Privacy Policy

Because Flextuma is a business messaging platform, we handle data in two distinct roles:

• Account data (we are the controller): information about you as a Flextuma customer — your name, username, email, organisation, role, and authentication data.
• Customer content (we are the processor): the contacts, phone numbers, message templates, and message content that you or your organisation upload or send through the Service, on your behalf and under your instructions.

For customer content, we act only as a data processor. Requests from recipients about their own phone number or message data should go to the Flextuma customer who added them, not to us directly — see our Data Deletion Policy.

• Account information: name, username, email address, password (stored hashed, never in plain text), organisation, and assigned privileges.
• Contact and messaging data: recipient phone numbers, contact names, tags and lists, message templates, message content, campaign configuration, delivery status, and timestamps.
• Billing data: wallet balance, currency, and transaction history associated with your organisation's account.
• Usage and security data: login attempts, session activity, IP address, and device/browser information, used to secure accounts and detect abuse.
• Cookies: we use a single essential, first-party session cookie to keep you signed in. We do not use advertising or third-party tracking cookies.

• To operate the Service: authenticate accounts, deliver messages through connected SMS providers, and track delivery status.
• To bill for usage against your organisation’s wallet balance.
• To secure the platform: detect fraud, abuse, and unauthorized access, and enforce rate limits.
• To communicate with you about your account, service changes, or support requests.
• To comply with legal obligations.

To deliver messages, we share message content and recipient phone numbers with the SMS network providers ("connectors") your organisation has configured. We do not sell personal data. We may disclose information where required by law or to protect the rights, property, or safety of FlexCode Labs, our customers, or others.

We retain account and messaging data for as long as your organisation's account is active, and for a limited period afterward as required for billing, legal, or fraud prevention purposes ([retention period to be confirmed]). You can request deletion at any time — see our Data Deletion Policy.

Depending on your location, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us at hi@flexcodelabs.com.

We use industry-standard safeguards, including encrypted connections (HTTPS), hashed passwords, and access controls limiting who within FlexCode Labs can view account and message data. No system is completely secure, and we cannot guarantee absolute security.

The Service is intended for business use and is not directed at children. We do not knowingly collect personal data from children.

We may update this Privacy Policy from time to time. We will update the effective date above when we do, and, for material changes, provide additional notice.

Questions about this Privacy Policy can be sent to hi@flexcodelabs.com.