Privacy Policy

Account Information

When you create a Flexbuild account, we collect your name, email address, and authentication credentials. If you sign up via Google or GitHub OAuth, we receive your public profile information from those providers.

Payment Information

When you subscribe to a paid plan, payment is processed securely by Stripe. We do not store your credit card number, CVV, or bank details. We retain only a Stripe customer ID and transaction records (amount, date, plan) for billing and support purposes.

Usage Data

We automatically collect information about how you interact with the platform, including: pages visited, features used, AI prompts sent (credit consumption), project metadata, browser type, operating system, IP address, and timestamps.

Project Content

When you create projects, Flexbuild stores the generated code, files, and chat history associated with each project. This content is necessary to provide the service and enable you to revisit and continue working on projects.

Cookies & Local Storage

We use essential cookies for authentication and session management. We also use local storage to persist user preferences such as theme selection. We do not use third-party advertising cookies.

Provide, maintain, and improve the Flexbuild platform and its features.

Process payments, manage subscriptions, and enforce credit limits.

Send transactional emails: account verification, password resets, billing receipts, and critical service notifications.

Analyze aggregate usage patterns to improve performance, fix bugs, and prioritize new features.

Detect, prevent, and address fraud, abuse, and security incidents.

Comply with legal obligations and respond to lawful requests from authorities.

Service Providers

We share data with trusted third-party providers that help us operate the platform: Stripe (payments), Supabase (database and authentication), Cloudflare (hosting and CDN), and AI model providers (Google, Anthropic, OpenAI) that process your prompts to generate code. These providers are contractually bound to protect your data.

Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request.

Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

No Selling of Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes. Period.

Account data is retained for as long as your account is active. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law (e.g., billing records).

Project content is retained for as long as your account exists. Deleting a project permanently removes its files and chat history.

Server logs and usage analytics are retained for up to 12 months, after which they are aggregated and anonymized.

All data in transit is encrypted using TLS 1.2+. Data at rest is encrypted using AES-256 via our infrastructure providers.

Authentication tokens are securely hashed. Passwords are hashed using bcrypt with per-user salts.

We conduct regular security reviews and follow industry best practices. Access to production data is restricted to authorized personnel on a need-to-know basis.

While we take extensive measures to protect your data, no method of electronic transmission or storage is 100% secure. We encourage you to use strong, unique passwords and enable two-factor authentication when available.

Access & Portability

You can access and export your project files at any time through the platform. You may request a copy of your personal data by contacting us.

Correction

You can update your account information (name, email, avatar) from your Account Settings page at any time.

Deletion

You may request deletion of your account and all associated data by contacting us at privacy@flexbuild.ai. We will process your request within 30 days.

Objection & Restriction

You may object to or request restriction of certain data processing activities by contacting us. We will comply unless we have a compelling legitimate basis to continue processing.

GDPR & CCPA

If you are located in the European Economic Area (EEA) or California, you have additional rights under GDPR or CCPA respectively, including the right to data portability, the right to be forgotten, and the right to opt out of data sales (though we do not sell data).

Flexbuild is not intended for use by children under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect personal information from children. If we discover that a child has provided us with personal data, we will delete it promptly.

Flexbuild is operated from the United States. If you are accessing the platform from outside the United States, your data will be transferred to and processed in the United States and other countries where our service providers operate. We ensure appropriate safeguards are in place for international data transfers in compliance with applicable data protection laws.

The platform may contain links to third-party websites or services (e.g., GitHub, documentation sites). We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies independently.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or by posting a prominent notice on the platform. Your continued use of Flexbuild after such changes constitutes acceptance of the updated policy.