Privacy Policy

1. Who we are

Flaplist is developed and operated by Redefine v/Morten Bang Justesen, CVR 30270444, Denmark. We are subject to the General Data Protection Regulation (GDPR) and act as the data controller for the personal data we process about our users.

If you have questions about this policy or your personal data, contact us at: privacy@flaplist.com

2. What data we collect

When you create an account, we receive basic profile information from your chosen identity provider (such as Google or GitHub) — typically your name, email address, and profile picture. We use this to identify your account and send service-related messages when needed.

Content you create — lists, items, checklist runs, and activity history — is stored and associated with your account. Flaplist is not intended for the storage of sensitive data or specially confidential personal data, and customers must not use the platform to store national identification numbers, health data, criminal offence data, payment card data, or similar information.

We use Swetrix for analytics. Swetrix does not use cookies and does not track you across sites. It processes anonymised page views and error events only. No identifying information about you is passed to Swetrix.

We do not use cookies. Your authentication session is stored in your browser's local storage, which is technically necessary for the app to work. This data stays on your device.

The service is intended for users aged 15 and above. We do not knowingly collect personal data from children under 15.

3. Why we collect it

We process your data for the following purposes and on the following legal bases:

• To provide and maintain the service — performance of a contract.
• To send important account and service notifications — legitimate interest.
• To understand usage and improve the service — legitimate interest. We rely on anonymised analytics that cannot identify you.
• To prevent fraud and ensure security — legitimate interest.

We do not process your data for advertising, profiling, or sale to third parties.

4. How long we keep your data

We keep your account and content data for as long as your account is active. When you delete your account, your personal data is scheduled for permanent deletion within 30 days.

List content may be held briefly after deletion to allow for accidental recovery. It is fully and permanently deleted within 30 days of account deletion.

5. Who we share it with

We do not sell or rent your personal data. We use a small number of third-party services to operate Flaplist:

• Logto — our authentication provider, which handles sign-in with Google, GitHub, and other methods.
• Swetrix — our analytics provider. Only anonymous, aggregated data is processed.
• Our hosting provider — your data is stored on servers located within the European Union.
• EUrouter B.V. and selected model providers — external processing for optional AI requests. See section 5.1 for activation, data and routing controls.

We must establish a lawful basis and appropriate data protection terms for providers’ processing. The AI provider information below is not, by itself, evidence of an executed data processing agreement or a valid transfer mechanism.

5.1. Optional AI features through EUrouter

AI is chosen inside Flaplist. It is off by default for organizations and can be enabled by an owner or administrator under organization administration → AI features. This also applies to lists shared with the organization. For personal lists with no organization connection, the user starts processing by sending an Ask AI request. Creating an account or buying a subscription does not start AI processing by itself.

Ask AI sends the request, clarification replies and relevant list content to EUrouter. This may include titles, notes, folders, dates, completion status, visible creator and assignment details, technical user and item references, and names, owner and workspace details for relevant destination lists. Content from up to two public links may be included. Images, attachments and recorded answer values are not automatically included.

AI in form analytics uses selected statistical findings, field names and reference data for explanations. Raw form answers and respondent names are not included in those explanations. View suggestions use the user’s description and the selected fields’ names and settings. Free text and field names may still contain personal data. Fields can be excluded from AI when editing the form.

AI requests are sent to EUrouter B.V. in the Netherlands, which forwards them to a model provider. EUrouter selects a provider that meets Flaplist’s processing requirements.

Flaplist selects an AI route based on the task, so EUrouter may use different models for list edits, explanations and analysis views. All requests require EU processing, no retention of requests or responses by the model provider, and no use of that content for training. These requirements also apply when changing models or providers. Requests must be rejected if the requirements cannot be met.

Enabling AI does not replace a lawful basis for processing personal data. The lawful basis, provider roles and applicable data processing terms must be established before personal data is used. Any transfers outside the EU/EEA must have a valid transfer mechanism. Do not send sensitive or confidential information to AI.

EUrouter states that request and response content is not stored after processing by default. API metadata is normally retained for up to 12 months and error and monitoring data for up to 90 days. Security or legal needs may require longer retention. Metadata may include timestamps, model IDs and usage. Deleting data in Flaplist does not automatically delete this metadata.

An organization owner or administrator can turn AI off in the same place. This stops new requests, cancels queued work and removes stored AI outputs held by Flaplist; active calls are aborted where possible. Previously saved list changes are kept. Turning AI off cannot recall data already sent to EUrouter. Lists, forms and regular analytics can be used without AI.

Read more:

• EUrouter privacy policy
• EUrouter terms of use
• EUrouter data processing agreement and sub-processor list
• Flaplist data processing agreement for AI

Chat agents you connect

When you connect an external chat agent through MCP, you choose the lists and actions the connection may use. Signing in alone does not grant access to your lists. Flaplist stores the client, permissions, expiry and audit history; it does not store the agent’s access or refresh tokens.

Content the agent retrieves from your selected lists is sent to your chosen chat provider. The provider’s processing and retention follow its own terms and privacy policy. Read them before connecting the client.

You can restrict or revoke a connection in Settings → Chat agents, including after downgrading to Free. Revocation stops future access but does not delete content already retrieved by the chat provider.

6. Your rights

Under GDPR, you have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — ask us to correct inaccurate information.
• Erasure — request that we delete your data.
• Portability — receive your data in a portable format. You can export your data directly from the platform.
• Restriction — ask us to temporarily limit the processing of your data.
• Objection — object to certain types of processing.

To exercise any of these rights, contact us at privacy@flaplist.com. We will respond within 30 days.

You also have the right to file a complaint with the Danish Data Protection Agency (Datatilsynet) at www.datatilsynet.dk.

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you (GDPR Article 22).

7. Changes to this policy

We may update this policy from time to time. When we do, we update the date at the top of this page. If we make significant changes, we will notify you via the app or by email.

Your continued use of Flaplist after changes are published constitutes acceptance of the updated policy.

8. Contact

For questions about your data or this policy, reach us at: privacy@flaplist.com