Privacy Policy

1. Information we collect

We may collect information that you choose to provide, including:

• your name
• business name
• email address
• phone number
• website
• social media links
• details about your business
• details about your enquiry
• messages, form submissions, walkthrough requests, booking requests, or project information
• any other information you send to Flint

We may also collect limited technical information needed to operate, secure, understand, and improve the website, such as device and browser information, pages visited, approximate location derived from technical data, IP address, referral source, cookie or analytics information where used, and error or security logs.

2. Client service information

Where Flint provides or discusses services with a client, we may process information relating to that client's business operations, including website content, event, retreat, service, booking, or product information, customer enquiries, booking and payment-related records, email and communication history, customer messages, reviews, review drafts and responses, Google Business Profile information, Facebook Page information, Instagram professional account information, Messenger-related information, social content drafts, captions, images, assets and publish history, Telegram operator messages and workflow records, and audit logs of actions requested, approved, published, sent, updated, failed, or disconnected.

3. Connected accounts and API integrations

Flint may allow authorised clients to connect third-party business accounts and services to Flint, including Google Business Profile, Google services, Facebook Pages, Instagram professional accounts, Messenger, Meta business assets, Stripe, booking systems, email services, Telegram, analytics tools, hosting providers, automation tools, AI tools and model providers, and other business platforms used to provide Flint services.

Where a client chooses to connect one of these services, Flint may receive and process information made available through that service's authorised API, login, OAuth, or connection flow.

Depending on the integration, this may include business profile information, page, account, location, or profile identifiers, account names, usernames, public profile details, connected location or profile details, post, caption, image, review, comment, message, engagement, booking, customer enquiry, or communication data, access tokens or authorisation credentials, and logs showing actions requested, approved, published, sent, updated, failed, or disconnected.

Flint only accesses connected account data where the business owner, account admin, or authorised user has granted permission through the relevant platform's authorisation process or has otherwise instructed Flint to support that business account.

4. How we use information

We use personal information and client information to respond to enquiries, review whether Flint is a fit for a business, provide, support, and improve Flint services, create and manage websites, content, bookings, and client workflows, connect and maintain authorised third-party integrations, display integration status, support Google Business Profile, Facebook Page, Instagram, Messenger, website, booking, review, customer communication, and operational workflows, generate drafts and recommendations, support client-approved publishing or account actions, send service communications, process payments or booking-related activity where applicable, maintain audit logs, troubleshoot issues, secure Flint systems, prevent misuse, keep records for legal or business purposes, and improve Flint's website, services, workflows, and client experience.

Flint does not sell personal information or connected account data.

5. AI-assisted workflows

Flint may use AI-assisted tools, including Hermes-style operator workflows, to help generate drafts, summaries, content ideas, images, captions, responses, recommendations, operational suggestions, and workflow outputs.

AI-assisted workflows are designed to support authorised businesses, not replace human responsibility.

Important actions, such as publishing social content, sending customer communications, changing profile information, or taking actions on connected third-party accounts, should be subject to client approval or client-configured permissions before they are completed.

Clients remain responsible for checking that any content, image, offer, claim, price, date, event detail, review response, customer message, or business update is accurate, lawful, appropriate, and suitable for their business before use or publication.

6. Google Business Profile data

If a client connects a Google Business Profile or related Google service, Flint may use authorised Google data only to provide client-approved business profile, location, review, visibility, communication, reporting, and operational workflows.

This may include viewing business profile or location details, helping keep business information accurate, monitoring profile status or operational signals, supporting review workflows, drafting or managing client-approved updates, and recording actions and errors for audit and support.

Flint's use of Google data is limited to the purposes described in this Privacy Policy and the permissions granted by the authorised user.

Flint does not sell Google user data. Flint does not use Google user data for unauthorised advertising, unrelated profiling, scraping, spam, fake engagement, or unmanaged bulk activity.

7. Meta, Facebook, Instagram, and Messenger data

If a client connects Facebook, Instagram, Messenger, or other Meta business assets, Flint may use authorised Meta data only to provide client-approved social publishing, messaging, engagement, profile, content, customer communication, and operational workflows.

This may include finding authorised Facebook Pages, finding linked Instagram professional accounts, displaying connected account status, preparing social content drafts, publishing approved Facebook or Instagram content, supporting approved Messenger or customer communication workflows, reading or managing engagement where authorised, and recording publish, message, and workflow logs for audit and support.

Flint does not use Meta platform data for scraping, fake engagement, spam, unauthorised posting, unmanaged bulk activity, or misleading behaviour.

Clients can disconnect Meta integrations or request deletion of related data using the process described on our Data Deletion page.

8. OAuth tokens and account credentials

Where Flint connects to a third-party service, Flint may store access tokens, refresh tokens, or similar credentials needed to operate the integration.

These are used only to provide the authorised integration and should be stored securely server-side.

Clients can request disconnection of an integration at any time. Disconnecting an integration may stop Flint from accessing, updating, publishing to, or otherwise operating that connected service.

9. Lawful basis for using personal information

Depending on the situation, Flint may use personal information on one or more of the following lawful bases:

• legitimate interests: to respond to enquiries, operate the business, provide and improve services, maintain security, keep records, and support client operations
• contract: where processing is needed to provide a service, take steps before entering into a contract, or deliver agreed client work
• consent: where consent is specifically required, such as for certain cookies, optional marketing activity, or optional connected workflows
• legal obligation: where processing is needed to comply with legal, tax, accounting, regulatory, or other legal requirements

10. Client and contact form submissions

If you submit a contact request, walkthrough request, or enquiry, we use that information to respond to you and follow up on the request.

We do not publish your submission. We only share it where needed to operate the website, send communications, process payments, support services, or protect Flint from misuse.

11. Cookies and analytics

Flint may use cookies or similar technologies for site operation, security, analytics, and service improvement.

Where non-essential cookies or analytics are used, they should be used in line with the choices you make through any cookie banner or settings shown on the site.

Analytics, where used, are intended to help us understand website performance, interest in Flint, and how to improve the service. Flint does not sell website analytics data.

More information is available in our Cookie Policy.

12. Third-party service providers

Flint may use third-party providers to operate and support its services. These may include providers for website hosting, databases and storage, analytics, payments, email delivery, forms and communications, booking and automation tools, Google services, Meta services, Telegram, AI tools and model providers, security, monitoring, and development tools.

These providers may process information on our behalf or as independent providers under their own terms, privacy notices, and security practices.

More information is available on our Subprocessors page.

13. Data sharing

We may share information where reasonably necessary to provide Flint services, operate authorised integrations, process payments, deliver emails, messages, booking confirmations, or notifications, host, store, secure, and maintain systems, comply with legal, accounting, tax, or regulatory obligations, protect Flint, clients, users, or connected systems from misuse, resolve disputes, or enforce agreements.

We do not sell personal information.

14. Data retention

We keep personal information and client information only for as long as reasonably necessary for the purpose it was collected, including to respond to requests, provide services, maintain service and project history, operate connected integrations, support audit, security, and troubleshooting needs, meet legal, accounting, or tax obligations, resolve disputes, enforce agreements, and protect Flint, clients, users, or connected systems from misuse.

When information is no longer needed, we aim to delete it or keep it in a form that no longer identifies you.

15. Security

We aim to use reasonable technical and organisational measures to protect information handled by Flint.

These may include access controls, server-side token handling, environment variables for secrets, scoped client data, audit logs, and sensible operational controls.

No online service can guarantee perfect security. Clients and users should also protect their own accounts, passwords, devices, and third-party platform access.

More information is available on our Security page.

16. International processing

Some third-party providers used by Flint may process or store information outside the United Kingdom or European Economic Area.

Where this happens, Flint aims to use providers and arrangements that are appropriate for the services being provided.

17. Your rights

Depending on your location and the circumstances, you may have rights to request access to the personal information we hold about you, request correction of inaccurate information, request deletion of your information, request restriction of processing, object to certain processing, request transfer of your information where applicable, and withdraw consent where processing is based on consent.

To make a request, email: hello@flintai.co.uk

We may need to verify your identity or authority before acting on a request.

18. Data deletion

You can request deletion of personal information or connected account data by following the instructions on our Data Deletion page.

Data deletion requests can be sent to: hello@flintai.co.uk

19. Complaints

If you have a concern about how Flint handles personal information, please contact us first and we will try to resolve it.

If you are in the UK, you may also have the right to complain to the Information Commissioner's Office.

20. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in Flint's services, legal requirements, connected integrations, or how our systems operate.

The latest version will be published on this page.