fal.ai procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ For individuals in the European Union: https://edpb.europa.eu/about-edpb/board/members_en ” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ If you have a concern about our processing of personal data, we encourage you to contact us in the first instance. However, if we are not able to resolve it, you have the right to lodge a complaint with the Data Protection Authority where you reside. Contact details for your Data Protection Authority can be found using the links below:” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “fal is based in the United States and we and our service providers process and store personal information on servers located in the United States and other countries. Whenever we make restricted international transfers of personal information, we take steps to ensure that your personal information receives an adequate level of protection (by putting in place appropriate safeguards, such as contractual clauses) or ensure that we can rely on an appropriate derogation under data protection laws. Where relevant, you may request access to any safeguard which we use to transfer your personal information outside of the European Economic Area, the United Kingdom, or Switzerland (although we may need to redact data transfer agreements for reasons of commercial confidentiality).” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ fal's primary business offering is an AI-powered generative media platform for developers to integrate into their applications, though we also offer a version of our platform directly to individuals through our Services. If you are an enterprise user of the Services, and your use is governed by an enterprise contract, we handle your personal information as a service provider (sometimes called a "processor") on behalf of the enterprise customer. Personal information processed on behalf of our enterprise customers is therefore not subject to this Privacy Policy. If you are an enterprise user of our Services, please contact the enterprise customer who has provided you with access to our Services.” | Captured 2026-06-07Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ For individuals in the UK: https://ico.org.uk/global/contact-us/ ” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ You have the right to (1) access your personal data, including in a portable format, (2) request erasure of your personal data, and (3) request correction of inaccurate personal data. In addition, you may have the right to object to certain processing or request we restrict certain processing. To exercise any of these rights, please email us at support@fal.ai .” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ For individuals in Switzerland: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html ” | Captured 2026-07-20Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | unknown | “ fal is based in the United States and we and our service providers process and store personal information on servers located in the United States and other countries. When personal information is processed and stored outside the jurisdiction where you reside, it may be subject to laws that have different standards of protection and may allow for foreign law enforcement and governmental access. Whenever we make restricted international transfers of personal information, we take steps to ensure that your personal information receives an adequate level of protection (by putting in place appropriate safeguards, such as contractual clauses) or ensure that we can rely on an appropriate derogation under data protection laws. Where required by law, we will provide more details about the safeguard(s) that we use to transfer your personal information to other jurisdictions.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “We retain personal data for as long as necessary to carry out the purposes for which we originally collected it and for other business purposes explained in this Privacy Policy.” | Captured 2026-06-07Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We store personal information associated with your account for as long as your account remains active. If you close your account, we will delete personal information related to your account within 30 days; otherwise, we will delete this information after two years of account inactivity. We store other personal information for as long as necessary to carry out the purposes for which we originally collected it and for other business purposes explained in this Privacy Policy.” | Captured 2026-07-20Open source →Finding permalink → |
| Data retention | All applicable tiers | unknown | “ We retain personal information as described above in the Data Retention section above.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Vendors and Service Providers . We make personal information available to our vendors, service providers, contractors, and consultants who perform services on our behalf, such as companies that assist us with web hosting, GPU hosting, infrastructure, internal and external communication, payment processing, fraud prevention and security, customer service, analytics, service monitoring, and marketing.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ With Your Consent and at Your Direction . We make personal information available to third parties when we have your consent or you intentionally direct us to do so.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Professional Advisors . We disclose personal information to our legal, financial, insurance, and other professional advisors where necessary to obtain advice or otherwise protect and manage our business interests.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We also collect personal data that you provide in the input to our Services, including your prompts and other content you choose to upload, such as files, images, audio and video, and other data.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ With Your Consent or at Your Direction . We make personal information available to third parties when we have your consent or you intentionally direct us to do so.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ Other Users of the Services . If you are a member of a Team Account, other members of the Team Account may view billing information, API keys, and AI model requests (including any input and output data) associated with the Team Account.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We disclose information about you as described in the Targeted Advertising and Analytics section above and in the following scenarios:” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We also disclose aggregated or de-identified information that cannot reasonably be used to identify you. We maintain and use this information only in a de-identified fashion and will not attempt to re-identify such information, except as permitted by law.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Corporate Transactions . We disclose personal information in connection with, or during negotiations of, certain corporate transactions, including a merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “Law Enforcement Authorities and Individuals Involved in Legal Proceedings . We disclose personal information in response to a request for information if we believe that disclosure is in accordance with, or required by, any applicable law, regulation, or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements.” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ We obtain information from other sources. For example, we collect information from our payment processor. This information includes your name, last 4 digits of your credit card or account number, credit card provider or bank name, billing address, and IP address.” | Captured 2026-07-20Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We disclose personal information as described in the Targeted Advertising and Analytics section above and in the following scenarios:” | Captured 2026-06-07Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ To Protect the Rights of fal and Others . We may disclose personal information if we believe that your actions are inconsistent with our user agreements or policies, if we believe that you have violated the law, or if we believe it is necessary to protect the rights, property, and safety of fal, our users, the public, or others.” | Captured 2026-06-07Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.