger: for as long as Indian tax and company law require us to keep them, which is years rather than months. These survive a deletion request because we are not allowed to destroy them — and because they are the record of money that moved between us.
Server logs: weeks, not years.
Deleting your account
Write to hello@innerlabs.ai from the address you signed in with and ask. We will confirm, then delete your account, your prompts and your renders, and tell you when it is done.
You can also ask us for a copy of what we hold about you, or to correct something that is wrong.
Security, honestly
Everything travels over TLS. The database and the bucket are private and reachable only from our own service. A small number of people at InnerLabs can reach production, and access is by named account.
No one can promise a breach will never happen. If one does and it affects you, we will tell you what happened, what we know and what we are doing — without waiting to be asked.
Children
Flow is for people 18 and over. We do not knowingly collect anything about a child. If you believe we have, write to hello@innerlabs.ai and we will delete it.
Changes, and who to write to
When this page changes, the date at the top changes with it. A change that affects what we do with your data will also reach you by email.
Questions about any of this: hello@innerlabs.ai.