Flatly Privacy Policy
Effective date: October 23, 2026
This policy explains what personal information Flatly, LLC (“Flatly,” “we,” “us”) collects when you visit flatly.io or use the Flatly app at app.flatly.io (together, the “Service”), how we use it, who we share it with, and the choices you have.
The short version
- We don’t sell your personal information, share it for cross-context behavioral advertising, or show ads.
- We don’t store the business data you sync. Flatly is a conduit: your data passes through our systems during a sync and is permanently deleted from our cache as soon as the sync completes.
- We do store the credentials needed to run your syncs, encrypted with AES-256 in Google Cloud.
- We use a small, named set of service providers to run Flatly, and they may use your information only to provide services to us.
- You can access, export, correct, or delete your information at any time by emailing support@flatly.io.
1. Who we are
Flatly, LLC, 440 N Barranca Ave #1810, Covina, CA 91723, USA. Contact: support@flatly.io.
Flatly decides how your account, billing, support, and website data is used, so for those we are the “controller” (or “business” under US state law). For business data that passes through your sync jobs, we act only on your instructions, as your “processor” or “service provider.”
2. Information we collect
Information you give us
- Account information: your name, email address, and login credentials. Sign-in is handled by Firebase Authentication; we never see your password in plain text. If you enable two-factor authentication, we store the settings needed to verify your codes.
- Billing information: payments are processed by Stripe, which collects and stores your card details. We receive only what we need to manage your subscription, such as your plan, payment status, invoices, and billing contact details.
- Support communications: messages you send through in-app chat (Intercom) or email, and anything you choose to include in them.
- Job and notification settings: job names, schedules, selected datasets and columns, output formats, destinations, and the email addresses, webhook URLs, or Slack endpoints you choose for notifications.
Information from the services you connect
When you connect a data source or destination, you authorize Flatly through OAuth, Plaid, a service account, an API key, server credentials, or your own key (BYOK).
- Connection credentials: access and refresh tokens, API keys, service account keys, and server connection details. These are encrypted with AES-256 and stored in an encrypted database in Google Cloud.
- Connection details: account, tenant, and sub-account names and IDs, the email address tied to a connected account, and connection health status.
- Business data: the records your sync jobs fetch, such as CRM records, support tickets, or bank transactions. This data may include personal information about you or about other people, such as your customers. We process it only in transit, hold it in a temporary cache while a sync runs, and permanently delete it when the sync completes. We do not persist it.
- Sync logs: for your most recent 1,000 syncs, we keep metadata such as status, timing, cell counts, API request counts, and error codes. Logs do not store the contents of your business data.
Bank connections through Plaid. When you connect a financial institution, Plaid collects your bank login directly; Flatly never sees your bank username or password. We receive an access token and the account and transaction data you choose to sync. Plaid’s handling of your data is described in the Plaid End User Privacy Policy.
Information collected automatically
- Usage and device data: IP address, browser and operating system, pages and screens viewed, referring URL, timestamps, and approximate location derived from your IP address.
- Session replay and error monitoring: in the app, LogRocket records interactions such as page navigation, clicks, console errors, and network timing so we can find and fix bugs. Form inputs, including credentials and API keys, are masked and never recorded.
- Bot protection: Google reCAPTCHA collects hardware and software information and interaction data, such as mouse movements, to tell people from bots.
- Cookies and similar technologies: described in section 7.
3. How we use information
- Run the Service: sign you in, store your connections and jobs, run syncs on your schedule, and send the notifications you set up.
- Billing: manage your trial, subscription, invoices, and payment status.
- Support: answer your questions and troubleshoot problems you report.
- Security: protect accounts, detect fraud and abuse, and keep the Service stable.
- Improve Flatly: understand how the website and app are used and fix bugs, using analytics, session replay, and sync metadata.
- Communicate with you: send service messages (sync failures, billing, security, and policy changes) and occasional product news. You can unsubscribe from product news at any time with the link in the email.
- Comply with the law: meet tax, accounting, and legal obligations and respond to lawful requests.
We use business data only to perform the syncs you configure. We do not use your business data or connected-account data for analytics, advertising, or to train AI or machine learning models.
Staff access. Flatly has a single system administrator. Business data is accessed only if you ask us to through a support request, or if your data is causing an outage or stability problem that we need to resolve.
4. Data from Google APIs
Flatly’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data we receive from Google services such as Google Sheets, Google Drive, and Google BigQuery:
- is used only to provide the sync features you configure in Flatly;
- is not transferred to others except as needed to provide those features, for security, to comply with law, or as part of a merger or acquisition;
- is never used for advertising, sold, or used to determine creditworthiness;
- is never used to develop, improve, or train generalized AI or machine learning models; and
- is not read by people unless you give us permission, it is needed for security or to comply with law, or it is aggregated and anonymized for internal operations.
You can revoke Flatly’s access at any time from your Google Account permissions.
5. How we share information
We share personal information only in the ways below.
Service providers. These companies process data on our behalf under contracts that limit their use of it to providing services to us:
| Provider | What they do for Flatly | Data involved | Location |
|---|---|---|---|
| Google Cloud and Firebase | Hosting, encrypted database, authentication, temporary sync cache | Account data, credentials, settings, business data in transit | US (us-central) |
| Cloudflare | Content delivery, DNS, and network security | IP address, request data | Global network |
| Stripe | Payments and subscription billing | Billing contact and payment details | US |
| Intercom | In-app chat and support email | Name, email, messages, app usage | US |
| LogRocket | Session replay and error monitoring | App interactions, device data | US |
| Google Analytics 4 | Website and app analytics | Usage data, cookie IDs | US |
| Google reCAPTCHA | Bot and spam protection | Device and interaction data | US |
Services you connect. When you connect a source or destination, data moves between Flatly and that service as you direct, including Plaid for bank connections. Your use of those services is governed by their own terms and privacy policies.
Notifications you set up. If you configure webhook or Slack notifications, sync summaries are sent to the endpoints you choose.
Legal and safety. We may disclose information if required by law, subpoena, or court order, or when needed to protect the rights, property, or safety of Flatly, our users, or others.
Business transfers. If Flatly is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that deal, subject to this policy.
With your consent. In any other case, only when you ask us to or agree to it.
We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising.
6. How long we keep information
We keep personal information only as long as we need it for the purposes above, then delete or anonymize it.
| Data | How long we keep it |
|---|---|
| Business data from syncs | Only while a sync runs; deleted from cache when it completes |
| Connection credentials | Until you delete the connection or your account |
| Account, job, and notification settings | While your account is open, then deleted within 30 days of account deletion |
| Sync logs | Your most recent 1,000 syncs; deleted with your account |
| Billing and tax records | As long as tax and accounting law requires, generally up to 7 years |
| Support conversations | While your account is open and up to 2 years after |
| Session replays (LogRocket) | Up to 30 days |
| Analytics (Google Analytics) | Up to 14 months |
Deleted data may remain in encrypted backups for a short period until those backups expire on their normal cycle.
7. Cookies and similar technologies
We use cookies, local storage, and scripts for the purposes below. We don’t use advertising cookies.
| Type | Purpose | Provider |
|---|---|---|
| Essential | Keep you signed in, secure your session, route and protect traffic | Flatly, Firebase, Cloudflare |
| Security | Distinguish people from bots on forms | Google reCAPTCHA |
| Support | Power in-app chat and remember your conversations | Intercom |
| Monitoring | Session replay and error tracking in the app | LogRocket |
| Analytics | Measure website and app usage | Google Analytics 4 |
You can block or delete cookies in your browser settings, though the app won’t work without essential cookies. You can opt out of Google Analytics with the Google Analytics opt-out browser add-on. We honor Global Privacy Control (GPC) signals as a valid opt-out request.
8. Security
- Connection credentials are encrypted with AES-256 and stored in an encrypted database in Google Cloud (US Central).
- Data in transit is protected with TLS 1.3.
- Accounts support two-factor authentication with an authenticator app, plus Flatly’s Destination Lock for connections.
- Business data is not persisted after a sync completes.
- Infrastructure access is limited to a single system administrator.
- Cloudflare protects our public-facing infrastructure.
No system is perfectly secure. If a breach affects your personal information, we will notify you and any required authorities as the law requires.
9. Your rights and choices
For everyone
- Access, export, correct, or delete your personal information by emailing support@flatly.io.
- Delete a connection in the app at any time; its stored credentials are deleted with it.
- Revoke Flatly’s access directly at the connected service, for example Google Account permissions, Microsoft account app permissions, or Plaid Portal.
- Unsubscribe from product news with the link in any such email. We’ll still send service messages about your account.
We respond to requests within 30 days, or sooner where the law requires, and we never charge for a reasonable request. We may need to verify your identity first, usually by confirming control of your account email.
US state privacy rights
If you live in California, Colorado, Connecticut, Virginia, Texas, Oregon, or another US state with a comprehensive privacy law, you have the right to:
- know what personal information we collect, use, and disclose, and get a copy of it in a portable format;
- correct inaccurate personal information;
- delete your personal information;
- opt out of the sale or sharing of personal information, targeted advertising, and profiling (we do none of these);
- limit the use of sensitive personal information (we use it only to provide the Service); and
- not be discriminated against for exercising these rights.
You can make a request yourself or through an authorized agent, who must provide proof of your authorization. If we deny your request, you can appeal by replying to our decision or emailing support@flatly.io with “Privacy appeal” in the subject line. If you disagree with the outcome of an appeal, you can contact your state attorney general.
Information we collected in the past 12 months:
| Category | Examples | Purpose | Disclosed to | Sold or shared |
|---|---|---|---|---|
| Identifiers | Name, email, IP address, account ID | Account, support, security | Service providers | No |
| Customer records | Billing contact details | Billing | Stripe | No |
| Commercial information | Plan and subscription history | Billing, support | Stripe, Intercom | No |
| Internet activity | Pages viewed, app interactions, device data | Analytics, debugging, security | Google, LogRocket, Intercom, Cloudflare | No |
| Approximate location | Location inferred from IP address | Security, analytics | Google, Cloudflare | No |
| Sensitive personal information | Account login credentials; access to financial and other connected accounts | Providing the Service only | Google Cloud, Plaid | No |
We collect this information from you, automatically from your device, and from the services you connect. Retention periods are in section 6.
Users in the EU, UK, and Switzerland
We rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Providing the Service, running syncs, billing, support | Performance of our contract with you |
| Security, fraud prevention, debugging, analytics, session replay, service emails, product news, product improvement | Our legitimate interests in running, securing, and improving a reliable service (you can object at any time) |
| Anything else you specifically agree to | Your consent, which you can withdraw at any time |
| Tax and accounting records, lawful requests | Legal obligation |
You also have the rights to restrict or object to processing, to withdraw consent, and to lodge a complaint with your local data protection authority.
Flatly is based in the United States and processes data there. When we transfer personal information out of the EU, UK, or Switzerland, we rely on the EU-US Data Privacy Framework (and its UK and Swiss extensions) where our providers are certified, or on Standard Contractual Clauses.
Users in other countries
If you live in Brazil, Canada, or another country with data protection laws, you can exercise the rights those laws give you by contacting support@flatly.io.
10. Children
Flatly is a business service for adults and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.
11. Changes to this policy
We may update this policy as Flatly changes. We’ll post the new version on this page with a new effective date. For material changes, we’ll also notify you by email or in the app before they take effect.
12. Contact us
Questions or requests about this policy or your personal information: email support@flatly.io, or write to Flatly, LLC, 440 N Barranca Ave #1810, Covina, CA 91723, USA.