Privacy Policy
Last updated: October 31, 2026
This policy explains what personal data Flexkit, the operator of www.flexkit.io ("Flexkit", "we"), collects when you use flexkit.io, Flexkit Studio, the Flexkit APIs and our AI features, why, who processes it, and your rights. Questions and requests: privacy@flexkit.io.
1. Our two roles
- We are the controller of data about our customers and their users: accounts, teams, billing, usage, support and communication.
- We are a processor of the data customers put into their projects (records, files, chats, knowledge documents, data read through plugins). The customer decides what is in it and why; we process it only on their instructions, under our Terms of Service. If your data is in a Flexkit customer's project, contact that customer first.
2. What we collect
| Data | Examples | Source |
|---|---|---|
| Account | name, email, avatar, sign-in provider (email, Google, GitHub), team memberships and roles | you, your sign-in provider |
| Billing | billing name and address, tax ID, plan, invoices; card details stay with Stripe | you, Stripe |
| Usage | features used, projects active, AI credit use, API requests (with IP address, country, user agent), errors | the Service |
| Desktop app | app opens, version and operating system; you can turn this off in the app | the desktop app |
| Attribution | the first page, referrer and campaign (UTM) that brought you to us | a first-party cookie |
| Connections | which plugins you connected and to which external account; tokens are stored encrypted | you |
| Support | your messages, and a log of every support-access session in your projects | you, our staff |
| Notifications | browser push subscriptions you enable | your browser |
We do not use third-party advertising trackers.
3. Why we use it and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide the Service, your account and your projects | contract |
| Billing, taxes, accounting | contract; legal obligation |
| Security, abuse prevention, debugging errors | legitimate interests |
| Product analytics (which features are used, activation, retention) to improve Flexkit | legitimate interests |
| Support, including support access to your projects | contract; legitimate interests |
| Service emails (sign-in, approvals, billing, important changes) | contract |
| Product news | consent, or legitimate interests for existing customers; you can unsubscribe anytime |
We do not sell personal data and do not use Customer Data to train AI models.
4. AI features
When you use the agent, automations, search or transcription, the relevant prompts, project context and files are sent to an AI model provider through Vercel AI Gateway to produce the answer. Providers include OpenAI, Anthropic, Google, xAI, Mistral and Perplexity (web search), depending on the model you or Flexkit choose. Their terms forbid training on this data; they may keep it for a limited period, typically up to 30 days, for abuse monitoring. Embeddings for search are created with OpenAI.
5. Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Vercel | hosting, functions, file storage, background workflows, code sandboxes, AI Gateway | EU (Frankfurt); AI Gateway routes to US providers |
| Supabase | database, authentication | EU (Frankfurt) |
| Neo4j Aura | project data (graph database) | EU |
| Stripe | payments, invoices, tax | US and EU |
| Tinybird | usage and product analytics | EU (London) |
| Axiom | error and request logs | US |
| Inngest | scheduling background jobs | US |
| Upstash | rate limiting and caching | US |
| Resend | sending email | US |
| AI model providers (section 4) | generating AI output | mostly US |
Plugins you connect (Google, Microsoft, Slack, Notion, Shopify, and others) receive data because you direct us to send it; their own privacy policies apply. We may also disclose data if the law requires it, or to a successor in a merger or acquisition, under this policy.
6. International transfers
Your core project data is stored in the EU. Some providers process data in the US. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses, with additional safeguards where needed.
7. How long we keep data
| Data | Kept for |
|---|---|
| Account and project data | while your account is open; deleted within 30 days after you delete it, backups within 35 days |
| Billing records | as long as tax and accounting law requires (up to 10 years) |
| Usage analytics and API request logs | 24 months, then deleted or anonymized |
| Error logs | 30 days |
| Support-access logs | 2 years |
| Attribution cookie | 90 days |
8. Security
We encrypt data in transit and at rest, store plugin credentials and tokens encrypted, keep projects isolated by access controls, and limit staff access to what support needs. Support access is read-only by default, time-limited, logged and visible to the customer; staff sign in with company accounts and two-factor authentication.
9. Your rights
Depending on where you live (including the EU, UK and California), you can ask to access, correct, delete or export your personal data, object to or restrict its use, and withdraw consent. Write to privacy@flexkit.io; we answer within one month. You can also complain to your data protection authority (in Czechia: the Office for Personal Data Protection, ÚOOÚ).
10. Cookies
We use only first-party cookies: to keep you signed in, to remember preferences such as the theme, and one attribution cookie (90 days) that records how you first found us. We use no advertising or cross-site tracking cookies.
11. Children
The Service is not for children. You must be at least 16 to use it.
12. Changes
We will post changes here and update the date above. For a material change we will notify you by email or in the product before it takes effect.
13. Contact
Flexkit, www.flexkit.io. Email: privacy@flexkit.io.