Privacy Policy

What we collect

• Account info — your email and password hash, set when you sign up.
• Site info — the URL and public content of websites you connect, so Flippy can answer questions about them.
• Visitor activity — anonymous visitor IDs, pages viewed, chat transcripts, and events your widget reports.
• Usage data — basic logs (timestamps, request paths, error messages) for debugging and abuse prevention.

How we use it

• Run Flippy on your site and show you the dashboard.
• Send AI requests to language model providers (e.g. via the Lovable AI Gateway) so Flippy can respond.
• Send you notifications you've asked for (email/WhatsApp).
• Improve the service and prevent abuse.

Who we share with

We share data only with the service providers we use to run Flippy:

• Our hosting and backend provider (Lovable Cloud / Supabase).
• Our AI gateway and underlying language model providers.
• Paddle.com — our Merchant of Record for the sale of paid plans. Paddle handles subscription management, payments, tax compliance, invoicing and refunds. See Paddle's privacy notice.
• Email/notification providers used to send messages you've opted into.
• Professional advisers and authorities where required by law.

We don't sell your data.

Legal basis for processing

We process personal information on the following legal bases (under GDPR, the UK GDPR, and South Africa's POPIA where applicable):

• Performance of a contract — to provide the service you've signed up for.
• Legitimate interests — to secure the service, prevent abuse, and improve the product.
• Consent — for optional communications (e.g. marketing emails) you opt into.
• Legal obligation — to comply with tax, accounting and other laws.

Data retention

We keep account and site data for as long as your account is active. If you close your account, we delete or anonymise personal data within 90 days, except where we're required to keep it longer for legal, tax or accounting reasons (typically up to 5 years for billing records held by us or by Paddle).

Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), encryption at rest for the database, role-based access controls, and row-level security on customer data. No system is perfectly secure, but we work to limit risk and respond quickly to any incident.

Your rights

You can request a copy of your data, ask us to correct it, or delete your account at any time. Contact us via the support form on this site.

Cookies & local storage

We use cookies and browser local storage to keep you signed in and to remember widget preferences. No third-party advertising cookies.

Children

The service isn't directed at children under 13. If you believe a child has given us information, contact us and we'll delete it.

Changes

We may update this policy. We'll note the new "Last updated" date above.