- “Customer Content” means what you or your team upload, type, record or generate in QikTools: prompts, scripts, documents, images, audio, video, brand assets, projects and the outputs made for you.
- “Customer Personal Data” means personal data contained in Customer Content that we process on your behalf.
- “Data Protection Laws” means the laws that apply to processing Customer Personal Data, including the EU General Data Protection Regulation 2016/679 (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection, and India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, “DPDP”).
- “Sub-processor” means a provider we engage that processes Customer Personal Data, as listed in Annex III.
- “Controller”, “processor”, “data subject”, “personal data breach” and “processing” have the meanings given in the GDPR; “Data Fiduciary”, “Data Processor” and “Data Principal” have the meanings given in the DPDP Act.
- You are the controller of Customer Personal Data, or a processor acting for your own client, in which case we are your sub-processor. We are your processor. Under the DPDP Act, you are the Data Fiduciary and we are your Data Processor.
- We are an independent controller, not your processor, for: your account and team details; billing and payments; usage and cost records; security, fraud-prevention and safety records (including the checks we run on requests); provenance records of generated files and one-way fingerprints of generated text; consent evidence; reports and takedowns; and anything the law requires us to keep. Our Privacy Policy describes that processing.
- Annex I describes the processing: its subject matter, nature and purpose, the types of personal data and the people concerned. It lasts for as long as we provide the Service to you, and then until the data is deleted as section 11 describes.
- We process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA and the choices you make in the Service: for example which tool and which AI model runs a job, what you save, share or delete, and who in your team has access.
- If the law requires us to process Customer Personal Data in another way (for example to preserve removed content or to comply with a court order, as India’s IT Rules require), we will tell you before we do, unless the law forbids it.
- We will tell you if we believe an instruction breaks Data Protection Laws, and we don’t have to follow an instruction we believe is unlawful.
- You are responsible for having a lawful basis for the Customer Personal Data you put into QikTools, for the notices and consents your data subjects need (including the written consent of anyone whose face or voice you use), and for your instructions being lawful.
- Access to Customer Personal Data is limited to the proprietor and to anyone else we authorise to help run the Service, each bound by a duty of confidentiality and given only the access their work needs.
- We don’t look at Customer Content except where needed to provide or support the Service at your request, to keep it secure, to handle a report or a safety concern, or where the law requires.
- We protect Customer Personal Data with the technical and organisational measures in Annex II, designed to keep it confidential and intact, to protect it against loss and unauthorised access, and to keep the Service available (Article 32 GDPR; DPDP Rule 6).
- We keep these measures under review. We may improve or replace them, but we won’t reduce the overall level of protection.
- You give us general authorisation to engage the sub-processors listed in Annex III and on our Third-Party Processors page.
- We will tell you about a new sub-processor at least 14 days before it starts processing Customer Personal Data, by updating that page and its RSS feed. If a change is urgently needed to keep the Service running or secure, we will tell you as soon as we can.
- You may object to a new sub-processor on reasonable data protection grounds by writing to hello@qiktools.com within that notice period. We will work with you in good faith on a solution, such as not using the affected feature or model for your data. If we can’t resolve it within 30 days, you may stop using the affected part of the Service or stop using QikTools; any refund follows the Terms.
- We engage sub-processors under written terms (their data processing or API terms) that require them to protect personal data and to use it to provide their service, with the one exception noted in Annex III. We remain responsible to you for our sub-processors as Data Protection Laws require.
- To run a tool, we send the inputs that job needs to the AI provider whose model runs it, and the provider returns the output. Tools that let you choose a model show which one will run, every screen that uses a Runway-served model shows “Powered by Runway”, and Annex III shows which providers may receive your content.
- Some AI providers’ standard terms allow them to use content they receive to train or improve their models. For example, Runway’s terms (updated 15 September 2026) say inputs and outputs may be used to train its models. Annex III and our AI Models & Providers page show each provider’s stance.
- Where a provider lets us switch training off, we do. Where it doesn’t, that provider uses the content under its own terms, as an independent controller, and we have no control over that use.
- By running a tool or model served by such a provider, you instruct us to send it the content that job needs on those terms. If that isn’t acceptable for some of your data, don’t submit that data, or choose a tool or model whose provider doesn’t train on content.
We are based in India. Our providers work mainly in the United States; some model developers reached through Fal and Runway are based elsewhere, including China and Singapore (see the processors page). So Customer Personal Data may be processed outside the country where you or your data subjects are.
- European Economic Area. Where you transfer Customer Personal Data from the EEA to us, the Standard Contractual Clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 (the “SCCs”) apply and are incorporated into this DPA by reference: Module Two (controller to processor) where you are a controller, and Module Three (processor to processor) where you are a processor. Clause 7 (docking) does not apply. Under Clause 9, option 2 (general written authorisation) applies, with the notice period in section 6. The optional wording in Clause 11 does not apply. Under Clause 13, the competent supervisory authority is the one responsible for you. Under Clause 17, option 2 applies: the SCCs are governed by the law of the EU Member State where you are established, or by Irish law where that law doesn’t allow third-party beneficiary rights or you have no establishment in the EU. Under Clause 18, disputes go to the courts of the Member State whose law governs. Annexes I, II and III of this DPA complete the SCCs’ annexes.
- United Kingdom. Where the UK GDPR applies, the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner (version B1.0, in force from 21 March 2022) applies and is incorporated: Table 1 is completed with the parties in Annex I, Table 2 with the modules and options above, and Table 3 with Annexes I to III; for Table 4, either party may end the Addendum as its Section 19 allows.
- Switzerland. Where the Swiss Federal Act on Data Protection applies, the SCCs apply with the changes the Swiss Federal Data Protection and Information Commissioner requires: references to the GDPR include the Swiss Act, the Commissioner is the competent supervisory authority for transfers under it, and data subjects in Switzerland may bring claims there.
- Onward transfers. Transfers from us to our sub-processors rely on the safeguards in their data processing terms, such as the SCCs, as Clause 8.8 of the SCCs requires.
- India. We won’t transfer Customer Personal Data to any country or territory the Government of India restricts under section 16 of the DPDP Act.
- If we become aware of a personal data breach affecting Customer Personal Data, we will tell you without undue delay, and within 48 hours of becoming aware of it, at the email address on your account.
- We will tell you, as far as we know: what happened; the categories and approximate number of people and records concerned; the likely consequences; what we have done or plan to do; and who to contact for more. Where we don’t know everything yet, we will tell you what we know and follow up.
- We will take reasonable steps to contain the breach and limit its effects. We won’t notify your data subjects or supervisory authorities about your data on your behalf unless you ask us to, but we will make the reports the law requires of us, such as reporting a reportable incident to CERT-In within 6 hours of noticing it.
- Telling you about a breach is not an admission of fault or liability.
- Data subject requests. You can export, correct and delete Customer Content yourself (Settings → Profile → Download my data, and by deleting projects, files, your team or your account). If one of your data subjects writes to us directly about your content, we will pass the request to you and won’t answer it ourselves unless you ask us to or the law requires. Where you need more help, we will give it within a reasonable time.
- Assessments. We will give you the information we reasonably can to help with data protection impact assessments and with consultations with supervisory authorities about the Service.
- Security and breaches. We will help you meet your own security and breach obligations as sections 5 and 9 describe.
- You can download or export your Customer Content at any time while your account is open, including before you close it.
- When you delete content, or your account or team, we delete the Customer Personal Data in it from our live systems. Copies in backups cycle out within 30 days.
- Generated files are hosted on our AI providers’ delivery networks, which remove them on the providers’ own schedules (some after about 7 days). We can’t always delete those files on request before then. Files you save to your library or private storage are deleted with your account.
- Records we hold as a controller under section 2, such as provenance records of generated files, one-way fingerprints of generated text, consent evidence and evidence of removed content, are kept for the periods in our Privacy Policy’s retention schedule, and protected while we hold them.
- We make available the information needed to show that we meet this DPA: this document, our Trust Center, our security questionnaire, and written answers to your reasonable questions.
- If that isn’t enough to meet your obligations or a supervisory authority’s request, you, or an independent auditor you appoint who is bound by confidentiality, may audit our compliance with this DPA: with at least 30 days’ written notice; no more than once in any 12 months, unless a supervisory authority requires it or after a personal data breach; during business hours in India; at your own cost; and without access to other customers’ data or to information that would put the security of the Service at risk. We will agree the scope with you first, and start with a review of documents.
Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where Data Protection Laws don’t allow liability to be limited, for example the rights data subjects have under Article 82 GDPR. Nothing in this DPA limits data subjects’ rights under the SCCs.
- If this DPA and the Terms disagree about the processing of Customer Personal Data, this DPA applies. If the SCCs and this DPA disagree, the SCCs apply.
- We may update this DPA when the law, the Service or our sub-processors change. We will tell you about material changes in advance, as the Terms describe for changes to them, and we won’t reduce the overall protection this DPA gives your data without telling you first. The version and date are shown at the top.
- This DPA ends when the Terms end, but its obligations continue for as long as we hold Customer Personal Data.
This section applies when India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 apply to the processing of Customer Personal Data. We apply it now, ahead of the dates on which those duties come into force.
- Contract. This DPA is the contract under which you, as Data Fiduciary, engage us as your Data Processor (section 8(2) of the Act).
- Purpose. We process the personal data of your Data Principals only to provide the Service to you, on your instructions in section 3.
- Security. We apply reasonable security safeguards to prevent a personal data breach (section 8(5); Rule 6), including the measures in Annex II: encryption, access control, and logging and monitoring.
- Breaches. We will tell you about a personal data breach without delay, as section 9 describes, with the details you need to inform the Data Protection Board of India and each affected Data Principal (section 8(6); Rule 7).
- Erasure. When you tell us to erase personal data, for example because a Data Principal has withdrawn consent or the purpose is no longer being served, we will erase it as section 11 describes, unless a law requires us to keep it (section 8(7)).
- Children. If you process the personal data of a child (anyone under 18), you are responsible for obtaining the verifiable consent of a parent or lawful guardian where section 9 of the Act requires it. We don’t track, monitor the behaviour of or target advertising at children.
- Transfers. We won’t transfer the personal data to any country or territory the Government of India restricts (section 16).
- Grievances. Our Grievance Officer, Sarthak Daruka (hello@qiktools.com), will help you respond to your Data Principals’ requests and grievances.
Annex I: Details of processing
| Item | Details |
|---|---|
| Data exporter (controller) | You, the business customer identified by your QikTools account or team, reachable at the email address on that account. |
| Data importer (processor) | Sarthak Daruka, trading as QikTools. QikTools is a trade name of Sarthak Daruka, an individual carrying on business in India as a sole proprietor. Principal place of business: Asansol, Paschim Bardhaman, West Bengal, India. Contact: hello@qiktools.com. Grievance Officer: Sarthak Daruka, hello@qiktools.com. |
| Data subjects | People shown, heard, named or described in Customer Content, such as your staff, presenters and models, clients and customers, and anyone in the photos, recordings, videos or documents you upload; visitors who send an enquiry through a property page you publish; and clients who review work through a review link you send, including the people at a client whom you let sign in to your review portal. |
| Personal data | Names and other details in prompts, scripts, documents and brand assets; images and video showing people, including faces; voice recordings and speech; the name, email address, optional phone number, message and recorded agreement of a visitor who sends an enquiry through a property page; the name, optional email address, comments and decisions of a client who reviews work through a review link; the email address and optional name of each person you let sign in to your review portal, and when they last signed in; any other personal data you choose to include in Customer Content. |
| Sensitive data | Faces and voices are processed only to make what you ask for, never to identify people: we don’t build face or voice recognition templates. Please don’t put special categories of personal data (such as health data) into QikTools unless a task truly needs it. |
| Frequency | Continuous, whenever you or your team use the Service. |
| Nature of the processing | Storage and hosting; sending inputs to the AI providers that run each job and receiving the outputs; generating, editing, transcribing and translating content; screening requests for safety; marking outputs with AI labels and Content Credentials; sharing within your team and through share and review links you create, and emailing a one-time sign-in code to the people you let sign in to your review portal; hosting property pages and passing their enquiries to you; and, when you connect a YouTube channel or an ad account, reading from it what you authorise. |
| Purpose | To provide the Service to you under the Terms. |
| Duration and retention | For as long as we provide the Service to you, then deleted as section 11 describes. Our retention schedule: https://www.qiktools.com/legal/privacy#retention. |
| Where | As listed for each sub-processor in Annex III. |
| Competent supervisory authority | The authority responsible for you (see section 8). |
Annex II: Technical and organisational measures
Encryption
- Every page and API is served over HTTPS (TLS), with HSTS in production so browsers refuse plain HTTP.
- Our database and file storage host, Supabase, encrypts the data it stores for us at rest with AES-256. Generated files hosted by our AI providers are stored on their infrastructure under their terms.
- Calls to our sub-processors’ APIs use HTTPS.
Access control
- Row-level security on every database table: each request can read or change only the signed-in person’s own data, or data explicitly shared with their team.
- Uploads you keep are in private storage that only you, and your team when you share, can open. To run a job, the file is sent to the AI provider, which may hold a temporary copy at an unguessable address. Share links are opt-in, can be protected with a password or an end date, and can be switched off at any time.
- Secret keys, including the database’s all-access key, are used only in server code and never reach the browser. Every production build is scanned and fails if a server secret appears in browser files.
- Database functions are locked down so the public and signed-in roles can call only what they need.
- The admin console is limited to named administrators, accounts that sign in with single sign-on can never be administrators, and every admin action is written to an audit log.
- Team owners control roles, permissions, approvals and spending limits, and can require single sign-on for verified company domains.
Authentication
- Email confirmation for new accounts. New passwords need at least 8 characters and are checked against common passwords; our sign-in provider stores passwords only as secure hashes.
- Bot protection at sign-up, and rate limits on sign-in, sign-up and password resets.
- Sign-in cookies are sent only over HTTPS in production and are protected against use from other sites.
- API keys are stored only as secure hashes and can be revoked at any time.
- Single sign-on (SAML) and automatic provisioning (SCIM) are available for teams, set up with us on request.
Application security
- Requests that change data are refused when they come from other sites, and every input is validated and size-limited before work starts.
- Links you give us are fetched through a guarded client that refuses private and internal network addresses.
- Security headers on every page: no framing by other sites, no content-type sniffing, and strict referrer and permission policies.
- Internal reviews of the code for security, data-access and payment risks, including attack tests of database rules, storage and request forgery, with findings fixed before release.
Abuse prevention and AI safety
- Requests that reach a generative model are screened before they run, by our own rules, a list of public figures and an automated moderation model: their text and images, and frames and the opening speech of uploaded video and audio. Tools that only read your own files aren’t screened.
- Real people’s faces and voices need a recorded consent confirmation, and voices saved for reuse need a spoken consent from their owner.
- Rate limits on every paid tool and costly free feature; automated fraud signals; strikes and restrictions, with suspensions and closures decided by a person apart from the automatic pauses our Privacy Policy describes.
- Realistic outputs carry a visible AI label; generated files carry metadata and, where the format allows, Content Credentials; anyone can check a file at /verify.
Logging, monitoring and incident response
- Safety and sign-up records are kept for 1 year; server and sign-in logs are kept by our hosting providers under their retention settings. Admin actions, refused requests (without the refused text) and payment events are recorded.
- Daily automated checks for fraud signals and overdue reports, with alerts.
- Incidents: business customers are told within 48 hours; reportable incidents go to CERT-In within 6 hours and to the Data Protection Board of India with a detailed report within 72 hours; where we are a controller under the GDPR, the relevant authority within 72 hours.
Availability and resilience
- Managed hosting and database services, monitored by their providers.
- Background jobs are tracked in our database, so they finish, or are cancelled at the provider and refunded, even if you close the page.
Data minimisation and deletion
- Each AI provider receives only what one job needs.
- Presenter photos are deleted at our video provider as soon as each video is ready (Runway’s terms still let it use inputs, including presenter photos, to train its models), and face tracking in the Video Clipper runs on your device.
- Self-service export and deletion. Periods for data we hold are enforced by scheduled jobs where a deletion is due; files hosted by our AI providers follow their schedules.
People
- Access is limited to the proprietor and anyone else authorised to help run the Service, each bound by confidentiality.
Annex III: Sub-processors
The providers below may process Customer Personal Data. The current list, with any announced changes, is always at www.qiktools.com/legal/subprocessors.
| Provider | What it does | Data it receives | Where |
|---|---|---|---|
| Supabase (Supabase, Inc.) | Database, sign-in, private file storage, the public pictures and video of published property pages, and live collaboration. | Account details, projects, uploads, brand assets, usage and purchase records, and everything else stored in your account. | Amazon Web Services cloud, in our project’s region |
| Web hosting provider | Runs the QikTools website and servers. | Every request to our site: IP address, browser details and server logs. | To be named here before QikTools goes live |
| Cloudflare (Cloudflare, Inc.) | Turnstile bot protection when you sign up, claim your trial credits, send a report, or send an enquiry through a property page. | IP address and browser signals used to tell people from bots. | Global network |
| GoDaddy (GoDaddy Operating Company, LLC) | Business email: sends and stores account, team, reminder and support emails. | Your name, email address and the message. | United States |
| Provider | What it does | Data it receives | Where | Training on content |
|---|---|---|---|---|
| OpenAI (OpenAI, L.L.C.) | Writing, scripts, translation, plans, captions and document answers; reading images, pages and documents (for example product photos and alt text); GPT Image generation and editing; text-only transcription; the help assistant (in text and, with Talk to Munns, by voice); safety checks on requests; translating non-English ad scripts for the claim check; the check that decides whether an output needs a visible AI label; descriptions and search for your asset library. | The text, images or audio each job needs (for Talk to Munns, the live audio of the conversation). | United States | No training by default. OpenAI’s Services Agreement (v. 1 January 2026): “OpenAI will not use Customer Content to develop or improve the Services, unless Customer explicitly agrees to such use.” |
| Fal (Features & Labels, Inc., fal.ai) | Runs image, video, voice, timed-transcription, voice-separation, music, lip-sync, 3D, background-removal and upscaling models, joins video pieces with their soundtrack, trains custom brand models, and hosts generated and working files. | The prompt and the images, audio or video each job needs; training images for a custom model; generated files. | United States | No training by default. fal’s API Services Terms: “Company will not use Client Content to create, train, develop (directly or indirectly) Company’s products or services” — for models fal marks “Pending Enterprise Ready” its security commitments and data processing addendum don’t apply. We only use models fal marks Enterprise Ready; cloud film renders are prepared and checked on our own servers and joined with fal’s Enterprise Ready FFmpeg compose. |
| Runway (Runway AI, Inc.) | Video models, talking-head presenters, image models, the Voice Studio’s Expressive voice, voice changing, dubbing and voice isolation. | The prompt, the text to be spoken, and the images or audio each job needs. Presenter photos are deleted after each video. (Runway’s terms still let it use inputs, including presenter photos, to train its models.) | United States | May train on content. Runway’s Terms of Use (updated 15 September 2026, read again on 10 October 2026) say “Inputs and Outputs may be used by the Company to train and improve its AI models” — this covers everything we send through Runway, including other companies’ models it runs for us and the Nano Banana pictures it makes as a backup. A request made with “Only providers that don’t train on my content” never goes to Runway. |
| Developer | Models | Reached through | What they may receive | Where | Training on content |
|---|---|---|---|---|---|
| Gemini Omni Flash 1.1, Veo 3.1, Veo 3.1 Fast, Veo 3.1 Lite, Nano Banana 2.1, Nano Banana Pro, Lyria 2, Nano Banana 2 | Fal: Gemini Omni Flash 1.1, Veo 3.1, Veo 3.1 Fast, Veo 3.1 Lite, Nano Banana 2.1, Nano Banana Pro, Lyria 2; Runway: Nano Banana 2, Nano Banana Pro | Video, image and music jobs (Runway receives picture jobs only as a backup when Fal can’t make them, never for requests that ask for providers that don’t train on your content) | United States (Google may also process data in other countries where it has facilities) | No training by default. Google’s Gemini API Additional Terms (effective 23 March 2026, page updated 28 April 2026, read again on 10 October 2026) say that for paid services “Google doesn’t use your prompts … or responses to improve our products”; we reach Google’s models through fal, which pays for them (fal marks the Nano Banana models we use “Enterprise Ready”, checked 10 October 2026), and, for Nano Banana pictures only as an automatic backup, through Runway — whose own terms still let Runway train on what passes through it. A request made with “Only providers that don’t train on my content” is never moved to Runway. | |
| ByteDance | Seedance 2.5, Seedance 2.0 (480p, 720p), Seedance 2.0 (1080p), Seedance 2.0 Fast, Seedance 2.0 Mini, Seedream 5 Pro | Runway: Seedance 2.5, Seedance 2.0 (1080p), Seedream 5 Pro; Fal: Seedance 2.0 (480p, 720p), Seedance 2.0 Fast, Seedance 2.0 Mini | Video and image jobs | Singapore (BytePlus Pte. Ltd., part of ByteDance, China) | Not stated. ByteDance’s BytePlus terms for these models are only readable when signed in, so we can’t confirm them; through Runway, Runway says it negotiates no-training terms with every model maker it runs (Runway’s own entry still applies). |
| Kuaishou | Kling 3.0, Kling O3, Kling O1 | Fal | Video jobs | Singapore (Kling AI Pte. Ltd., part of Kuaishou, China) | May train on content. Kling AI’s Terms of Service (21 April 2026) let it use content to “create, test, improve, train” its models; we reach Kling through fal’s partnership, whose terms with Kling aren’t public. |
| MiniMax | MiniMax H3, MiniMax H3 Max, MiniMax Music | Fal | Video and music jobs | Singapore (Nanonoble Pte. Ltd., which runs MiniMax’s international services; MiniMax is based in China) | Not stated. MiniMax’s API platform terms only load in a browser script and we couldn’t read them; we reach MiniMax through fal’s partner API. |
| Alibaba | Wan 3 | Fal | Video jobs | China (Alibaba Cloud); the region used for our jobs isn’t stated | No training by default. Alibaba Cloud Model Studio (page updated 28 September 2026): it “will never use your data for model training”; we reach Wan 3 through fal’s partner API. |
| Black Forest Labs | FLUX.1 Kontext [pro], FLUX 3 | Fal | Photos to edit and editing prompts, and the pictures and prompts of video clips | Germany (BFL GmbH, Freiburg) | May train on content. Black Forest Labs’ FLUX API Service Terms (4 August 2026, read again on 14 October 2026): “the Company may use Inputs and Outputs to train and improve its artificial intelligence models”; we reach FLUX.1 Kontext [pro] and FLUX 3 through fal’s partner API. |
| ElevenLabs | Eleven v3, Eleven v4, Sound Effects v2, Eleven Multilingual v2 (voice changer), Dubbing, Voice Isolator, Eleven v4 Turbo, Eleven Turbo v2.5, Scribe v2 | Fal: Eleven v3, Eleven v4, Sound Effects v2, Eleven v4 Turbo, Eleven Turbo v2.5, Scribe v2; Runway: Eleven v4, Eleven Multilingual v2 (voice changer), Dubbing, Voice Isolator | Text, voice recordings and audio | United States (Eleven Labs Inc.) | May train on content. ElevenLabs’ Terms of Service (31 March 2026) let it use customer content “to improve the Services” unless the account holder opts out; the account holders for our requests are fal and Runway, not us, so the opt-out isn’t ours to set. |
| Sync Labs (sync.) | sync. lip-sync | Fal | Video and audio of the speaker | United States | May train on content. Sync Labs’ Terms of Service (revised 6 June 2024) give it a licence to use uploaded content “to develop and improve the Service”; we reach it through fal’s partner API. |
| VEED | VEED Lipsync | Fal | Video of the speaker and the translated audio | United Kingdom (Veed Limited, London) | No training by default. VEED’s API FAQ (read 7 October 2026): “We don’t use your API inputs or outputs to train our models unless you agree to it” (it keeps each request’s log for 7 days); its Terms of Use (22 April 2024) only let it train on content from free VEED accounts. Veed Limited is in London, United Kingdom; fal marks VEED Lipsync as a partner API, so we reach it through fal. |
| Creatify | Creatify Lipsync | Fal | Video of the speaker and the translated audio, only if Fal passes them on (Fal runs this model on its own servers) | United States (Creatify Lab Inc., California) | May train on content. Creatify’s Terms of Service (effective 23 September 2024) give it a perpetual licence to use what is sent and made “to provide, maintain, promote, and improve the Services”. fal’s own model page marks Creatify Lipsync as run by fal itself, not as a partner API, so your video and audio should stay with fal — which doesn’t train on them — and not reach Creatify; we list Creatify’s terms because they govern the model. Creatify Lab Inc. is in California, United States. |
| CassetteAI | Music Generator and Sound Effects | Fal | Music and sound prompts | United States (Pixl Technologies, Inc.) | Not stated. CassetteAI’s terms (13 February 2023) don’t say whether prompts are used for training; we reach it through fal’s partner API. |
| Ideogram | Ideogram 3.0 | Fal | Image prompts | Canada (Toronto) | No training by default. Ideogram’s Developer API Agreement: it “shall not use any User Input or User Output to train the Ideogram AI Model”, except content flagged as breaking its usage policies; we reach it through fal’s partner API. |
| Recraft | Recraft V3 | Fal | Image prompts | United States (Recraft Inc.) | No training by default. Recraft’s Developer Terms (11 August 2026): “Recraft will not use any Assets created using the API Services to train Recraft AI models”; we reach it through fal’s partner API. |
| Tripo AI (VAST) | Tripo H3.1 | Fal | Product photos | Not confirmed (its site couldn’t be checked) | Not stated. Tripo’s site blocks automated reading, so we couldn’t open its terms; search listings of its help pages say paid users’ content isn’t used for training, but we haven’t confirmed that ourselves. We reach Tripo through fal’s partner API. |
| Hyper3D (Deemos) | Rodin Gen-2.5 | Fal | Product photos | United States (Deemos Corporation) | May train on content. Deemos’ terms say it may use prompts and outputs “to provide, maintain and improve our services, and conduct and support research”; we reach Rodin through fal’s partner API. |
| Bria AI | RMBG 2.0 | Fal | Photos for background removal | Israel (Tel Aviv) | No training by default. Bria’s background-removal terms (September 2026) let it use content only “for the performance and enhancement of the Products for Customer’s use only” and say it “shall not be used to train generative models” without written consent; Bria is based in Tel Aviv, Israel, its terms incorporate its data processing addendum, and fal marks this model Enterprise Ready, so fal’s own addendum covers it. |
| xAI | xAI Text to Speech | Fal | Text to be spoken | United States | No training by default. xAI’s API security FAQ: it “never trains on your API inputs or outputs without your explicit permission”; we reach it through fal’s partner API. |
Open models that Fal runs on its own systems don’t send content to their original authors. Every Fal model we use is one Fal places under its DPA (“Enterprise Ready”). Our payment partners process payment details as independent controllers and receive no Customer Content.