> For the complete documentation index, see [llms.txt](https://docs.flash.im/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flash.im/docs/resources/privacy-policy.md). # Privacy Policy > **DRAFT. REMOVE THIS BANNER BEFORE PUBLICATION.** This draft has not been reviewed by legal counsel. Placeholders in square brackets must be replaced before publication. See `_정책문서_설계.md` section 11 for the pre-publication checklist. ## Privacy Policy **Effective date: \[EFFECTIVE DATE]** This Policy explains what personal data FLASH collects, why we collect it, how long we keep it, who we share it with, and what rights you have. We have written it to describe what we actually do. Where we do not do something, we say so rather than leaving it open. ### 1. Who we are **FLASH AI S.R.L.** is the controller of the personal data described in this Policy. **Registered office** \[REGISTERED ADDRESS TO BE INSERTED BEFORE PUBLICATION], Costa Rica **Privacy contact** **EU Representative (GDPR Article 27)** \[EU REPRESENTATIVE NAME AND ADDRESS TO BE INSERTED BEFORE PUBLICATION] **UK Representative (UK GDPR Article 27)** \[UK REPRESENTATIVE NAME AND ADDRESS TO BE INSERTED BEFORE PUBLICATION] ### 2. Scope This Policy covers the FLASH Terminal and Newsroom web applications, the JSON API, the RSS feeds, our documentation, and our websites. It does not cover third-party websites you reach by following a link from a news item. ### 3. What we collect #### 3.1 Account data When you sign in with Google to obtain an API Key, **we receive your email address and nothing else.** We do not receive your name, your profile picture, your contact list, or any other Google account data. We generate and store an account identifier and a hashed reference to your API Key. #### 3.2 API usage data When you call the API, our servers record: * the endpoint called and the parameters sent, including any `queryId` you supply * the timestamp of the call * the IP address the call came from * the user agent string * the response status and the number of items returned #### 3.3 Support data If you contact us, we receive what you send: your message, your email address, and any attachments. #### 3.4 Analytics data Our websites use Google Analytics. It sets two cookies and collects standard web analytics data such as pages viewed, approximate location derived from IP address, device type, and referring page. See our Cookie Policy for detail. #### 3.5 Payment data Paid plans are payable in $FL. We record which plan an account holds and the transactions associated with it. The specific payment method and any processor involved will be identified at the time you subscribe, and this Policy will be updated to name them. #### 3.6 What we do not collect * We do not collect special category data (health, biometrics, race, religion, political opinions, sexual orientation, trade union membership). * We do not collect data from children. The Service is for people aged 18 and over. * We do not buy personal data from data brokers. * We do not operate advertising and we do not run advertising cookies or trackers. ### 4. Why we process it, and on what legal basis | What | Why | Legal basis (GDPR) | | ---------------------------------- | ------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------- | | Email address | Create and operate your account, issue and rotate your API Key, send service notices | Performance of a contract | | Account identifier, hashed API Key | Authenticate your calls, apply your plan's limits | Performance of a contract | | API usage data | Enforce rate limits, bill correctly, investigate abuse and security incidents, keep the Service stable | Legitimate interests (operating and protecting the Service) | | Aggregated usage statistics | Capacity planning, product decisions | Legitimate interests | | Support data | Answer your question and keep a record of it | Performance of a contract, or legitimate interests where you are not a customer | | Analytics data | Understand how our websites are used | Consent, given through the cookie banner | | Payment data | Take payment, keep accounting records | Performance of a contract, and legal obligation for the accounting record | | Any of the above | Comply with a legal obligation, or establish or defend a legal claim | Legal obligation, or legitimate interests | Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and we will provide our assessment on request. Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal. ### 5. How long we keep it | Data | Retention | | --------------------------------------------------------------- | -------------------------------------------------------------------------------- | | Email address and account record | For as long as the account exists, then 30 days after closure | | Hashed API Key | For as long as the account exists, then 30 days after closure | | API usage data (IP, user agent, endpoint, timestamp) | 90 days | | Aggregated usage statistics (daily call counts, no identifiers) | 24 months | | `queryId` and related cursor state | For as long as needed to serve incremental fetching for that query, then 90 days | | Support records | 24 months | | Payment and accounting records | For the period required by Costa Rican accounting and tax law | | Google Analytics data | 14 months. Cookie lifetime is set out in the Cookie Policy | The 30-day window after account closure exists so that an account closed by mistake can be restored. After it passes, the account record is deleted. ### 6. Who we share it with We share personal data only with the following categories of recipient, and only as far as necessary. | Recipient | Purpose | | --------------------- | ---------------------------------------------------------------------------------------------------------------- | | AWS (hosting) | Running the Service and storing data | | Google (sign-in) | Authenticating you and returning your email address | | Google Analytics | Website analytics | | Stripe | Processing payment for paid plans | | Professional advisers | Legal, accounting, and audit services, under confidentiality | | Authorities | Where we are legally required to disclose, or where disclosure is necessary to establish or defend a legal claim | **We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We do not disclose personal data to advertising networks or data brokers.** If we are ever involved in a merger, acquisition, or sale of assets, personal data may transfer to the acquiring entity. We will give notice before that happens and before this Policy would change. ### 7. Where your data goes Our company is established in Costa Rica. Our infrastructure is hosted in the **United States**. This means personal data is transferred out of the country you are in. For transfers from the European Economic Area and the United Kingdom, we rely on the **European Commission's Standard Contractual Clauses** (and the UK International Data Transfer Addendum, where applicable) as the transfer mechanism, supported by additional technical and organisational measures. Where a recipient in the United States is certified under the EU-US Data Privacy Framework, that certification may also apply, but we do not rely on it alone. You may request a copy of the relevant transfer safeguards by writing to . ### 8. Your rights #### 8.1 If you are in the European Economic Area or the United Kingdom You have the right to: * **access** the personal data we hold about you and receive a copy; * **rectify** data that is inaccurate, and complete data that is incomplete; * **erase** your data in the circumstances the law provides; * **restrict** our processing in the circumstances the law provides; * **object** to processing based on our legitimate interests; * **portability**, meaning to receive data you gave us in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible; * **withdraw consent** at any time, where we rely on consent; and * **lodge a complaint** with a supervisory authority in your country of residence, place of work, or the place of the alleged infringement. To exercise any of these, write to . We will respond within one month. If a request is complex we may extend that by two further months and will tell you if we do. We do not carry out automated decision-making that produces legal or similarly significant effects concerning you. #### 8.2 If you are in the United States Depending on your state of residence, you may have the right to know what personal data we collect and why, to access and obtain a copy of it, to correct it, to delete it, to obtain it in a portable form, to opt out of sale, sharing, targeted advertising, and profiling, and not to be discriminated against for exercising these rights. **We do not sell personal data, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising or profiling.** There is therefore nothing for you to opt out of on those grounds. We honour universal opt-out signals such as Global Privacy Control where they apply. To exercise your rights, write to . You may use an authorised agent. We may need to verify your identity before acting, and we will do so using information we already hold. #### 8.3 If you are in Costa Rica You have the rights provided by Law No. 8968 on the Protection of the Person in the Processing of Personal Data, including access, rectification, and deletion, and the right to complain to the Agency for the Protection of Personal Data of Inhabitants (PRODHAB). #### 8.4 Everyone else Wherever you are, you may write to to ask what we hold about you, to correct it, or to have it deleted. We will apply the same process regardless of where you live. ### 9. Security We protect personal data with measures appropriate to the risk, including encryption in transit, encryption at rest, access controls limited to staff who need access, hashed storage of API Key references, and logging of administrative access. No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, **we will notify you and the relevant supervisory authority** without undue delay, in accordance with applicable law. We will do this even where the law of our place of establishment does not require it. ### 10. Data you send us about other people If you are a partner integrating our API, the values you send us in a query, including `queryId`, are chosen by you. Where such a value identifies a person, you are responsible for having a lawful basis to send it to us, and we process it on your instructions for the purpose of answering your query and maintaining your cursor state. We recommend that `queryId` be an internal identifier of a contract or an asset, not of a person. ### 11. Children The Service is not directed to anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, write to and we will delete it. ### 12. Changes to this Policy We may update this Policy. When we do, we will change the effective date at the top. If a change is material, we will make reasonable efforts to give notice before it takes effect, by posting the revised Policy and, where we hold your email address, by email. ### 13. Contact **FLASH AI S.R.L.** \[REGISTERED ADDRESS TO BE INSERTED BEFORE PUBLICATION], Costa Rica