Privacy Policy

1. Data controller

The data controller for this Website is:

2. What data we collect on this Website

When you visit or interact with flank.life, we may collect the following categories of personal data:

• Usage and analytics data — pages visited, session duration, scroll depth, button clicks, referral source, and device/browser information. Collected automatically via Google Analytics and PostHog.
• Technical data — IP address (anonymised where possible), browser type, operating system, screen resolution, and approximate geographic location (country/city level).
• Cookie data — identifiers and preferences stored in browser cookies or local storage. See our Cookie Policy for details.
• Contact and enquiry data — if you contact us via email or a contact form, we collect your name, email address, and the content of your message.
• Account registration data — if you create a Flank account via the Website, we collect your email address, chosen password (stored in hashed form), and any profile information you provide. This data is primarily governed by the App Privacy Policy once your account is active.

3. Legal basis for processing

We process your personal data under the following lawful bases:

• Consent — for analytics and non-essential cookies. You can withdraw consent at any time via our cookie preferences or by contacting us.
• Legitimate interests — to understand how the Website is used, improve our product, prevent fraud, and maintain Website security, where these interests are not overridden by your rights.
• Contract — to provide you with the service you have requested, including processing your account registration.
• Legal obligation — where processing is necessary to comply with applicable law.

4. How we use your data

We use the data collected on this Website to:

• Deliver and maintain the Website and its content.
• Understand visitor behaviour and improve the Website's design, performance, and content using Google Analytics and PostHog.
• Track product engagement metrics internally (e.g. which features attract interest, conversion from free trial to paid subscription) using PostHog event tracking.
• Respond to enquiries and support requests.
• Send transactional or service-related emails (e.g. password reset, account setup).
• Detect and prevent security incidents, abuse, and fraudulent activity.
• Comply with our legal obligations.

We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces significant legal effects.

5. Analytics and tracking services

We use the following analytics tools on this Website. Both tools operate under data processing agreements with us and are bound by GDPR-compliant data handling obligations.

Google Analytics

We use Google Analytics (provided by Google LLC, or Google Ireland Limited for users in the EEA/UK) to understand how visitors use this Website. Google Analytics uses cookies to collect anonymised usage data including page views, session duration, traffic source, and device information. We have enabled IP anonymisation. Data may be transferred to Google servers in the United States under Standard Contractual Clauses. You can opt out by using the Google Analytics Opt-out Browser Add-on or by declining analytics cookies via our cookie banner.

PostHog

We use PostHog for product analytics and internal event tracking. PostHog helps us understand feature engagement, user flows, and conversion events. Data collected includes page events, clicks, feature interactions, and session information linked to a pseudonymous identifier. PostHog data is processed under a data processing agreement with Fueld AI Ltd. You can opt out of PostHog tracking via our cookie banner.

6. Third-party services and data processors

We work with trusted third-party providers who process data on our behalf. All processors are bound by data processing agreements:

SCCs = Standard Contractual Clauses, a recognised mechanism for lawful international data transfer under UK GDPR.

7. Data retention

We retain your personal data only as long as necessary:

• Analytics data — retained for up to 26 months in Google Analytics; PostHog data retained for up to 12 months, after which it is aggregated or deleted.
• Account and contact data — retained for the duration of your relationship with Flank, plus up to 6 years to satisfy legal and financial record-keeping obligations.
• Cookie data — see our Cookie Policy for individual cookie lifetimes.

8. International data transfers

Some of our third-party service providers (including Google Analytics and Stripe) are based outside the UK and European Economic Area. Where data is transferred internationally, we ensure appropriate safeguards are in place — including Standard Contractual Clauses approved by the UK ICO — to protect your data to the same standard as under UK GDPR.

9. Your rights under UK GDPR

You have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to ask us to correct inaccurate or incomplete data.
• Right to erasure — to request deletion of your personal data where there is no compelling reason to continue processing.
• Right to restrict processing — to ask us to limit how we use your data in certain circumstances.
• Right to data portability — to receive your data in a structured, machine-readable format.
• Right to object — to object to processing based on legitimate interests, including profiling.
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at data_protection@flank.life. We will respond within one calendar month. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Cookies

We use cookies and similar tracking technologies on this Website. Our full Cookie Policy explains what cookies we use, why, and how you can manage them.

11. Children's privacy

Flank is not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16. If you believe we have inadvertently collected such data, please contact us immediately at data_protection@flank.life and we will delete it promptly.

12. External links

This Website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to review the privacy policies of any third-party sites you visit.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will reflect any changes. Where changes are material, we will notify registered users by email.

14. Contact us

For any questions about this Privacy Policy or how we handle your data: