1: What We Collect
Account data. When you subscribe, we collect your email address. This is used to deliver your API key, send billing receipts, and communicate service updates.
API usage data. We log API requests at a high level: timestamps, endpoints called, and response status codes. We do not log the content of your financial models, your driver values, or your formulas. Your model data is processed in memory and not persisted on our servers.
Payment data. Billing is handled entirely by Stripe. We do not store or process payment card information. Stripe's privacy policy governs payment data.
Analytics. We use two analytics services. Ahrefs Web Analytics is cookieless and privacy-first: it records aggregate page views (page URL, referrer, approximate country), sets no cookies, and uses no personal identifiers. Google Analytics 4 gives us deeper usage insight; unlike Ahrefs, it sets cookies in your browser and shares data with Google, which acts as our analytics processor. GA4 collects page interactions, an anonymous client identifier, approximate location derived from a truncated IP address, and device and browser type. Where required by law (for example, for visitors in the EU or UK), analytics cookies are subject to your consent.
Product and funnel events. We also record our own anonymous product events, for example which pages are visited and whether a signup form was submitted, alongside a random session identifier and any marketing campaign parameters present in the URL (such as utm_* or gclid). These events never include your email, your API key, or any model content. We store them in our own database to understand usage and measure which channels bring people to Flatland; we do not share them with any advertising network.
Support communications. If you email us, we retain that correspondence to help resolve your issue.
2: What We Do Not Collect
- The content of your financial models (assumptions, formulas, computed values)
- Any data from your local file system or development environment
- Device fingerprinting, or any data we sell to third parties
- Information about your AI agent's other activities outside of Flatland API calls
3: How We Use Your Data
- Deliver and operate the Service: authenticate API requests, enforce rate limits
- Send transactional emails: API key delivery, billing receipts, service notices
- Understand usage patterns at an aggregate level to improve the Service
- Respond to support requests
We do not sell your data, and we do not build advertising profiles from it. Our analytics providers (Ahrefs and Google) process usage data on our behalf under their own privacy terms.
4: Third-Party Services
| Service | Purpose | Data shared |
|---|---|---|
| Supabase | Database: API keys, account records, anonymous funnel events | Email, API key hash, anonymous event data |
| Stripe | Payment processing and subscription management | Email, billing details |
| Resend | Transactional email delivery | Email address, message content |
| Ahrefs | Cookieless web analytics | Aggregate page views (no personal identifiers) |
| Google Analytics | Web analytics (GA4) | Cookies, anonymous client ID, page interactions, truncated IP |
| Vercel | Hosting and edge delivery | Request metadata (no model content) |
| Fly.io | API server hosting | API request logs (no model content) |
Each of these services has their own privacy policy. We have selected providers that take data security seriously.
5: Data Retention
We retain your account data for as long as your subscription is active. If you cancel and request deletion, we will remove your email and API key records within 30 days.
API request logs are retained for 90 days for operational purposes, then deleted.
To request deletion of your data, email info@flatlandfi.com.
6: Security
API keys are stored as hashed values. All data in transit is encrypted via TLS. We follow standard practices for access control and secrets management.
No system is perfectly secure. If you discover a vulnerability, please disclose it responsibly to info@flatlandfi.com.
7: Your Rights
You may request access to, correction of, or deletion of your personal data at any time. Email info@flatlandfi.com with your request.
If you are in the EU or UK, you have additional rights under GDPR / UK GDPR, including the right to data portability and the right to lodge a complaint with a supervisory authority.
Ahrefs Web Analytics and our own product events are cookieless and carry no personal identifiers. Google Analytics sets cookies; you can opt out by declining analytics cookies where a consent prompt is shown, by installing Google's opt-out browser add-on, or by blocking cookies in your browser.
8: Changes to This Policy
We may update this policy as the Service evolves. Material changes will be communicated to subscribers by email. The effective date at the top of this page reflects the most recent revision.
9: Contact
Privacy questions: info@flatlandfi.com
Data deletion requests: info@flatlandfi.com