Privacy Policy

1. Who we are

Flout Ltd, trading as Flout Labs, is a company registered in Ireland (company number 617498) with its registered office at Cave, Clarinbridge, Co. Galway, Ireland.

Privacy contact: privacy@floutlabs.com
General contact: admin@floutlabs.com

2. Data we collect

We collect the following categories of personal data:

• Account data — your name, email address, password (stored only as a secure hash), workspace and team membership, and account preferences.
• Content you add — the stax, projects, goals, dates, people, next actions, records, notes, and other material you or your connected agents create in the Service. This may include personal data about other people (for example, a colleague’s name or email address).
• Agent and integration data — instructions you give to agents, the actions agents take on your behalf, audit-log entries, and the access tokens or identifiers needed to connect third-party tools you choose to link (such as AI assistants, MCP clients, or messaging apps).
• Billing data — your plan, billing address, and payment history. Card details are collected and stored by our payment processor, Stripe; we never see or store your full card number.
• Technical and usage data — IP address, browser and device type, log files, timestamps, error reports, and how features of the Service are used.
• Communications — messages you send us, support requests, and feedback.

3. How we use data and our legal bases

Under the EU General Data Protection Regulation (GDPR), we rely on the following legal bases:

• To provide the Service (performance of a contract) — creating your account, storing and syncing your content, running agents you instruct, connecting the integrations you enable, and providing support.
• To take payment and keep financial records (contract and legal obligation) — processing subscriptions and meeting Irish tax and accounting requirements.
• To keep the Service secure and reliable (legitimate interests) — preventing abuse and fraud, debugging, monitoring performance, and enforcing our Terms of Service.
• To improve the Service (legitimate interests) — understanding, in aggregate, which features are used so we can make them better.
• To send service messages (contract) — account verification, security alerts, billing notices, and important changes. Product news is sent only where you have consented or where permitted by law, and you can unsubscribe at any time.
• To comply with the law (legal obligation) — responding to lawful requests from authorities and exercising or defending legal claims.

We do not sell your personal data, and we do not use it for third-party advertising.

4. AI and agent processing

HeyStax uses large language model providers to power agents and AI-assisted features. When you ask an agent to act, the relevant parts of your content and instructions are sent to the AI provider to generate a response. We use these providers under commercial terms that do not permit them to use your content to train their general models, and we do not use your content to train AI models of our own.

When you connect HeyStax to a third-party AI assistant or MCP client (for example Claude, ChatGPT, Cursor, or Codex), that client can read and write the stax you authorise. Data you share with a third-party client is also governed by that provider’s own privacy policy.

Agents may take actions you request, such as drafting or sending messages. Every agent action is recorded in your audit log so you can see what happened and when.

5. Who we share data with

We share personal data only with service providers that help us run the Service, under written contracts that require them to protect it and use it only on our instructions. These include:

• Supabase — database, authentication, and file storage
• Vercel — website and application hosting
• Stripe — payment processing and subscription billing
• Resend — transactional email delivery
• Anthropic and other AI model providers — agent and AI features
• Google — web fonts loaded on heystax.ai
• YouTube (privacy-enhanced mode) — embedded product videos

We may also disclose data to professional advisers, to a buyer or successor in the event of a merger or sale of the business (subject to this policy), or where required by law or to protect the rights, property, or safety of our users or others. Other members of your team or workspace can see content you share with them.

6. International transfers

Some of our service providers are located, or process data, outside the European Economic Area (EEA), including in the United States. Where we transfer personal data outside the EEA, we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses, together with additional safeguards where appropriate.

7. How long we keep data

• Account data and content are kept for as long as your account is active.
• If you delete your account, we delete or anonymise your content within 30 days, except where we must keep it for legal reasons. Encrypted backups are overwritten within a further 90 days.
• Billing and tax records are kept for 6 years, as required by Irish law.
• Security and server logs are generally kept for up to 12 months.

8. Cookies and similar technologies

The heystax.ai marketing website does not use advertising or cross-site tracking cookies. Loading the site sends your IP address to Google to serve web fonts, and playing an embedded video loads content from YouTube in privacy-enhanced mode.

The HeyStax app uses strictly necessary cookies and local storage to keep you signed in and remember your settings. These are required for the Service to work and do not require consent. If we introduce optional analytics cookies, we will ask for your consent first.

9. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• have your data erased;
• restrict or object to our processing, including processing based on legitimate interests and any direct marketing;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, email privacy@floutlabs.com. We will respond within one month. We may need to verify your identity before acting on a request.

You also have the right to complain to the Irish Data Protection Commission (www.dataprotection.ie) or to the supervisory authority where you live. We would appreciate the chance to address your concern first.

10. Personal data you add about others

If you add information about other people to HeyStax, such as contacts or colleagues, you are responsible for making sure you are entitled to do so. Where you use HeyStax on behalf of an organisation, that organisation may be the controller of that data and we process it on its behalf. Contact us at privacy@floutlabs.com if you need a data processing agreement.

11. Security

We use industry-standard measures to protect personal data, including encryption in transit (TLS) and at rest, access controls, row-level security in our database, and audit logging. No system is perfectly secure. If we become aware of a personal data breach that affects you, we will notify you and the Data Protection Commission as the law requires.

12. Children

The Service is not intended for anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows when it last changed. If we make material changes, we will notify you by email or in the Service before they take effect.

14. Contact us

Flout Ltd
Cave, Clarinbridge, Co. Galway, Ireland
Privacy: privacy@floutlabs.com
General: admin@floutlabs.com