1. Introduction

Welcome to Flaxbot ("Flaxbot", "we", "our", or "us"), operated by Flaxbot Ltd. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you visit our website at https://flaxbot.com or use our PC software (collectively, the "Services").

We are committed to protecting your privacy and complying with applicable data protection laws, including:

• The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018
• The EU General Data Protection Regulation (Regulation (EU) 2016/679)
• The California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA)
• The Privacy and Electronic Communications Regulations (PECR)

Please read this Privacy Policy carefully. By accessing or using our Services, you acknowledge that you have read, understood, and agree to the practices described in this policy.

2. Data Controller / Business Identity

For the purposes of UK and EU data protection law, the Data Controller is:

For California residents, Flaxbot Ltd is the "Business" as defined under the CCPA/CPRA.

3. Information We Collect

3.1 Personal Information You Provide Directly

We collect the following categories of personal information that you voluntarily provide when creating an account or using our Services:

• Name or Username – to identify your account and personalise your experience
• Email Address – to communicate with you, send account-related notifications, and (with your consent) marketing communications
• Password – stored in encrypted/hashed form to authenticate your account access; we never store plain-text passwords

3.2 Information Collected Automatically

When you visit our website or use our PC software, we may automatically collect certain technical and usage data through tracking technologies described in Section 4:

• Browser type, device type, operating system, and IP address
• Pages visited, time spent on pages, clickstream data, and referring URLs
• Session data – information about your activity during a single browser session
• Local storage data – small files stored on your device to enhance functionality and remember your preferences

3.3 Information from Third Parties and Advertising Technologies

• Analytics data from Google Analytics (including demographic and interest reports where enabled)
• Behavioural and conversion data collected via the Meta (Facebook) Pixel
• Advertising and retargeting data from third-party ad networks used to serve relevant advertisements to you across other websites and platforms
• Payment transaction data processed by a third-party (we do not receive or store full payment card details)

4. Tracking Technologies

4.1 Sessions

Session data is created when you log in and is used to maintain your authenticated state during your visit. Sessions are temporary and expire when you log out or close your browser.

4.2 Local Storage

We use browser local storage to persist certain preferences and application state across visits. Unlike cookies, local storage data is not transmitted to our servers automatically but may be read by our scripts. You can clear local storage data via your browser settings.

4.3 Google Analytics

We use Google Analytics to understand how users interact with our website. Google Analytics uses cookies and similar technologies to collect information about your use of our Services and may combine this with information about your visits to other websites to produce aggregated reports.

For more information, see Google's Privacy Policy. You may opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

4.4 Meta (Facebook) Pixel

We use the Meta Pixel to measure the effectiveness of our advertising and to build audiences for targeted ads on Meta platforms (Facebook and Instagram). The Pixel collects information about actions taken on our website (such as page views and sign-ups) and links them to your Facebook profile where possible.

You can manage your Meta ad preferences at https://www.facebook.com/settings/?tab=ads or opt out via the Digital Advertising Alliance.

4.5 Retargeting / Remarketing

We use retargeting technologies to display advertisements to users who have previously visited our website or interacted with our Services. These advertisements may appear on third-party websites and social media platforms, and work through the cookies, local storage, and pixel technologies described above.

You can opt out via the Network Advertising Initiative or the Digital Advertising Alliance.

5. How We Use Your Personal Information

5.1 To Provide and Maintain the Services

Legal basis (UK/EU GDPR): Performance of a contract (Article 6(1)(b))

• Creating and managing your user account
• Processing payments via a third-party
• Authenticating your identity when you log in
• Providing technical support and responding to your enquiries

5.2 To Communicate with You

Legal basis (UK/EU GDPR): Legitimate interests (Article 6(1)(f)) for transactional communications; Consent (Article 6(1)(a)) for marketing emails

• Sending service-related emails (e.g., account confirmations, security alerts, billing receipts)
• Sending newsletters or promotional communications where you have opted in
• You may opt out of marketing emails at any time by clicking the unsubscribe link in any email or contacting us at [email protected]

5.3 For Analytics and Service Improvement

Legal basis (UK/EU GDPR): Legitimate interests (Article 6(1)(f)); Consent where required by PECR

• Analysing usage patterns to improve our website and PC software
• Monitoring performance and diagnosing technical issues
• Conducting A/B testing and product research

5.4 For Advertising and Retargeting

Legal basis (UK/EU GDPR): Consent (Article 6(1)(a)) where required; Legitimate interests (Article 6(1)(f)) where applicable

• Displaying targeted advertisements to relevant audiences on Meta platforms and third-party sites
• Measuring the effectiveness of our advertising campaigns
• Building lookalike audiences based on our existing user base

5.5 To Comply with Legal Obligations

Legal basis (UK/EU GDPR): Legal obligation (Article 6(1)(c))

• Maintaining records as required by applicable law
• Responding to lawful requests from law enforcement or regulatory authorities
• Exercising or defending legal claims

6. How We Share Your Information

We do not sell your personal information. We may share your information in the following limited circumstances:

6.1 Service Providers and Data Processors

We engage third-party service providers who process personal data on our behalf, subject to appropriate data processing agreements:

• Payment Processing: A third-party processes payment transactions. We share limited transactional information necessary to complete your purchase.
• Analytics: Google LLC – provides Google Analytics services. Data may be transferred to the United States under Standard Contractual Clauses.
• Advertising: Meta Platforms, Inc. – operates the Facebook Pixel and advertising platform. Data may be transferred to the United States under Standard Contractual Clauses.
• Hosting and Infrastructure: Our website and software may be hosted on third-party cloud infrastructure providers who act as data processors.

6.2 Business Transfers

If Flaxbot Ltd is involved in a merger, acquisition, or sale of all or a portion of its assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership or uses of your personal information.

6.3 Legal Requirements

We may disclose your personal information where required to do so by law, or where we believe in good faith that disclosure is necessary to: (i) comply with a legal obligation; (ii) protect and defend the rights or property of Flaxbot Ltd; (iii) prevent or investigate possible wrongdoing in connection with the Services; or (iv) protect the personal safety of users of the Services or the public.

6.4 With Your Consent

We may share your information with third parties when you have given your explicit consent to do so.

7. International Data Transfers

As a UK-based company, we primarily process your data within the United Kingdom and the European Economic Area (EEA). However, certain service providers (including Google and Meta) operate internationally, which may result in transfers of your personal data outside the UK and EEA, including to the United States.

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements, including:

• Adequacy decisions recognised by the UK Information Commissioner's Office (ICO)
• Standard Contractual Clauses (SCCs) approved for use in the UK
• The UK International Data Transfer Agreement (IDTA)

For transfers from the EEA, we rely on the EU Standard Contractual Clauses adopted by the European Commission.

8. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected:

When personal data is no longer required, we securely delete or anonymise it.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encryption of passwords using industry-standard hashing algorithms
• Use of HTTPS/TLS encryption for data transmitted between your browser and our servers
• Access controls limiting employee access to personal data on a need-to-know basis
• Regular security assessments and vulnerability testing

No method of transmission over the Internet or method of electronic storage is 100% secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and, where required, affected individuals in accordance with applicable law.

10. Children's Privacy

Our Services are not directed to individuals under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13 without parental consent, we will take steps to delete such information promptly.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected].

11. Your Rights Under UK and EU Data Protection Law

If you are located in the United Kingdom or the European Economic Area, you have the following rights in relation to your personal data, subject to certain conditions and exceptions:

To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with the supervisory authority. In the United Kingdom, this is the:

Information Commissioner's Office (ICO)
Website: https://ico.org.uk/make-a-complaint
Helpline: 0303 123 1113

12. Your Rights Under California Law (CCPA/CPRA)

If you are a California resident, the CCPA as amended by the CPRA grants you the following rights:

12.1 Right to Know

You have the right to request that we disclose: the categories and specific pieces of personal information we have collected about you; the categories of sources; the business or commercial purpose for collecting or sharing it; and the categories of third parties with whom we share it.

12.2 Right to Delete

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions (such as where the information is necessary to complete a transaction or comply with a legal obligation).

12.3 Right to Correct

You have the right to request that we correct inaccurate personal information we maintain about you.

12.4 Right to Opt-Out of Sale or Sharing

We do not sell your personal information for monetary consideration. However, under the CPRA, use of the Meta Pixel and Google Analytics for cross-context behavioural advertising may constitute "sharing" of personal information. You have the right to opt out of this sharing by:

• Opting out of Meta advertising data sharing via your Facebook Ad Preferences
• Installing the Google Analytics Opt-Out Browser Add-on
• Using the opt-out links in Section 4 above
• Contacting us at [email protected] with the subject line "CCPA Opt-Out"

12.5 Right to Limit Use of Sensitive Personal Information

We do not collect or process sensitive personal information as defined under the CPRA.

12.6 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you goods or services, charge different prices, or provide a lower quality of service because you exercised your privacy rights.

12.7 Categories of Personal Information Collected (CCPA Categories)

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

12.8 How to Submit a CCPA/CPRA Request

California residents may submit requests by emailing [email protected]. We will respond within 45 days of receiving a verifiable consumer request, with a possible 45-day extension where reasonably necessary (with prior notice). We will not charge a fee for one request per 12-month period.

13. Email Communications and Marketing

We may send you marketing emails, newsletters, and promotional content about our Services, but only where you have explicitly opted in to receive such communications.

You can opt out of receiving marketing communications at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email
• Contacting us at [email protected] with the subject line "Unsubscribe"

Even if you opt out of marketing communications, we may still send you essential service-related emails (such as account confirmations, security alerts, and payment receipts) as these are necessary for the performance of our contract with you.

We comply with the UK Privacy and Electronic Communications Regulations (PECR) and the CAN-SPAM Act for all marketing communications.

14. Payment Processing

We use a third-party payment processor, to handle online payment transactions. When you make a payment through our Services, your payment information (including card details) is collected and processed directly by the third-party. We do not receive, process, or store full payment card numbers or sensitive authentication data.

The information we receive from third-party is limited to transaction confirmation details (such as amount, date, and a transaction reference) necessary for account management and customer support.

15. Third-Party Websites and Services

Our Services may contain links to third-party websites or services that are not operated by us. We have no control over the content, privacy policies, or practices of these third-party sites and accept no responsibility for them. We encourage you to review the privacy policy of every website you visit.

16. Legal Basis for Processing (UK/EU GDPR Summary)

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Effective Date" at the top of this policy
• Notify you via email (to the address associated with your account) where required by law
• Post a prominent notice on our website or within the PC software

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after any changes constitutes your acceptance of the updated policy, to the extent permitted by applicable law. If you do not agree with any changes, you should discontinue use of the Services and may request deletion of your account.

18. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For UK GDPR-related requests, we will respond within one calendar month. For CCPA/CPRA requests, we will respond within 45 days. If we require additional time, we will inform you of the reason and extension period within the initial response window.