Privacy Policy

1. Introduction

This Privacy Policy explains how Adam Development AB, trading as FlexPortal ("FlexPortal", "we", "us", or "our"), collects, uses, discloses, and protects personal data when you use our subscription management platform and visit our website.

We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (GDPR), the Swedish Data Protection Act, and other applicable data protection laws.

Data Controller

Adam Development AB
Organization number: 559430-2027
Björkrisvägen 6A, 702 34 Örebro, Sweden
Email: support@flexportal.io

2. Scope of This Policy

This Privacy Policy applies to:

• Visitors to our website (flexportal.io)
• Businesses that create accounts and use our Platform ("Clients")
• Individuals representing Clients who access the Platform ("Users")

Our Role as Data Processor

FlexPortal is a business-to-business (B2B) platform. When Clients use our Platform to manage their subscription business, they upload data about their own customers ("End Customer Data"). In this relationship:

• Clients act as the data controller for End Customer Data
• FlexPortal acts as the data processor, processing End Customer Data only on behalf of and under the instructions of our Clients

This Privacy Policy primarily addresses how we process data about our Clients and Users. If you are an end customer of one of our Clients, please refer to that Client's privacy policy for information about how they handle your data.

3. Personal Data We Collect

3.1 Account and Business Information

When you create an account or become a Client, we collect:

• Contact information: Name, email address, phone number
• Business information: Company name, business address, VAT number, organization number
• Account credentials: Email and authentication data (passwords are handled by Firebase Authentication and never stored by us directly)
• Billing information: Payment method details, billing address (payment card data is processed by Stripe, our payment processor, and not stored on our servers)
• Team member information: Names and email addresses of users you invite to your account

3.2 Usage Data

When you use our Platform, we automatically collect:

• Activity logs: Actions performed, features used, timestamps
• Session data: Login times, session duration, last activity
• API usage: API calls, endpoints accessed, request metadata
• Technical data: Browser type, operating system, device information

3.3 Website Analytics

On our marketing website (flexportal.io), we collect:

• Vercel Analytics: Anonymous, aggregated website performance data. Vercel Analytics is privacy-focused and does not use cookies or collect personal data.
• Google Tag Manager: Used for conversion tracking to understand how visitors find and interact with our website. This may set cookies as described in Section 8.

3.4 Communications

When you contact us, we collect:

• Email correspondence and support requests
• Feedback and survey responses
• Demo or meeting booking information

4. How We Use Your Data

We process your personal data for the following purposes:

4.1 Providing Our Services

• Creating and managing your account
• Providing access to the Platform and its features
• Processing transactions and billing
• Sending transactional emails (order confirmations, payment notifications, subscription updates)
• Providing customer support

Legal basis: Performance of a contract (Article 6(1)(b) GDPR)

4.2 Platform Improvement

• Analyzing usage patterns to improve features
• Monitoring performance and fixing errors
• Developing new features and services

Legal basis: Legitimate interests (Article 6(1)(f) GDPR) - improving our services

4.3 Security and Compliance

• Detecting and preventing fraud, abuse, and security threats
• Enforcing our Terms of Service
• Maintaining audit logs for compliance purposes
• Responding to legal requests and obligations

Legal basis: Legitimate interests (security) and legal obligation (Article 6(1)(c) and (f) GDPR)

4.4 Communications

• Sending service announcements and updates
• Responding to inquiries and support requests
• Providing onboarding assistance

Legal basis: Performance of a contract and legitimate interests (Article 6(1)(b) and (f) GDPR)

5. Data Sharing and Third Parties

We do not sell your personal data. We share data only in the following circumstances:

5.1 Service Providers

We use trusted third-party service providers to help operate our Platform:

Provider	Purpose	Data Location
Google Cloud Platform (Firebase)	Infrastructure, database, authentication, file storage	EU (Frankfurt) or US (Iowa) based on your selection
Stripe	Payment processing for FlexPortal subscriptions and payment integration for Clients to collect payments from their customers	EU and US (Stripe is PCI DSS Level 1 certified and certified under EU-US Data Privacy Framework)
Resend	Transactional email delivery	US (with appropriate safeguards)
Vercel	Website hosting and analytics	Global edge network

All service providers are bound by data processing agreements and are required to protect your data in accordance with applicable data protection laws.

5.2 Legal Requirements

We may disclose your data if required by law, court order, or government request, or when necessary to:

• Comply with legal obligations
• Protect our rights, privacy, safety, or property
• Enforce our Terms of Service
• Protect against legal liability

5.3 Business Transfers

If FlexPortal is involved in a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your data.

6. Data Residency and Regional Isolation

6.1 Isolated Regional Environments

FlexPortal operates fully isolated regional environments to meet local data residency and compliance requirements. Each region has its own:

• Database infrastructure (Firestore)
• Application servers (Cloud Functions)
• File storage (Cloud Storage)
• Authentication systems

Your data never leaves your selected region. There is no data replication or synchronization between regions. Each environment is completely independent.

6.2 Available Regions

We currently offer the following regional deployments:

• European Union: Frankfurt, Germany (europe-west3) — for EU, UK, EEA, Switzerland, and GDPR-focused clients
• United States: Iowa, United States (us-central1) — for US, Canada, LATAM, APAC, and rest of world

You select your data region during account setup. This choice determines where all your account data, customer data, assets, orders, and files are stored and processed.

6.3 Enterprise Regional Deployments

For Enterprise customers with specific data residency requirements, we can provision dedicated regional environments in additional locations (e.g., Middle East). These deployments are fully isolated and comply with local data protection regulations. Contact us at support@flexportal.io to discuss your requirements.

6.4 Ancillary Services

While your core Platform data remains in your selected region, certain ancillary functions may involve processing outside that region:

• Email delivery (Resend): Transactional emails are sent via Resend. Email content passes through their infrastructure to reach recipients.
• FlexPortal billing (Stripe): Your subscription payments to FlexPortal are processed by Stripe. Stripe handles payment processing, tax calculation, and invoice generation according to their privacy practices.

These services process only the minimum data necessary for their function (e.g., email addresses for delivery, payment details for billing) and are bound by data processing agreements.

7. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes described in this policy:

Data Type	Retention Period
Account data	Duration of account plus 30 days after termination for data export
Billing records	7 years (Swedish accounting requirements)
Audit logs	365 days
Session data	7 days after session expiration
Support correspondence	3 years after resolution
Marketing analytics	Aggregated data only, no personal data retained

After the retention period, data is securely deleted or anonymized. You may request earlier deletion of your data subject to legal and contractual obligations.

8. Cookies and Tracking Technologies

8.1 Our Website (flexportal.io)

Our marketing website uses minimal tracking:

• Vercel Analytics: Privacy-focused analytics that does not use cookies and does not collect personal data. Provides aggregated performance metrics only.
• Google Tag Manager: Used for conversion tracking. May set cookies to understand how visitors find our website through advertising channels.

8.2 Our Platform (app.flexportal.io)

The Platform uses only essential cookies necessary for:

• Authentication and session management
• Security (CSRF protection)
• User preferences

These are strictly necessary cookies and do not require consent under GDPR.

8.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling essential cookies may affect Platform functionality. For Google Tag conversion tracking, you can opt out through Google's opt-out browser add-on.

9. Data Security

We implement comprehensive security measures to protect your data:

9.1 Technical Measures

• Encryption at rest: All data is encrypted using AES-256 encryption
• Encryption in transit: All communications use TLS 1.2 or higher
• Access controls: Role-based access, multi-tenant data isolation
• Authentication: Secure authentication via Firebase Auth with session management
• API security: Rate limiting, authentication requirements, abuse detection

9.2 Organizational Measures

• Limited access to personal data on a need-to-know basis
• Regular security assessments and code reviews
• Incident response procedures
• Service provider security requirements

9.3 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR
• Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms
• Document all breaches, including the facts, effects, and remedial actions taken
• Provide you (as our Client) with information about breaches affecting your End Customer Data so you can fulfill your own notification obligations

If you become aware of any unauthorized access to or disclosure of data processed through the Platform, please notify us immediately at support@flexportal.io.

9.4 Infrastructure Security

Our infrastructure is hosted on Google Cloud Platform, which maintains extensive security certifications including ISO 27001, SOC 2, and GDPR compliance. Data is stored in secure, redundant data centers with physical security controls.

10. Your Rights

Under GDPR and applicable data protection laws, you have the following rights:

10.1 Right of Access

You have the right to request a copy of the personal data we hold about you and information about how we process it.

10.2 Right to Rectification

You have the right to request correction of inaccurate or incomplete personal data.

10.3 Right to Erasure

You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected.

10.4 Right to Restriction

You have the right to request that we restrict processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have contested.

10.5 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller. Our Platform provides data export functionality.

10.6 Right to Object

You have the right to object to processing of your personal data based on legitimate interests. We will cease processing unless we have compelling legitimate grounds.

10.7 Rights Related to Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on individuals.

10.8 Exercising Your Rights

To exercise any of these rights, please contact us at support@flexportal.io. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

10.9 Right to Lodge a Complaint

If you believe we have violated your data protection rights, you have the right to lodge a complaint with a supervisory authority. In Sweden, this is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY):

Integritetsskyddsmyndigheten
Box 8114
104 20 Stockholm, Sweden
www.imy.se

11. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

11.1 Your California Rights

• Right to Know: You can request information about the categories and specific pieces of personal information we have collected, the sources of that information, our business purposes for collecting it, and the categories of third parties with whom we share it.
• Right to Delete: You can request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You can request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell personal information or share it for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information: You can limit the use of sensitive personal information to purposes necessary to provide the services.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

11.2 How We Collect and Use Information

In the preceding 12 months, we have collected the following categories of personal information: identifiers (name, email, IP address), commercial information (subscription history, transaction data), and internet activity (usage logs, API activity). We collect this information for the business purposes described in Section 4 of this policy.

11.3 Exercising Your California Rights

To exercise your California privacy rights, contact us at support@flexportal.io. We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf.

11.4 Do Not Track and Global Privacy Control

Our Platform does not currently respond to "Do Not Track" browser signals. However, we honor Global Privacy Control (GPC) signals as a valid opt-out request under California law. If your browser sends a GPC signal, we will treat it as a request to opt out of the sale or sharing of personal information.

12. Marketing Communications

We may send you marketing communications about our products, services, and updates if you have opted in or where permitted by applicable law. You can opt out of marketing communications at any time by:

• Clicking the "unsubscribe" link in any marketing email
• Contacting us at support@flexportal.io
• Updating your communication preferences in your account settings

Please note that even if you opt out of marketing communications, we will still send you transactional messages related to your account, such as billing notifications, security alerts, and service updates.

13. Children's Privacy

FlexPortal is a B2B platform intended for use by businesses and their authorized representatives. We do not knowingly collect personal data from children under 16 years of age. If you believe we have inadvertently collected data from a child, please contact us immediately at support@flexportal.io.

14. Data Processing Agreement

For Enterprise customers, we offer a Data Processing Agreement (DPA) that provides additional contractual commitments regarding our processing of End Customer Data, including:

• Detailed processing instructions
• Sub-processor list and notification procedures
• Security measures and audit rights
• Data breach notification procedures
• Standard Contractual Clauses for international transfers

To request a DPA, please contact us at support@flexportal.io.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes:

• We will update the "Last updated" date at the top of this policy
• We will notify you via email or through the Platform for significant changes
• We will provide at least 30 days' notice before changes take effect for material changes affecting your rights

We encourage you to review this policy periodically to stay informed about how we protect your data.

16. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: support@flexportal.io

Mailing Address:
Adam Development AB
Björkrisvägen 6A
702 34 Örebro
Sweden