1. Data controller
The controller for personal data processed through Flap Studio AI is Ángel Martínez García, trading as Flap Studio AI, with address at Carrer Pablo Picasso 3, 03660 Novelda (Alicante), Spain, and contact email info@flapstudioai.com.
2. Data we process
We process the data needed to provide the service and manage the relationship with each user:
- Account and identification data: email address, name, and basic profile data when available. For the waitlist, we process the email address and professional profile you provide to manage early access.
- Security data: temporary technical connection signals used to prevent abuse and protect public forms.
- Billing and subscription data: plan status, customer and subscription identifiers, billing history, and metadata needed to operate Stripe.
- Usage and support data: credit consumption, generated assets, feedback, and service or support communications.
- Generation records for support and incident review: new prompts are retained for 7 days, without result thumbnails. Earlier records retain their original expiry, up to 30 days. Content becomes inaccessible at expiry and is deleted in batches during hourly maintenance. Only the owner administrator can view it through the application. Operation, model, usage and receipt records are retained separately. This audit record does not retain input images or full-resolution results. Separately, Multiview keeps the full result in private storage for 24 hours for connection recovery; only the requesting account can retrieve it. It becomes inaccessible at expiry, and expired files are removed in batches during maintenance triggered by application use.
- User content: prompts, images, references, masks, and any other material submitted by the user for processing.
3. Purposes and legal basis
We process personal data for the following purposes and legal bases:
- Providing the service, authenticating access, and executing requested generations: performance of a contract or pre-contractual measures.
- Managing payments and subscriptions: performance of a contract. Meeting tax, accounting and invoicing duties: compliance with legal obligations. Preventing fraud, abuse and unauthorized access: our legitimate interest in protecting the service and, where applicable, compliance with legal obligations.
- Handling support, incidents, and data protection requests: legitimate interest and, where applicable, compliance with legal obligations.
- Managing non-essential cookies or similar technologies if enabled in the future: user consent.
4. Recipients, processors and independent controllers
We do not sell personal data. We share only the information needed to provide the service, comply with legal duties and protect the platform. A provider's role depends on the specific processing activity.
- Stripe, for Checkout, payments, subscriptions, invoicing, taxes, fraud prevention and the customer portal. Depending on the activity, Stripe may act as our processor or as an independent controller for its own regulatory, security, fraud-prevention and service purposes. Card details are entered in Stripe's environment; Flap Studio AI does not store the full card number or CVC. Stripe's privacy policy is available at stripe.com/privacy.
- Supabase, for authentication, database storage, and operational persistence.
- OpenAI, Google Cloud and fal.ai (Multiview), to process prompts, images, DXF plans and other references for requested generations. Avoid unnecessary personal or confidential data.
- Resend or equivalent transactional email providers, to send access codes and service communications.
5. International transfers
Some providers may process data outside the European Economic Area. When this happens, we rely on appropriate safeguards under applicable law, such as standard contractual clauses, adequacy decisions, or equivalent transfer mechanisms made available by those providers.
6. Retention
We keep personal data only for as long as needed to provide the service, maintain security, address incidents, comply with legal obligations, and defend potential claims. Account and billing records may be kept for the duration of the contractual relationship and for applicable statutory retention periods; operational records and content are retained only for as long as needed for their purpose. Stripe and other providers acting as independent controllers may retain certain data for periods required by their own legal obligations. History saved in this browser remains on the device until you delete it or clear site data. AI providers may retain security logs under their terms: disabling response storage does not guarantee zero retention. Rights requests are recorded for handling and the defence of legal claims.
7. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction, and portability at /rights or by contacting info@flapstudioai.com. We normally respond within one month; any lawful extension will be communicated within that month. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing. Where a provider such as Stripe acts as an independent controller for particular processing, some rights may also need to be exercised directly with that provider.
8. Complaints and security
If you believe your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (AEPD) or the competent supervisory authority. We apply reasonable technical and organizational measures to protect the confidentiality, integrity, and availability of the data we process.