Privacy Policy

Data controller

Controller: Fleksi.io (company to be established), Vantaa, Finland. 'Company to be established' means a limited liability company will be formed to assume the controller obligations. Contact: Use the contact form.

Roles in SaaS

When a business customer uses Fleksi to manage their own customers, employees, or contacts, the business customer acts as the data controller and Fleksi as the data processor. This notice also covers situations where we act as controller ourselves, such as website contact requests, sales discussions, and billing.

Data we process

• Account and contact details for users and admins (name, email, role, phone, company code).
• Company and workspace data you submit (customers, invoices, tasks, files), which may include customer or employee contact details.
• Usage and device data such as logins, IP address, browser, device identifiers, and diagnostic logs.
• Support communications, bug reports, and feedback, including attachments you provide.

Why data is processed

• Delivering the service, managing access rights, storage and usability (contract).
• Security, monitoring, auditing and service quality improvement (legitimate interest).
• Customer relationship management, onboarding and support (legitimate interest and contract).
• Statutory obligations such as accounting or tax-related retention (legal obligation).

The legal basis for processing may be contract, legal obligation, legitimate interest, or consent, depending on the nature of processing.

Sharing and processors

We use processors for hosting, email delivery, analytics, and customer support (for example, Google and Apple iCloud). They are bound by data processing agreements. We do not sell personal data.

Subprocessors and transfer mechanisms are specified in contractual annexes for business customers.

Retention periods

We retain data only as long as necessary for the service, the customer relationship, legal obligations, or security. Business customer SaaS data is retained for the contract term and deleted or returned according to the agreed process.

Your rights

• Access, rectification, and erasure.
• Restriction and objection to processing.
• Data portability.
• Withdraw consent at any time when processing is based on consent.

To exercise your rights, use the contact form. You can also lodge a complaint with your local data protection authority.