Privacy notice

Flipsyd takes messages out of Slack and email and puts them on an ordinary phone as text messages. That means we handle your work messages, and it means this notice has to be specific rather than reassuring. Everything below describes how the service actually behaves.

1. Who we are

The controller of your personal data is TODOregistered company name (e.g. Flipsyd Technologies Ltd), a company registered in England and Wales with company number TODOCompanies House registration number, whose registered office is at TODOregistered office address, including postcode. We are registered with the Information Commissioner's Office under registration number TODOICO data-protection fee registration number (Zxxxxxxx).

For anything about your data, write to hello@flipsyd.app. We have not appointed a Data Protection Officer, because we are not required to; that address reaches the people who can act.

2. What we collect

Given by you

• Your mobile number. The one thing the service cannot work without. We verify it by sending a one-time code before anything else happens.
• Your country — worked out from your number's country code (you only choose it for +1 numbers, which the US and Canada share). It decides which local Flipsyd numbers you are given and the currency you are billed in.
• Your settings. Muted channels, whether you are paused, the short names you give people, whether overage is on, and whether you have set a call-in PIN (stored only as a salted hash).
• Your consent records. When you ticked the box agreeing to receive text messages, when you accepted the terms at checkout, and which version of the wording you saw each time.

Given by you when you connect an app

• Access and refresh tokens for Slack. These are encrypted with AES-256-GCM before they are written down, using a key held in AWS Systems Manager Parameter Store and itself encrypted with AWS KMS. They are only ever decrypted in memory to make a call on your behalf.
• Your Slack identifiers — your Slack user id and workspace id.

Created for you

• A Flipsyd email address, randomly generated — deliberately not derived from your phone number, so it cannot be reversed into one.
• Usage counters: credits used this cycle, messages sent, minutes of calling in. These are numbers, not content.

Message content

To do its job the service reads the messages you would have read yourself: the body, the sender's name, the channel or conversation name, the subject line on email, and the surrounding messages in a thread. Before any of that is stored, summarised or texted to you, it passes through a redaction step that strips things that look like credentials — private keys, API keys, access tokens — and replaces them with [redacted]. We log the name of the rule that fired, never the value it matched.

We never write message bodies, access tokens or contact email addresses into our logs. That is enforced in code, not just in policy.

Payment data

Card details go straight to Stripe and never reach our servers. We keep your Stripe customer and subscription identifiers, your plan, and your renewal date.

Data about other people

Messages sent to you contain personal data about your colleagues and correspondents — their names and what they wrote. We get this from your own Slack or email account, at your instruction, and we only ever see what you could already see: the permissions you grant at connection time are the ceiling. We do not use it to build profiles, we do not contact those people, and it is deleted on the schedule in section 5. Contacting every sender individually would be disproportionate under Article 14(5)(b) of the UK GDPR, so this notice serves as that information. If the account you connect belongs to your employer, check that you are allowed to forward its contents to your phone — that part is between you and them.

3. Why we are allowed to (lawful basis)

• Performance of a contract (Art. 6(1)(b)) — your number, your connected accounts, your message content and your usage counters. Without these there is no service to give you.
• Consent (Art. 6(1)(a), and Regulation 22 of PECR) — sending text messages to your phone. You give it at signup by ticking the box — we record when, and which version of the wording you saw — and you withdraw it at any time by replying STOP. Withdrawing does not affect anything we did beforehand.
• Legitimate interests (Art. 6(1)(f)) — keeping the service secure and available: rate limiting, deduplication, redacting secrets before they can leak to a handset, and investigating abuse. We have weighed this against your interests and think it is what any user would expect.
• Legal obligation (Art. 6(1)(c)) — keeping payment records for the period UK tax law requires.

We do not ask for special category data (Art. 9) and we do not look for it. A message you receive might happen to contain some; we do not treat it differently because we do not read or classify it beyond delivering it to you.

4. What we do with it

• Deliver @-mentions and direct messages to your phone as SMS.
• Hold the rest so you can pull it with *i or by calling your number, and read it back over the phone.
• Post your replies back into Slack or email under your own account.
• Shorten long messages so they fit a text message. On the Full plan, a message too long for one text is sent to Anthropic's Claude API to be summarised. It goes with the sender's display name and nothing else — no phone number, no account id, no billing data — and it goes after redaction. If that call fails we fall back to truncating the text ourselves, so nothing leaves on an error path.
• Count credits so we can bill you and warn you before you run out.
• Send you account notices: the 80% credit warning, billing problems, service changes.

There is no automated decision-making that produces legal or similarly significant effects (Art. 22). Summarising a message is not a decision about you.

We do not sell your data, we do not share it for advertising, and we do not use your message content to train any model of ours.

5. How long we keep it

The short version: message content is transient by design. It is buffered so the commands work, then it expires automatically.

Deletion of expired message content is automatic, run by the database itself rather than by a job somebody has to remember to schedule. Message content is never backed up. The account database is, on a rolling 35-day window, so we can recover from a fault; we never restore a backup to bring back an account someone deleted.

6. Who else sees it

We use a small set of sub-processors. Each one is contractually bound to process your data only on our instructions. The full table, with purpose and location, is on the sub-processors page; in summary:

• Amazon Web Services (AWS) — All hosting: compute, database, queues, object storage, secret storage, logging, and sending and receiving email on your Flipsyd address. (London, United Kingdom (eu-west-2))
• Anthropic — Summarising a long message into something that fits a text, on the Full plan only. (United States)
• Twilio — Sending and receiving SMS, running the inbound voice line, and sending the one-time code that verifies your phone number at signup. (United States and Ireland)
• Telnyx — Sending and receiving SMS and inbound voice calls on the UK and US number lanes. (United States and Ireland)
• Stripe — Taking subscription payments, holding your card details, and issuing refunds. (Ireland and United States)

Separately, the apps you connect are your own accounts rather than our sub-processors, and their own privacy policies apply to them:

• Slack — Reads the messages you can already see and posts your replies under your own account.
• Email — Mail sent to the Flipsyd address we generate for you arrives over standard SMTP.

We may also disclose data where we are legally required to, or to establish or defend legal claims. If we are ever acquired, your data would transfer with the business and you would be told before it did.

There is no analytics provider, no advertising network, no session-replay tool and no third-party error tracker on this site or in the service.

7. Sending data outside the UK

Everything we host runs in AWS's London region (eu-west-2). Your account record, your encrypted tokens, your buffered messages and your inbound email never leave the UK while they are in our hands.

Four sub-processors — Anthropic, Twilio, Telnyx and Stripe — process data in the United States or the EEA. Those transfers rely on the International Data Transfer Addendum to the EU standard contractual clauses (or, where the recipient is certified, the UK Extension to the EU–US Data Privacy Framework), together with the technical measures described here: encryption in transit throughout, encryption at rest for tokens, and sending the minimum content needed for the task. You can ask us for a copy of the relevant safeguards at the address above.

8. Security

• Access tokens are encrypted at rest with AES-256-GCM; the key never leaves AWS.
• Your sign-in session is an HttpOnly cookie, so a script injected into the page cannot read it. There is no token in local storage.
• All traffic is TLS-only; non-TLS access to our storage is refused outright.
• Every backend function runs with its own least-privilege role, holding only the permissions its code actually needs.
• Credentials in message bodies are stripped before storage, summarisation or sending.
• Logs are structured and never contain bodies, tokens or contact email addresses.

No system is perfect. If we suffer a breach that is likely to risk your rights and freedoms we will report it to the ICO within 72 hours and tell you without undue delay where the risk is high.

9. Cookies and browser storage

We use one cookie and a handful of local-storage keys. All of them are strictly necessary for a function you have asked for, so we do not show a consent banner — there is nothing here to consent to. We set no third-party cookies and no tracking pixels.

10. Your rights

Under the UK GDPR you can ask us to:

• Give you a copy of the personal data we hold about you, and tell you what we do with it (Art. 15).
• Correct anything inaccurate — a wrong number, a wrong country (Art. 16).
• Erase it (Art. 17). See below — this one has a button-sized answer.
• Restrict what we do with it while a dispute is resolved (Art. 18).
• Port it — receive it in a structured, machine-readable format, or have it sent to another provider where technically feasible (Art. 20).
• Object to processing based on legitimate interests (Art. 21).
• Withdraw consent to text messages at any time (Art. 7(3)) — reply STOP.

How to have your data erased

You can do it yourself: open your dashboard, scroll to Delete account, type DELETE to confirm, and it happens immediately. There is no ticket, no waiting period and nobody to talk you out of it. If you cannot get into your dashboard, email hello@flipsyd.app from your account address and we will do it for you.

Deleting an account:

1. Cancels your subscription, so you are not billed again.
2. Revokes your Slack token with Slack and removes the Microsoft change subscription, so our access to your workspaces ends at the source.
3. Erases your account record, your settings, your nicknames, your usage counters and any buffered message content — immediately, rather than waiting for it to expire.
4. Signs you out everywhere: every session stops working the moment the account is gone.

Where we have to ask a third party to do something and it is unavailable at that moment, the local credential is destroyed anyway and the failure is logged so we can finish the job by hand. Three things outlast deletion: payment records we are legally required to keep for six years, operational logs that roll off after 30 days and contain no message content, and the rolling 35-day backups of the account database, which age out on their own. A request made by email is completed within 30 days and normally the same day; we may ask you to confirm it from your registered number, because we would rather be slow than delete the wrong person's account.

Deleting your Flipsyd account does not delete anything in Slack or your mailbox. Your messages stay where they always were.

11. Complaints

Tell us first — hello@flipsyd.app — and we will try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to come to us first.

12. Children

Flipsyd is a workplace tool and is not intended for anyone under 16. We do not knowingly collect data about children; if you believe we have, tell us and we will delete it.

13. Changes to this notice

If we change how we handle your data in a way that matters — a new sub-processor, a longer retention period, a new purpose — we will update the date at the top and tell you by text or email before it takes effect. Minor wording fixes just get a new date.