Privacy Policy

1. Data controller

The controller for personal data processed through Flap Studio AI is Ángel Martínez García, trading as Flap Studio AI, with address at Carrer Pablo Picasso 3, 03660 Novelda (Alicante), Spain, and contact email info@flapstudioai.com.

2. Data we process

We process the data needed to provide the service and manage the relationship with each user:

• Account and identification data: email address, name, and basic profile data when available. For the waitlist, we process the email address and professional profile you provide to manage early access.
• Security data: temporary technical connection signals used to prevent abuse and protect public forms.
• Billing and subscription data: plan status, customer and subscription identifiers, billing history, and metadata needed to operate Stripe.
• Usage and support data: credit consumption, generated assets, feedback, and service or support communications.
• Generation records for support and incident review: prompts and a result thumbnail up to 384 pixels are retained for 30 days. Content becomes inaccessible at expiry and is deleted by the next cleanup cycle (every 15 minutes). Only the owner administrator can view it through the application. Operation, model, usage and receipt records are retained separately. This audit record does not retain input images or full-resolution results. Separately, Multiview keeps the full result for 24 hours for connection recovery; only the requesting account can retrieve it, and it is deleted in the next 15-minute cleanup cycle.
• User content: prompts, images, references, masks, and any other material submitted by the user for processing.

3. Purposes and legal basis

We process personal data for the following purposes and legal bases:

• Providing the service, authenticating access, and executing requested generations: performance of a contract or pre-contractual measures.
• Managing billing, taxes, invoices, fraud prevention, and post-sale operations: performance of a contract and compliance with legal obligations.
• Handling support, incidents, and data protection requests: legitimate interest and, where applicable, compliance with legal obligations.
• Managing non-essential cookies or similar technologies if enabled in the future: user consent.

4. Recipients and processors

We do not sell personal data. We share information necessary to deliver the service with the providers listed below or when required by law. Depending on the operation, Stripe may act as a processor or as an independent controller for its own legal obligations and fraud prevention.

• Stripe, to manage payments, invoicing, taxes, and the customer portal.
• Supabase, for authentication, database storage, and operational persistence.
• OpenAI, Google Cloud and fal.ai (Multiview), to process prompts, images, DXF plans and other references for requested generations. Avoid unnecessary personal or confidential data.
• Resend or equivalent transactional email providers, to send access codes and service communications.

5. International transfers

Some providers may process data outside the European Economic Area. When this happens, we rely on appropriate safeguards under applicable law, such as standard contractual clauses, adequacy decisions, or equivalent transfer mechanisms made available by those providers.

6. Retention

We keep personal data only for as long as needed to provide the service, maintain security, address incidents, comply with legal obligations, and defend potential claims. Account and billing records may be kept for the duration of the contractual relationship and for the statutory retention periods that apply; operational records and content are retained only for as long as needed for their purpose. History saved in this browser remains on the device until you delete it or clear site data. AI providers may retain security logs under their terms: disabling response storage does not guarantee zero retention. Rights requests are recorded for handling and the defence of legal claims.

7. Your rights

You may exercise your rights of access, rectification, erasure, objection, restriction, and portability at /rights or by contacting info@flapstudioai.com. We normally respond within one month; any lawful extension will be communicated within that month. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

8. Complaints and security

If you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) or the competent supervisory authority. We apply reasonable technical and organizational measures to protect the confidentiality, integrity, and availability of the data we process.