Privacy policy

How the relay works

• Nothing is sent to flitagent.com until an administrator clicks Connect in FlitAgent → Connect.
• After that, the plugin fetches our public signing keys about once a day.
• Your AI app reaches your site through flitagent.com. Tool calls and their results pass through and are not stored, though they can contain personal data from your site.
• Your AI app sends what it reads to its own provider, such as OpenAI or Anthropic, under that provider’s terms.

What we collect

• Your account: your email address, a password hash and when you signed up.
• Connected sites: the address, the access you chose, the site’s name and versions, connection dates and the last error. We never hold a password or token that can log in to your site.
• Connected AI apps: each app’s name, the addresses it registered, dates and its tokens.
• Usage: for each tool call, the account, site, app, tool, outcome, time taken and sizes. No arguments, results or IP addresses.
• Payments: Paddle sends us your customer and subscription IDs, your plan, its status and payment notices. We never store your full card details.
• Messages and newsletter: contact form messages, and your newsletter sign-up and consent.
• Downloads: a daily count per version, not who downloaded.

How long we keep it

• Tool calls and their results: not stored
• Usage records: 90 days
• Daily usage totals: 25 months
• Payment notices from Paddle: 90 days after we process them
• Contact form messages: 12 months
• Abuse-limit data (hashed IP and email addresses): about a day
• Unconfirmed newsletter sign-ups: 7 days
• Unconfirmed site connections: 24 hours
• Unverified accounts: 30 days without a login
• Your account, sites and subscription record: until you delete your account

Why we use it

• To run the service and bill a paid plan (contract).
• To keep the service secure and limit abuse (legitimate interests).
• To keep payment records as tax law requires (legal obligation).
• To send the newsletter, only with your consent, which you can withdraw at any time.

Who else handles it

• Paddle, our Merchant of Record, collects your payment details, billing address and tax information under its own privacy notice.
• Hostinger, our host and email provider, runs flitagent.com, delivers our emails from hello@flitagent.com and keeps standard server logs, including IP addresses and browser details.
• Your AI app’s provider receives what your AI app reads from your site.

These providers may handle your data in other countries. Where they do, they use their own data protection terms, such as the EU’s Standard Contractual Clauses.

Emails

We send only the emails your account needs, and the newsletter if you subscribe. The newsletter is double opt-in, goes out weekly or every two weeks, plus release notes and urgent notices, and has a one-click unsubscribe. Our emails carry no tracking pixel.

Cookies

• No analytics cookies, and nothing loaded from other sites, except Paddle.js on checkout and Update payment method. Paddle may set its own cookies there.
• Logged in: the WordPress session cookies, kept for 14 days if you tick Keep me logged in.
• Logged out: only flit_connect and flit_oauth (10 minutes, while you connect a site or allow an AI app) and __Host-flit_verify (one day, while you verify your email).

Your rights under GDPR and other privacy laws

Wherever you live, you can ask us to:

• show you the personal data we hold about you, or send you a copy
• correct it if it’s wrong
• erase it
• stop or limit how we use it

Email hello@flitagent.com to make a request. We answer within one month. Erasing cancels a paid plan at once, so ask for any refund first. If you’re in the EU or UK, you can also complain to your local data protection authority.

Your controls

• From your account you can disconnect a site or remove an AI app’s access. Deleting the FlitAgent plugin from a site also disconnects it.
• From your profile you can change your email or password, log out everywhere or delete your account.

Security

We use HTTPS, hashed passwords and access limited to us. Requests to your site are signed with our key, and your site checks each one.

Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. If you keep using FlitAgent after a change takes effect, the updated policy applies to you.