Privacy Policy — How We Handle Your Data

This Privacy Policy explains how KwaFlux Limited (“KwaFlux,” “we,” “us,” or “our”) collects, uses, shares, and protects information when you use our website, desktop application, account features, billing tools, support channels, cloud processing features, and related services (collectively, the “Service”).

KwaFlux is designed as a local-first desktop AI media enhancement product. In local processing mode, your video, image, audio, and project files are processed on your device and are not uploaded to our servers for AI processing. If you choose to use optional cloud processing, remote rendering, AI cloud features, team collaboration, cloud backup, or other upload-based features, the files you select may be uploaded and processed as described in this Privacy Policy.

If you do not agree with this Privacy Policy, please do not use the Service.

The Service is operated by:

KwaFlux Limited Company / Business Registration No.: 80432817 Registered office address: UNIT 225-22, 2/F MEGA CUBE, 8 WANG KWONG RD, KLN BAY, HONG KONG Support: support@kwaflux.com Privacy: privacy@kwaflux.com Legal: legal@kwaflux.com

We collect only the information reasonably necessary to provide, secure, license, bill, support, and improve the Service.

We use information for the following purposes:

• To create and manage your account.
• To authenticate users and protect accounts.
• To process payments, invoices, taxes, subscriptions, cancellations, refunds, and plan changes.
• To activate licenses, verify entitlements, prevent unauthorized access, and enforce plan limits.
• To provide local and optional cloud processing features requested by you.
• To upload, queue, process, return, and delete cloud processing tasks and output results.
• To calculate credits, usage, billing, subscription entitlements, and processing limits.
• To provide customer support and troubleshoot technical issues.
• To improve product performance, compatibility, stability, and user experience.
• To detect, prevent, and investigate fraud, abuse, prohibited content, security incidents, chargebacks, and violations of our terms.
• To communicate important product, account, billing, legal, security, or service updates.
• To comply with applicable law, legal process, tax, accounting, and regulatory obligations.

We do not sell your personal information.

This section applies only if you choose to use cloud processing, remote rendering, AI cloud features, team collaboration, cloud backup, or other upload-based features.

Where applicable law requires a legal basis, we process personal information based on:

• Contract necessity, when processing is needed to provide the Service, manage your account, process billing, deliver cloud processing tasks requested by you, or provide support.
• Legitimate interests, such as securing the Service, preventing fraud, preventing abuse, improving product quality, enforcing our terms, maintaining service reliability, and maintaining business records.
• Consent, where we ask for your consent, such as optional marketing emails, optional telemetry choices, optional cloud features where required, biometric or sensitive processing where required, or any future use of your media files for AI model training.
• Legal obligations, where processing is required for tax, accounting, legal, compliance, regulatory, or law-enforcement reasons.

We may share information with limited categories of service providers and partners that help us operate the Service, including:

• Payment processors, such as Stripe, for billing, taxes, subscriptions, invoices, refunds, and payment fraud prevention.
• Authentication and database providers, such as Supabase, for account, entitlement, and license management.
• Hosting, security, and infrastructure providers, such as Cloudflare, for website delivery, security, traffic routing, and account interactions.
• Cloud storage and compute providers, for encrypted upload, temporary storage, AI processing, remote rendering, queue management, and output delivery when you choose cloud features.
• Analytics and diagnostics providers, where used, to help us understand product stability, errors, and usage patterns. Where possible, we use aggregated or pseudonymized data.
• Support tools, email providers, or customer communication systems, to respond to user requests.
• Professional advisers, such as lawyers, accountants, auditors, insurers, or tax advisers, where necessary.
• Authorities or third parties where legally required, including to comply with law, legal process, enforce our rights, protect users, or respond to lawful requests.
• Successors in business transactions, such as a merger, acquisition, financing, restructuring, or sale of assets, subject to appropriate safeguards.

We do not share your personal information with third parties for their independent advertising or sale purposes.

We do not authorize third-party service providers to use your uploaded media files, project files, prompts, or output results for their own AI model training.

Our website may use cookies, local storage, and similar technologies for:

• Essential website operation.
• Account login and session management.
• Security and fraud prevention.
• Billing portal and checkout functionality.
• Basic analytics and performance measurement.

We do not use third-party advertising cookies or cross-site advertising trackers in the current website version. If this changes, we will update this Privacy Policy and provide applicable choices.

You can control cookies through your browser settings. Some features may not work correctly if essential cookies are disabled.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Typical retention periods include:

• Account data: retained while your account is active.
• Billing, invoice, tax, and payment records: retained as required for tax, accounting, audit, chargeback, and legal compliance.
• Support communications: retained as needed to resolve requests, improve support, and maintain records.
• Security, entitlement, and fraud-prevention logs: retained for a limited period necessary to protect the Service and resolve disputes.
• Cloud source files, file chunks, temporary files, and output files: automatically deleted according to the retention period stated in the applicable feature page.
• Deleted account records: after account deletion, certain records may be retained for up to 12 months, or longer if necessary for legal, tax, fraud-prevention, dispute-resolution, or compliance purposes.

In local processing mode, we do not retain your media files because they are not uploaded to our servers for AI processing.

In cloud processing mode, uploaded files and output files are retained only as described in this Privacy Policy and the applicable feature page.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information and cloud processing data, including encryption in transit, encryption at rest where applicable, access controls, credential separation, restricted internal access, logging, security monitoring, and infrastructure protections.

For optional cloud processing, relevant media files may be split into encrypted chunks before upload, transmitted through encrypted channels, stored or queued in encrypted form, and temporarily decrypted only within a controlled AI compute environment to complete the processing task requested by you.

No electronic transmission, storage, or processing method is completely secure. We cannot guarantee absolute security.

We operate internationally, and your information may be processed in countries other than where you live. Where required, we use appropriate safeguards to protect transferred information, such as contractual protections and service provider commitments.

If you choose cloud processing, your selected files and task data may be processed by cloud infrastructure or compute providers located outside your country or region. We take reasonable steps to protect such transfers in accordance with applicable law.

The Service is not intended for children under 16. We do not knowingly collect personal information from children under 16.

You may not upload or process media involving children unless you have all rights, permissions, consents, and legal authority required by applicable law.

If you believe a child has provided us with personal information, contact privacy@kwaflux.com and we will take appropriate steps to delete it.

Depending on your location, you may have rights to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal information.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Receive a portable copy of your information.
• Opt out of certain marketing communications.
• Delete available cloud files where the product provides a delete option.

To exercise your rights, contact privacy@kwaflux.com. We may ask for information to verify your identity before responding. We aim to respond within 30 days or within the period required by applicable law.

Please note that deleting account data, billing records, security logs, or cloud task metadata may be subject to legal, tax, fraud-prevention, dispute-resolution, security, and technical limitations.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising in the current website version.

We collect the categories of information described in this Privacy Policy, including identifiers, account information, payment-related information, device and network data, usage data, support communications, approximate location inferred from IP address, and cloud processing data that you choose to upload or generate through optional cloud features.

We use and disclose these categories for the business purposes described above, including account management, billing, security, fraud prevention, customer support, service operation, cloud processing, analytics, compliance, and legal protection.

We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date and may provide additional notice through the website, app, email, or account dashboard.

If we introduce materially different cloud processing, remote rendering, AI cloud, team collaboration, backup, biometric, or AI model-training features, we will provide additional disclosures or request consent where required by applicable law.

Your continued use of the Service after the updated policy becomes effective means you acknowledge the updated policy.

For privacy questions or requests, contact:

privacy@kwaflux.com

For general support:

support@kwaflux.com

For legal inquiries:

legal@kwaflux.com