Last updated: March 2026
FlexFly provides AI and digital agent services for businesses, including web chat, email, and Telegram-based workflows.
This Privacy Policy explains what information we collect, how we use it, who processes it on our behalf, how long we retain it,
and the rights available to users and customers.
1. Information We Collect
Information you provide directly
- Messages you send through our web chat, email, or Telegram channels
- Contact details you choose to share, such as name, email address, phone number, company name, and time zone
- Scheduling details for meetings or appointments
- Business context you provide during qualification, support, or sales conversations
Information collected automatically
- Session identifiers and timestamps associated with chat sessions
- Technical metadata such as browser, device, IP-related network information, and connection events
- Website and WebSocket traffic processed through Cloudflare
Business records created during service delivery
- CRM records stored in Google Sheets
- Calendar events stored in Google Calendar
- Emails sent or received through Gmail
- Subscription and billing records processed by Stripe, if applicable
2. How We Use Information
- To operate and provide AI-driven communication and scheduling services
- To respond to inquiries and conduct sales qualification
- To book, reschedule, or cancel appointments
- To send confirmations, follow-ups, and service-related emails
- To maintain CRM records and track customer interactions
- To process subscriptions and billing where applicable
- To secure, monitor, troubleshoot, and improve our services
- To comply with legal obligations and enforce our agreements
3. How Our Service Processes Data
When a visitor uses the FlexFly web chat, message content is transmitted through Cloudflare and proxied to our application environment.
Conversation content may then be processed by third-party AI model providers hosted in the United States and European Union, including Google (Gemini) and OpenAI (via OpenRouter as an API aggregator).
If a conversation results in a lead, booking, or follow-up, the relevant information may be written to:
- Google Sheets for CRM records
- Google Calendar for scheduling
- Gmail for confirmations, follow-ups, and related communication
Cloudflare proxies all web traffic and WebSocket connections associated with our website and chat services.
4. Storage and Retention
Web chat session data
- Server-side chat logs are retained for up to 90 days from last activity, then automatically purged
- Client-side chat history may be stored in browser localStorage for approximately 24 hours
CRM data
- Stored in Google Sheets within the client's Google Workspace
- Retained for the duration of the client relationship plus 90 days post-termination
- Available for export upon request before deletion
Calendar data
- Stored in Google Calendar within the client's Google Workspace
- Retained for the duration of the client relationship plus 90 days post-termination
Email data
- Stored in Gmail within the client's Google Workspace
- Retained for the duration of the client relationship plus 90 days post-termination
Billing data
- Stored and retained by Stripe in accordance with Stripe's policies and legal obligations (up to 7 years for tax and regulatory compliance)
AI model processing
- Conversation content sent to AI model providers is processed transiently and is not persisted by those providers beyond the API request lifecycle
- We do not use customer data to train AI models
Backups and logs
- Infrastructure backups are retained for up to 14 days
- Operational logs are retained for up to 30 days
5. Third-Party Processors and Service Providers
We use third parties to operate the service. These may process personal information on our behalf or on behalf of our business customers.
- Google LLC — cloud infrastructure, AI model processing (Gemini), Gmail, Google Calendar, Google Sheets, and related services
- Cloudflare, Inc. — CDN, proxying, traffic routing, and WebSocket handling
- OpenRouter, Inc. — AI API aggregation and routing to model providers (including OpenAI)
- OpenAI, Inc. — AI model processing of conversation content (via OpenRouter)
- xAI Corp. — AI model processing of conversation content (via OpenRouter)
- Stripe, Inc. — billing and subscription processing
Third-party AI model providers may receive the content of conversations, including personal information users choose to submit. Their handling of data is governed by their own terms and privacy policies, unless separate contractual terms apply.
6. AI Processing Notice
Our services use third-party AI systems to process message content and generate responses or workflow actions. This means conversation content may be transmitted to and processed by external model providers. Please do not submit highly sensitive information unless it is necessary for the service requested.
While we aim to limit unnecessary data exposure, AI outputs may be inaccurate, incomplete, or context-dependent, and AI processing may involve automated decision support rather than human review.
7. Legal Bases for Processing
Where applicable, we process personal information based on one or more of the following:
- Performance of a contract or requested service
- Legitimate interests in operating, securing, and improving our services
- Compliance with legal obligations
- Consent, where required by law
8. Data Sharing
We may share personal information:
- With subprocessors and service providers described in this policy
- With our business customers when we act on their behalf as a service provider or processor
- To comply with law, legal process, or government requests
- To protect our rights, safety, property, users, or others
- As part of a merger, acquisition, restructuring, or sale of assets
We do not sell personal information for money. We do not use client data to train our own models.
9. Security
We use administrative, technical, and organizational measures intended to protect personal information. However, no method of transmission, storage, or processing is completely secure, and we cannot guarantee absolute security.
10. International Data Transfers
Personal information is primarily processed in the United States. Our AI model providers operate within the United States and European Union. By using the service, users acknowledge that data may be transferred to and processed in these jurisdictions.
11. Your Rights and Choices
Depending on applicable law, you may have the right to request:
- Access to personal information we hold
- Correction of inaccurate information
- Deletion of personal information
- Restriction of certain processing
- Objection to certain processing
- Data portability, where applicable
To exercise rights, contact privacy@flexfly.ai. We may need to verify identity before responding.
We aim to respond to verifiable requests within 30 days.
12. California Privacy Disclosures
If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA), as amended by the CPRA, including the right to know, access, delete, and correct certain personal information, and the right to limit certain uses of sensitive personal information where applicable.
In the past 12 months, we may have collected the following categories of personal information:
- Identifiers, such as name, email address, phone number, company, and account-related details
- Internet or network activity, such as website and chat interaction data
- Commercial information, such as subscription and service records
- Professional or employment-related information users choose to provide
- Inferences drawn from interactions for lead qualification or service delivery
We collect and use these categories for the business purposes described in this policy. We do not sell personal information for money and do not knowingly share personal information for cross-context behavioral advertising.
13. Children's Privacy
Our services are not directed to children under 13, and we do not knowingly collect personal information from children under 13.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Any updates will be posted on this page with a revised "Last updated" date.