Privacy Policy
Last updated 15 September 2026
1. Who controls your data
Fraesh Labs Ltd., 732 S 6th St, Ste R, Las Vegas, NV 89101, USA, is the data controller for information collected through ezfly. Contact: support@ezflyapp.com.
2. What we collect
You give us:
- Your name, email address and chosen username when you create an account
- Your phone number, if you choose to add one — it's optional
- Your password, stored only as a salted hash. We never see it in plain text.
- Whether you opted in to product emails
- Images you upload, and the text you type into your designs — lineups, venues, dates
- The prompts and vibe selections you use to generate backdrops
We generate:
- Your generation count for the current billing month, so we can enforce your plan's allowance
- Your saved designs and drafts
- Your subscription status and plan
We do not collect your card number. Stripe handles payment details; we only receive the card brand, last four digits and expiry date so we can show you which card is on file.
ezfly sets no cookies at all — not one, first-party or third. The only browser storage we use is what keeps you signed in and what remembers your interface preferences, both of which are strictly necessary for a service you asked for. There are no advertising or analytics trackers, and nothing on the site contacts a third party: our fonts and code libraries are served from our own servers rather than from Google, a CDN or anyone else, so no outside company sees your IP address when you visit. That is why you see no cookie banner — there is nothing here to consent to.
3. Why we use it, and our legal basis
- To run your account and provide the service — performance of our contract with you
- To take payment and prevent fraud — performance of a contract, and our legitimate interest in not being defrauded
- To enforce plan limits — performance of a contract
- To send service emails (confirmation, password resets, billing notices) — performance of a contract
- To send product updates — only if you opted in, and you can withdraw at any time
- To keep the service secure and debug faults — our legitimate interest in a working, safe product
4. We do not sell or share your information
We have never sold personal information, and we do not share it for advertising. That is a commitment, not a current preference — if it ever changed we would have to tell you here first, and give you a way to opt out before it took effect.
To be precise about two words that have specific legal meanings: we do not "sell" personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act. We run no advertising pixels, no ad networks and no data brokers. There is nothing to opt out of.
5. The companies that process data for us
Running ezfly means some data passes through infrastructure we don't own. These providers are our processors: they are contractually bound to act only on our instructions, to use your data solely to deliver the service listed below, and never for their own purposes.
- Supabase — authentication, database and file storage
- Stripe — payment processing and subscription billing
- fal.ai — running the image models. Your prompt and any image you're editing are sent to them to produce a result.
- Resend — sending account and service emails
- Hetzner — server hosting
One honest qualification. For most purposes Stripe processes payment data on our instructions, but for fraud prevention, anti-money-laundering and its own legal obligations Stripe acts as an independent controller in its own right. We can't direct what it does in that capacity, and we don't speak for it. Stripe's own privacy policy governs that processing and is at stripe.com/privacy.
Beyond that, our commitment above covers what we do with your data and what we permit our processors to do with it. It cannot extend to a provider's own separate practices where they act as a controller, or to anything you choose to send them directly. Each company above publishes its own privacy policy, and we'd encourage you to read the ones you care about.
We may also disclose data where the law requires it — a court order, a lawful request from an authority — or where we reasonably need to in order to protect our rights or someone's safety.
6. Where your data goes
Some of these providers operate outside your country, including in the United States. Where personal data leaves the UK or EEA, transfers rely on Standard Contractual Clauses or an equivalent safeguard. Our application server is operated by Hetzner in Helsinki, Finland, inside the EEA. Our database and authentication are hosted by Supabase in US West (Oregon), us-west-2, and backups are stored in Cloudflare R2.
7. How long we keep it
- Account details — until you delete your account
- Your designs and uploads — until you delete them, or 30 days after you close your account
- Usage counts — 24 months
- Billing records — as long as tax law requires, typically 6–7 years. These survive account deletion because we're legally obliged to keep them.
8. Your rights
Depending on where you live, you can ask us to:
- Give you a copy of the data we hold about you
- Correct anything that's wrong
- Delete your account and data
- Restrict or object to how we use it
- Export it in a portable format
- Withdraw consent for product emails — the unsubscribe link in any of them, or your account page
Two of these you can do yourself, right now, without asking us. Your account page has Export my data, which downloads everything we hold as a JSON file, and Delete account, which cancels your subscription and erases your data permanently.
For anything else, email support@ezflyapp.com and we'll respond within 30 days. If you're in the UK or EU and you think we've got it wrong, you can complain to your data protection authority — in the UK that's the ICO at ico.org.uk.
9. Security
Traffic is encrypted in transit. Passwords are hashed, never stored in readable form. Access to the production database is restricted, and row-level security means one account cannot read another's data. No system is perfectly secure, but if a breach affects your personal data we'll tell you and the relevant regulator as the law requires.
10. Children
ezfly isn't for under-16s. We don't knowingly collect their data. If you believe a child has given us personal information, email us and we'll delete it.
11. Changes
If we change this policy materially we'll email you before it takes effect. The date at the top always shows the current version.