Flank privacy & data

Flank acts as a data processor on behalf of its customers (who are the data controllers) for personal data submitted to or processed through the platform.

Name — of admin users and chat users, to personalise the experience and facilitate communication

Email address — for authentication, account management, and service communications

Job Title (optional) — to manage user permissions and access within the platform

Technical data such as IP address, browser type, and device information

Log data, including login times, feature usage, and system events

User-generated content: Any data entered into free-text fields by users when using the platform.

Providing and operating the platform Account data, usage data Art. 6(1)(b) GDPR — performance of a contract

Analysing usage to improve the product Anonymised usage data Art. 6(1)(f) GDPR — legitimate interests in improving our services

Compliance with legal obligations As required Art. 6(1)(c) GDPR — legal obligation

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law.

Where personal data is transferred to a country without an EU adequacy decision, we rely on: Standard Contractual Clauses (SCCs) under Art. 46 GDPR

A full and up-to-date list of sub-processors is maintained in our Data Processing Agreement (DPA) .

For customers who use Flank to process personal data on their behalf, a Data Processing Agreement is available at https://www.flank.ai/legals/dpa .

Customers may also request earlier deletion in accordance with our DPA.

Right of access — to obtain a copy of the personal data we hold about you

Right to erasure — to request deletion of your personal data

Right to data portability — to receive your data in a structured, machine-readable format

Right to object — to processing based on legitimate interests

We do not sell or rent personal data.