No training
Prompts, uploaded inputs and generated outputs are never used to train or fine-tune any model. That holds for every account, through the API, dashboard, CLI and MCP server.
Nothing to opt out of.
We don't train on your data.
Windpaint doesn't use your prompts, inputs or outputs to train any model. Here is who can see your data, how long it's kept, where it's stored, and what moderation blocks.
- Training on your data
- Never
- Default retention
- 7 days
- Storage region
us-east-1- Blocked content
- Not charged
Your data runs your jobs.
We use your data to run the jobs you submit, store the results in your project, bill you, and support you when you ask.
Open-source models
The live models, z-image-turbo and flux-2-klein-4b, are Apache-2.0 models that Windpaint runs on its own GPUs.
No third-party model API.
Who can see it.
Everything you upload or generate belongs to a project in your organization. People outside it can't list or read your assets through the API.
| Who | What they can access |
|---|---|
| Your organization | Members read projects, jobs and assets according to their role. All four roles (owner, admin, member, read_only) can read. API keys act with their creator's role or a narrower one. |
| Anyone with a signed link | An asset's download URL redirects to a signed link that works without a key for 15 minutes. Whoever you hand it to can download that one file until it expires. |
| Windpaint staff | Account, billing and job records, including prompts and outputs, only to give support you asked for, resolve billing issues, or investigate abuse or a breach of our terms. |
Kept as long as you choose.
Uploads and outputs are kept for your organization's retention period: 7 days by default, or anything from 1 to 365 days, or forever.
Per request
Send
retention_dayson a submit, a workflow run or an upload to keep those files for less time than the organization setting. It can only shorten retention.At expiry
The file is deleted from storage within minutes. Downloads then return
410 generation.asset_gone. If a running job still uses the asset as an input, deletion waits until that job ends.On delete
Deleting an asset removes its file immediately and it can't be recovered. You can also delete everything a job produced, and its inputs, in one call.
What stays
The record of the asset and the job that made it, including the prompt, stays in your project after the file is gone.
URL inputs
When you pass an
https://URL as an input, Windpaint downloads the file and stores it as an asset in your project, under the same retention.
# Keep assets for 30 days (null keeps them forever)curl -X PATCH https://api.windpaint.ai/v1/account/storage \ -H "Authorization: Bearer $WINDPAINT_API_KEY" \ -H "Content-Type: application/json" \ -d '{"asset_retention_days": 30}'# Delete everything a job produced, and its inputscurl -X DELETE "https://api.windpaint.ai/v1/generation/requests/$REQUEST_ID/assets?inputs=true" \ -H "Authorization: Bearer $WINDPAINT_API_KEY"Storage within each asset's first 7 days is free. Longer retention is billed per GiB, see storage pricing.
Checked in, checked out.
Windpaint checks prompts before a job is created and checks image outputs after the model runs. Blocked content is refused and never charged.
Input, at submit
The prompt is checked before any credits are held. Input images can be checked too, depending on how input checks are configured for your account; only the first 8 are checked. A blocked request returns
422 moderation.input_blockedand no job is created.Output, after the model runs
Image outputs are checked. A blocked job ends with status
nsfw, no output is kept, and the hold is released in full. Video and audio rely on the model's own safety checks, which report asprovider_flagged.Enforcement
Each block is recorded against your organization with the categories that matched. Repeated blocks in a hard category flag the organization for review by Windpaint staff. Nothing is suspended automatically.
| moderation | Behavior |
|---|---|
auto | The default. Blocks content that is likely to fall into any category. |
low | Blocks only content that very clearly falls into a category. Hard categories are blocked as under auto. |
curl -X POST https://api.windpaint.ai/v1/generation/capabilities/image.generate \ -H "Authorization: Bearer $WINDPAINT_API_KEY" \ -H "Content-Type: application/json" \ -d '{"prompt": "a medieval battle scene, painted", "moderation": "low"}'{ "error": { "code": "moderation.input_blocked", "message": "The request was blocked by content moderation.", "details": { "stage": "input", "categories": ["sexual"], "moderation": "auto" }, "request_id": "86926749.37e5a9" }}| Category | Covers | Level |
|---|---|---|
sexual/minors | Sexual content involving minors. | Hard, always blocked |
sexual/nonconsensual | Non-consensual intimate imagery of real people. | Hard, always blocked |
sexual | Sexual or explicit content. | auto or low |
violence | Violence. | auto or low |
violence/graphic | Graphic violence and gore. | auto or low |
hate | Hate based on protected attributes. | auto or low |
harassment | Harassment or threats. | auto or low |
self-harm | Self-harm. | auto or low |
illicit | Instructions or depictions of illegal activity. | auto or low |
public_figure | Content depicting real public figures. | auto or low |
provider_flagged | The model refused the request without giving a reason. | auto or low |
Where your data lives.
Storage, records and the API run in AWS us-east-1. Models run on our own GPUs.
| Data | Where |
|---|---|
| Uploaded files and generated outputs | Amazon S3, a private bucket in AWS us-east-1 (N. Virginia). Files are only served through signed links. |
| Account, project, job and billing records, including prompts | PostgreSQL in AWS us-east-1. Backups are stored in Amazon S3. |
| API and dashboard | AWS us-east-1. |
| Model inference | Our own GPUs. Prompts and inputs go there to run a job, and outputs come back to storage in us-east-1. |
| Provider | What it does | Data it handles |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage | Everything described on this page |
| Stripe | Payment processing for credit top-ups | Billing contact and payment details. Windpaint never sees your full card number. |
| Resend | Transactional email (verification, invitations, low-balance alerts) | Email addresses and the content of those emails |
Rate and concurrency limits.
Limits are set per organization by tier, and the tier goes up with lifetime credit purchases. Free signup credits don't count.
| Tier | Lifetime purchases | Concurrent jobs | Submits per minute |
|---|---|---|---|
| 1 | None (free credits only) | 5 | 60 |
| 2 | $50 or more | 10 | 120 |
| 3 | $500 or more | 25 | 300 |
| 4 | $2,000 or more | 50 | 600 |
What counts
Concurrent jobs are those
queuedorin_progress. Submits are generation and workflow-run submits. Every authenticated request counts toward the per-key limit.Headers
Responses carry
X-RateLimit-Limit,X-RateLimit-RemainingandX-RateLimit-Reset, plusRetry-Afteron a429. Minute windows reset at the start of each clock minute.Refusals are free
Nothing is created or charged on a
429. WaitRetry-Afterseconds, and send anIdempotency-Keyso a retry never creates a second job.Your current tier
GET /v1/billing/limitsreturns your tier, limits, usage this minute and what the next tier needs. Top-ups are on the pricing page.
{ "error": { "code": "rate_limit.concurrency", "message": "Too many jobs in flight for the organization's tier. Retry once some finish.", "details": { "limit": 5, "current": 5, "retry_after": 5 }, "request_id": "59630881.7c2e4a" }}The website, too.
This page covers the API and dashboard. The early-access website has its own short notice.
The privacy notice explains what we collect when you request early access and how to ask us to delete your account. For anything about how your data is handled, contact support, or read data use and privacy in the docs.
Questions.
Can I opt out of training?
There is nothing to opt out of. Windpaint does not use prompts, uploaded inputs or generated outputs to train or fine-tune any model, on any account, through the API, dashboard, CLI or MCP server.
Are my prompts sent to a third-party model API?
Not for the live models. z-image-turbo and flux-2-klein-4b are open-source models that Windpaint runs on its own GPUs. If a model ever runs on another provider's API, the Models page in the docs will say so.
Am I charged when something is blocked?
No. A prompt blocked at submit is refused before any credits are held, and a job whose output is blocked ends as nsfw with its hold released in full.
Are video outputs moderated?
Windpaint checks image outputs. Video and audio outputs rely on the model's own safety checks, which report as provider_flagged. If a classifier errors or times out, the request isn't blocked by that check.
Can I delete my data straight away?
Yes. Deleting an asset removes its file immediately, and you can delete everything a job produced, with its inputs, in one call. The record of the job, including the prompt, stays in your project.
What happens when I hit a rate limit?
The request returns 429 with a Retry-After header, and nothing is created or charged. For concurrency limits, wait for one of your running jobs to finish. Send an Idempotency-Key when retrying submits.
Will Windpaint suspend my account for a blocked prompt?
Nothing is suspended automatically. Blocks are recorded against your organization, and repeated blocks in a hard category flag it for review by Windpaint staff, who may contact you or restrict the account.