PrivacyPolicy.

The controller within the meaning of Art. 4(7) GDPR is:

Represented by: [Authorised representative]

Email: [Email address]

Phone: [Phone number (recommended)]

Further details are available in our legal notice.

We have not designated a data protection officer because the legal requirements for doing so (Art. 37 GDPR, § 38 BDSG) are not met. Please send any data protection requests directly to the controller at [Email address].

flect is a platform for creating, planning and publishing social media content with the help of artificial intelligence (AI). We process personal data only to the extent necessary to provide the website and the platform, to perform our contract with you, to keep the service secure or to comply with legal obligations, or where you have given consent.

We do not use any analytics, tracking or marketing tools, we do not embed third-party content (such as social media plugins, external fonts or videos) in our pages, and we use only strictly necessary or functional cookies (see Cookies).

Some processing only takes place if the operator of the installation has configured the respective service (e.g. an AI provider, payment service or email delivery) and you use the related feature. We indicate this in the individual sections with the note “where configured”.

We base processing on the following legal grounds:

• Art. 6(1)(a) GDPR (consent) – where you have consented to a specific processing operation.
• Art. 6(1)(b) GDPR (contract) – to perform the flect user agreement and to take steps prior to entering into it, e.g. registration, providing features, billing and support.
• Art. 6(1)(c) GDPR (legal obligation) – to comply with legal obligations, in particular retention duties under commercial and tax law.
• Art. 6(1)(f) GDPR (legitimate interests) – to pursue our legitimate interests, in particular secure and stable operation, prevention of abuse and attacks, error analysis and communication with invited persons. You may object to this processing under Art. 21 GDPR.
• Art. 9(2)(a) GDPR (explicit consent) – for voice cloning, insofar as voice data qualifies as a special category of personal data (see Voice cloning).

The website and the platform are operated by OVH SAS, 2 rue Kellermann, 59100 Roubaix, Frankreich. When you access our pages, the server necessarily processes the following data: IP address, date and time of access, requested address (URL), amount of data transferred, HTTP status code, referrer URL, and browser type and operating system (user agent).

Purpose: delivering the website, ensuring stability and security, detecting and preventing attacks. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in secure and functional operation.

Retention: server log files are deleted after 14 days at the latest, unless they are needed for longer in an individual case to investigate a security incident.

The hosting provider processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. The same applies to the providers of the database (PostgreSQL), cache (Redis) and object storage where these are operated separately.

A user account is required to use the platform. For this we process:

• name and email address,
• your password only as a cryptographic hash (scrypt) – the password itself is never stored,
• settings such as language and appearance (theme), optionally a profile picture,
• time of registration and last sign-in,
• active sessions with IP address, user agent and time of last activity, so that you can review and sign out your devices.

Purpose: providing the account and the platform. Legal basis: Art. 6(1)(b) GDPR; for session data used for security additionally Art. 6(1)(f) GDPR.

Retention: sessions expire after 30 days or end when you sign out. Account data is kept until the account is deleted.

Content is organised in workspaces in which several people with different roles (e.g. owner, admin, manager, editor, viewer) can collaborate. We process memberships and roles, invitations, comments, approvals, tasks, projects, brand profiles and notifications. Other members of the same workspace can see your name, profile picture and contributions within the workspace.

Legal basis: Art. 6(1)(b) GDPR. Retention: until deleted by authorised members, until you leave the workspace or until the workspace is deleted.

Where businesses use flect to process personal data of third parties (e.g. employees, customers or people depicted in content), we act as a processor in that respect. Details are available under Data processing agreement.

We store the content you upload or create with flect, e.g. texts, images, videos, audio files, templates, drafts and scheduled posts. Media files are stored in S3-compatible object storage (where configured, e.g. Amazon Web Services S3, Cloudflare R2 or a self-hosted MinIO instance).

Legal basis: Art. 6(1)(b) GDPR. Retention: until you delete it or until the account or workspace is deleted.

For AI features we transmit your inputs (prompts), selected content and, where applicable, brand details (e.g. target audience, tone of voice) to the respective AI provider, only when you start a generation yourself or an AI agent you have set up acts within your rules. The results are returned to us and stored in your workspace. Depending on the feature and configuration, the following providers are used:

The providers act on the basis of data processing agreements where offered; otherwise they process the data in accordance with their API terms. According to the providers' API terms at the time of writing, API inputs are not used to train models by default; the providers' current policies apply.

Legal basis: Art. 6(1)(b) GDPR. Please only enter personal data of third parties in prompts if you are entitled to do so. Information on limitations and labelling of AI content is available under AI transparency.

The voice cloning feature creates a synthetic voice from speech recordings. Voice recordings and the voice models derived from them may be equivalent to biometric data. We therefore process them only on the basis of explicit consent (Art. 9(2)(a), Art. 6(1)(a) GDPR).

• Before cloning, you must enter the speaker's name and expressly confirm that it is your own voice or that you have the speaker's written permission.
• The confirmation is recorded in the audit log with time, acting account and workspace so that consent can be demonstrated (Art. 7(1) GDPR).
• The recordings are transmitted to ElevenLabs to create the voice model (where configured).
• You can withdraw consent at any time with effect for the future. We then delete the cloned voice, as we do when you delete it in the platform, including at the provider to the extent the provider allows deletion.

You can connect accounts on TikTok, Meta (Instagram, Facebook, Threads), Google (YouTube), LinkedIn, X and Pinterest. Connections are made solely at your initiative via the platform's official OAuth flow. We process:

• access and refresh tokens – stored encrypted with AES-256-GCM and never sent to the browser,
• public profile data (e.g. account name, profile picture, follower count),
• posts you publish or schedule, and metrics (e.g. views, likes, comments) that we retrieve via the platforms' official APIs.

Legal basis: Art. 6(1)(b) GDPR. You can disconnect an account at any time; the tokens are then deleted. You can additionally revoke access in the settings of the respective platform. The platforms' own privacy policies apply to their processing.

Paid subscriptions and credit packs are processed via Stripe (where configured). You enter payment data such as card numbers directly with Stripe; it is not stored on our servers. We store the Stripe customer ID, subscription status, purchased plans and credit packs, payment events and invoice information.

Legal basis: Art. 6(1)(b) GDPR; for retaining accounting records Art. 6(1)(c) GDPR. Stripe may act as an independent controller for its own purposes such as fraud prevention and regulatory compliance; Stripe's privacy policy applies in that respect.

We send transactional emails, such as workspace invitations, via an SMTP email service provider (where configured). When members invite someone, we process that person's email address, the intended role and the invitation status. If no email delivery is configured, the invitation link is shown to the inviting person instead.

Legal basis: Art. 6(1)(b) GDPR towards users; towards invited persons Art. 6(1)(f) GDPR (legitimate interest in enabling collaboration). Pending invitations expire and are deleted if not accepted.

We do not send marketing newsletters.

To protect against abuse and unauthorised access, we log sign-in attempts (email address or IP address, success, time) and limit the number of requests per time unit. Security-relevant actions (e.g. invitations, role changes, publications, changes to integrations, voice cloning consents) are recorded in an audit log with acting account, time and IP address.

Legal basis: Art. 6(1)(f) GDPR (security of the service, accountability), for proof of consent additionally Art. 7(1) GDPR. Retention: sign-in attempts up to 30 days; audit logs up to 12 months or until the workspace is deleted.

When a technical error occurs, we store an error message with technical context (e.g. affected function, time, internal identifiers). In individual cases this may relate to a person.

Legal basis: Art. 6(1)(f) GDPR (error analysis and stability). Retention: usually 30 to 90 days.

When you submit a support request, we process the subject, message, replies, status and the associated account and workspace.

Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR. Retention: until the request is resolved and thereafter for up to two years where necessary for traceability, at most until the workspace is deleted.

We only share personal data where necessary for the purposes described. The following categories of recipients may be involved – in each case only where the operator has configured the service:

In addition, data may be disclosed to authorities or courts where we are legally obliged to do so (Art. 6(1)(c) GDPR).

Some of the providers mentioned are based in the USA or process data there. For transfers to the USA, an adequacy decision of the European Commission (EU-US Data Privacy Framework) applies where the recipient is certified under it. Otherwise we base the transfer on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) and, where necessary, supplementary measures. You can request a copy of the safeguards using the contact details above.

We delete personal data as soon as the purpose no longer applies and no statutory retention obligations prevent deletion. Overview:

You can export your data at any time under Settings → Privacy and delete your account there. Data subject to statutory retention obligations is restricted until the period expires and then deleted.

You have the following rights towards us:

• access to the data processed (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) – e.g. via the data export in the settings,
• objection to processing (Art. 21 GDPR),
• withdrawal of consent with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before withdrawal remains unaffected.

To exercise your rights, simply send a message to [Email address].

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The supervisory authority competent for us is: [Competent data protection authority].

We only use our own (first-party) cookies that are strictly necessary for operation or provide features you have requested:

Storing these cookies is permitted without consent under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) because it is strictly necessary to provide the service you have expressly requested. Subsequent processing is based on Art. 6(1)(b) and (f) GDPR. We do not use third-party cookies or tracking or marketing cookies; a cookie consent banner is therefore not required. Further information is available in our cookie policy.

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning you or similarly significantly affects you takes place.

AI agents (including autopilot mode) create, schedule or publish content solely on the basis of the rules and settings defined by you or your workspace. They do not make decisions about people.

You are under no statutory or contractual obligation to provide us with personal data. Without the information required for the user account (name, email address, password), however, we cannot enter into a user agreement with you. You do not have to use optional features such as AI generations, voice cloning or platform connections.

Our service is not directed at persons under 16. We do not knowingly process personal data of children.

We implement appropriate technical and organisational measures (Art. 32 GDPR), in particular:

• encrypted transmission (TLS/HTTPS),
• encrypted storage of integration credentials (AES-256-GCM) and password hashing (scrypt),
• role-based access control and strict separation of data between workspaces,
• rate limiting, logging of security-relevant actions and regular backups.

We update this privacy policy when our processing or the legal situation changes. The version published on this page applies; the date of the last update is shown above. We additionally inform registered users of material changes in an appropriate manner.