This Privacy Policy explains how Flex Line collects, uses, shares, and protects your information.

1. Information we collect

Account data: name, email, profile photo (from Google OAuth)
Billing data: handled by Stripe; we store only your plan and subscription status, never card numbers
Communications: SMS/MMS messages and call logs you send or receive through Flex Line — stored encrypted in our database
Voicemail audio: stored in our secure object storage; transcribed via OpenAI Whisper
Usage data: pages visited, features used, basic analytics

2. How we use your information

To operate Flex Line: provisioning phone numbers via Twilio, routing SMS and voice, sending transactional emails via Resend, processing payments via Stripe, and providing customer support. We do not sell your personal data to third parties.

3. SMS data handling (10DLC compliance)

No mobile information shared with third parties. Message content, opt-in data, and consent will not be shared, sold, or transferred to third parties for promotional or marketing purposes. Information sharing is limited to: (a) Twilio, for message delivery; (b) law enforcement when legally required; (c) you and your account.

Reply STOP to any message to revoke consent. Your opt-out is honored permanently unless you reply START to re-subscribe.

4. Sub-processors

Twilio — SMS, MMS, voice, voicemail, number provisioning
Stripe — payment processing
Resend — transactional email delivery
Google (OAuth) — authentication
OpenAI (Whisper) — voicemail transcription only; audio is not used for model training
MongoDB / Emergent — application database and hosting

5. Your rights (CCPA / GDPR)

You may request a copy of, correction to, or deletion of your data at any time by emailing info@flexlines.store. We respond within 30 days. EU users can also contact their local data protection authority.

6. Data retention

We retain account and communications data while your account is active. Upon account deletion, your data is purged within 90 days, except where retention is legally required (e.g., billing records for 7 years per IRS rules).

7. Security

All traffic is encrypted in transit via TLS. Session tokens are stored as httpOnly secure cookies. Stripe handles all card data under PCI DSS. We do not retain Twilio Auth Tokens or Stripe secret keys in client-side code.

8. Contact

Privacy questions: info@flexlines.store