Privacy Policy

• Controller: Ubani LTD, 348A St Albans Road, Watford, UK, WD24 6PQ, is the data controller for personal data processed through the Services.
• Contact: for any privacy question or request, email admin@tryflaris.com.

To plan content that fits a brand, the Services read information that businesses and people have made public. Some of it can identify a person. We collect:

• Business websites. When a user gives us a website, we read its public pages: text, images (which can include photos of the business’s staff or premises), products, prices, and reviews published on the site, including the reviewer’s name as published.
• Competitors. We search the web for a brand’s competitors and read their public websites, the social profiles they link to, and their ads in Meta’s public Ad Library (the ads’ copy, images or video, and transcripts). Ads can show the people who appear in them.
• Audience research. We read public posts and comments (for example, on Reddit) and public reviews (on review sites and on a brand’s own product pages) to learn how customers describe their problems. We keep short excerpts and where they came from, not the author’s profile.
• Public social posts. Our viral content library holds public TikTok and Instagram posts (the creator’s handle and follower count, the caption, hashtags, engagement figures, a cover image, and for some posts a transcript). When a user gives us a link to a public post or ad to use as a reference, we download it to analyse it.

Why, and on what basis. We use this information to plan and make on-brand content for our users: to understand a business, its market and its customers. We rely on legitimate interests (ours, and our users’ in marketing their business). We do not use it to contact, profile or target the people it is about.

No stranger quoted. Content the Services make does not present a stranger’s post as a quotation or testimonial: research informs the wording, but our checks reject copy that prints it in quote marks. The only reviews the Services may quote are reviews of the user’s own business, with the attribution as it was published. These checks are automated, and the user approves every post before it is published.

Your rights. If you think we hold information about you this way, you can ask us what we hold, object to its use, or ask us to delete it, by emailing admin@tryflaris.com with the page, post or handle concerned. Unless we have a compelling reason to keep it, we remove it from the Services and stop using it. You can also complain to the Information Commissioner’s Office.

• Provide and operate the Services — researching your brand and market, generating content from your Input, saving and organizing your projects, and publishing or scheduling the content you approve to your connected accounts.
• Personalize your experience, including suggesting content and improving outputs based on your brand and preferences.
• Process payments, manage subscriptions and credits, and send service messages and the notifications you have not turned off.
• Measure performance, debug, secure the Services, prevent abuse (including of the free sample), and improve our features.
• Comply with legal obligations and enforce our Terms of Service.

Legal bases (UK/EEA): we rely on contract (to provide the Services), consent (browser notifications, analytics and session replay cookies for visitors who are not signed in, and Meta advertising measurement), legitimate interests (product improvement, analytics of signed-in use, which you can turn off in Settings, security, preventing abuse, and researching public information to plan content), and legal obligation.

To generate Output, your Input is processed by AI models operated by third-party AI providers (listed under Our service providers). This means your prompts, uploaded media and brand information are transmitted to those providers to fulfill your request.

Model training: we do not use your content to train our own AI models. Each provider processes it under its own terms, including its terms on data retention and model training, which we do not control. Where we have set a provider to no retention and no training, the list of providers says so. We may use aggregated or de-identified data to operate, secure, and improve the Services.

We use the access you grant to connected accounts only to provide the features you request — publishing and scheduling the posts you approve, and reading the performance of posts published through Flaris. The platform’s access tokens are held by our publishing partner, Post For Me, not by Flaris. When Post For Me tells us about a change to an account, we keep only the account’s Post For Me ID, its ID on the platform, the platform, its status, its username, and when it was last updated.

You can disconnect a social account at any time in the app, which disconnects it at Post For Me, or revoke access from within the relevant platform. Disconnecting stops our future access to that account.

We do not sell your personal data. We share data only with:

• Service providers (subprocessors): the vendors listed under Our service providers, which process data on our behalf to run the Services.
• Social platforms: the platforms you connect, when we publish the posts you approve or retrieve their performance.
• Legal & safety: to comply with law, enforce our terms, or protect the rights, safety, and security of Flaris, our users, and the public.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

These providers process personal data on our behalf to run the Services. Where a region is shown it is where that provider receives the data; otherwise the provider may process it in the United States, the UK, the EEA or elsewhere (see International data transfers).

• Supabase: database, sign-in, file storage and background functions, holding your account, content and project data.
• Vercel: hosting of our website and app, scheduled jobs, isolated sandboxes that render slides and read websites, and the AI Gateway that routes most requests to the AI model providers below.
• Railway: background workers that make content, run research and publish posts, and their job queues.
• OpenAI, Anthropic and Google (Gemini): AI language, vision and search-embedding models, called directly or through Vercel's AI Gateway, which receive your chat messages, briefs, brand information, uploaded images and video frames.
• Perplexity: web search for brand, competitor and audience research, through Vercel's AI Gateway.
• TypeSafe AI: a quality check on ad copy, set to no data retention and no training.
• fal.ai: image, video and audio generation from your prompts and the media they use, on models from developers such as OpenAI, Google, ByteDance and Kuaishou (Kling).
• Higgsfield: video generation, where we offer video, from prompts and reference images.
• ElevenLabs: voice generation from script text, for video features.
• Post For Me: our publishing partner, for connecting your social accounts, publishing and scheduling posts, and reading their performance.
• Stripe: payments and subscriptions, with your email, billing details and payment information.
• Resend: sending email, with your email address and the content of the emails we send you.
• PostHog (EU): product analytics and session replay (with your consent), and monitoring of AI requests (their text and replies, linked to your account).
• Sentry (US): error and performance monitoring, with your account ID, IP address, browser details and the request that failed.
• Meta: the Meta Pixel and Conversions API (with your consent), to measure our own advertising, as described under Advertising measurement.
• Apify: collecting public TikTok and Instagram posts for the viral library and for references you give us.
• ScrapeCreators: reading Meta's public Ad Library for competitor research.
• Telegram: if you link Telegram, carrying your messages and photos to our bot and our replies.
• Your browser's push service (for example Google, Mozilla, Apple or Microsoft): delivering browser notifications, if you turn them on, as encrypted messages.
• Discord: internal alerts to our team, which can include your email, plan and payment amount.

If you sign in with Google or Apple, that provider shares your name and email with us under its own privacy policy. The social platforms you connect receive the posts you publish to them.

• Work updates by email. We email you about your work: when a campaign is ready, when a piece needs something from you or fails, when credits run low, when a post publishes, fails or is held, when an account needs reconnecting, and when your plan is ending. You can turn these off with the unsubscribe link in each email or in Settings.
• Account emails. We also send emails you cannot turn off while you have an account, such as sign-in, security, billing and payment messages, and may send emails about getting started with Flaris. Any marketing email we send will carry a way to unsubscribe.
• Browser notifications. If you turn them on, we store your browser’s push subscription (an endpoint and its keys) and your browser type. You can choose which notifications you get, or turn them off, on the Integrations page or in your browser’s settings.
• Telegram. If you link Telegram, we can send updates and replies there. You can unlink it on the Integrations page.

We use essential cookies for things the Services need to work, such as keeping you signed in. When you are signed in, we measure how you use the Services with our product analytics service (PostHog) to fix problems and improve the service: the pages you see and what you click, including session replays (anything you type into a field is hidden). You can turn this off at any time under Settings, Product analytics. When you are not signed in, PostHog stores cookies and records replays only if you accept them in the cookie banner; if you decline, or have not answered, it counts your visit anonymously, with no tracking cookie or identifier stored on your device, from a hash of your connection that rotates daily. Separately, our servers send PostHog the text of requests to our AI models and their replies, linked to your account, so we can monitor quality, errors and cost; turning product analytics off stops this too, as it does every other event about you we would send PostHog from our servers. You can give or withdraw cookie consent at any time through the Cookie settings link on our website.

With your consent, we use the Meta Pixel and Meta’s Conversions API to measure our own advertising. The Conversions API sends Meta, from our servers, the fact that you signed up or subscribed, with a hashed email address and account ID, your IP address and browser details, and Meta’s browser identifiers (the _fbp and _fbc cookies). You can change your choice at any time through the Cookie settings link on our website, or control cookies in your browser settings.

We may transfer, store, and process your information outside your country, including in the United Kingdom, the EEA, and the United States. Where we transfer personal data from the UK/EEA to a country without an adequacy decision, we use appropriate safeguards such as the UK International Data Transfer Agreement and Standard Contractual Clauses.

• Your account and content are kept while your account is active. We do not delete inactive accounts automatically. Deleting a project in the app removes its generated media, and deleting a brand removes the research stored for it (images it imported may stay in your account until the account is deleted).
• Deleting your account. Email admin@tryflaris.com from the address on your account. We cancel any subscription, disconnect your social accounts at our publishing partner, and delete your account with its projects, chats, brands, content and files.
• What we keep after deletion: a record that your website has used its free sample (so a new account cannot claim it again), the billing and credit records we need for tax, accounting and disputes (Stripe keeps its own payment records as the law requires), and records of actions our team took on your account.
• Shorter periods we enforce automatically: the request data sent with each chat turn is cleared 90 days after the turn (the chat history itself stays with its project); detailed AI traces (prompts and tool data) are cleared after 30 days and deleted after 180 days; the raw Telegram updates we receive, and our queue of notifications, are deleted 7 days after we receive them once handled; and event messages from our publishing partner are deleted 30 days after we process them.
• Information about non-users (see above) that is stored with a brand is kept until the brand or the account is deleted. Our shared library of public posts and clips, and copies of public posts and ads used as references, are kept while they are useful to the Services, and removed when we accept a request to remove them.
• Our analytics, session replay and error-monitoring providers keep data for the periods set in our accounts with them. We may retain certain data longer where required to comply with law, resolve disputes, or enforce our agreements.

We use appropriate technical and organizational measures to protect personal data, including encryption in transit and at rest and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

The Services are not directed to children. You must be at least 18 to use Flaris, and we do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. We will post the updated version and revise the “Last updated” date, and provide additional notice where required.

For questions or requests about this Privacy Policy or your personal data, contact:

Ubani LTD
348A St Albans Road, Watford, UK, WD24 6PQ
Email: admin@tryflaris.com