Incident #724B4D · 09 JUL 2026notable
fal adds US state privacy rights, retention periods, and explicit collection of prompts and uploads
The policy now says outright that prompts and uploaded files (images, audio, video) are collected. It sets retention: account data is deleted within 30 days of closure, or after two years of inactivity. A new US state section covers California, Nebraska and Texas. It acknowledges that ad-related disclosures may count as 'sales' or 'sharing', and offers opt-out through the footer link or Global Privacy Control. The Europe section is reorganised under 'Additional Information for Specific Jurisdictions', and its international transfers wording changed.
Taken from you
- Policy now expressly says prompts and uploaded files are collected as personal data
- Ad tracking activities are acknowledged as possible 'sales' or 'sharing' of personal data under state laws
Won back
- Defined retention: deletion within 30 days of account closure, or after two years of inactivity
- Opt-out of targeted ads via the Your Privacy Choices link and Global Privacy Control signals
- US state residents get an appeal process and may use authorized agents. The access, correction and deletion rights already existed for Europe and in the account dashboard.
- Commitment not to sell or share data of consumers known to be under 18
- Commitment not to discriminate for exercising privacy rights
Evidence · 4 of 4 quotes matched in source
We also collect personal data that you provide in the input to our Services, including your prompts and other content you choose to upload, such as files, images, audio and video, and other data.+ inserted · ✓ matched in source
If you close your account, we will delete personal information related to your account within 30 days; otherwise, we will delete this information after two years of account inactivity.+ inserted · ✓ matched in source
The activities described in this section may constitute “targeted advertising,” “sharing,” or “selling” under certain privacy laws.+ inserted · ✓ matched in source
You can also opt out by visiting our websites with a legally recognized universal opt-out signal enabled, such as the Global Privacy Control.+ inserted · ✓ matched in source
Archived version ↗ · 1,570 words changed