Privacy policy

Who this covers

This policy covers personal data about people who visit this site, sign up for Flatstack, or are members of a Flatstack account. Affiliate Intelligence Ltd (Affiliate Intelligence Ltd, a company registered in England and Wales under number 14577286, whose registered office is at 86-90 Paul Street, London, EC2A 4NE, United Kingdom) is the controller of that data. Contact us at privacy@flatstack.dev.

It doesn't cover the data of your apps' end users. For that data, you're the controller and we process it on your behalf under the data processing agreement. End users should contact the app that holds their data.

What we collect

• Account details: your name, email address, password (stored hashed), two-factor settings, passkeys, and Google or GitHub sign-in identifiers if you use them.
• Billing details: your billing name, address and VAT number, held by Stripe. We never see or store your full card number.
• Security records: IP address, browser user agent and times for your sign-in sessions, and the audit log of changes made in your account.
• Service records: your projects, configuration, usage figures, and the email log of messages your projects send (recipient, subject and delivery status, not the message body).
• Your messages: what you send us by email or through support.
• This site doesn't use analytics, advertising or tracking of any kind.

Why we use it

• To provide Flatstack under our contract with you: creating your account, running your projects, billing and support.
• To keep Flatstack secure and prevent abuse, which is our legitimate interest: sign-in protection, audit logs and spotting misuse.
• To meet legal obligations, such as keeping tax and accounting records.
• To email you about your account: service, billing and security messages, and notice of changes to our terms. We don't send marketing email without your consent.
• We don't sell personal data, and we don't make decisions about you based solely on automated processing.

Who we share it with

Only our subprocessors, listed on the subprocessors page, to run Flatstack; professional advisers when we need advice; and authorities when the law requires it.

Where it's stored

Account data is stored with Neon and Cloudflare, including in the United States, and billing data with Stripe. Where personal data leaves the UK, we protect it with the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or rely on an adequacy decision such as the UK–US data bridge.

Your projects' data is stored in the region you choose for each project.

How long we keep it

• Account data: while your account is open, then for the 30-day export period after cancellation, then deleted.
• A sign-in whose payment never completes: deleted after 7 days.
• Audit log entries: 365 days.
• Email log entries: 30 days.
• Invoices and accounting records: six years, as UK tax law requires.

Cookies

This site sets no cookies. It remembers your light or dark theme choice in your browser's local storage, which never leaves your device. The dashboard uses only essential cookies, to keep you signed in and secure, so it doesn't ask for consent.

Your rights

You can ask us for a copy of your personal data, and ask us to correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Email privacy@flatstack.dev and we'll reply within one month. Much of it you can change or export yourself in the dashboard.

If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk.

Changes

We'll update this page when how we handle personal data changes, and email account owners about significant changes.