FlagPilot Privacy Policy

Welcome to FlagPilot ("FlagPilot," "we," "our," or "us"). FlagPilot is a developer platform for managing feature flags, rollouts, target users, webhooks, APIs, SDKs, and CLI tooling.

This Privacy Policy explains in detail what information we collect, why we collect it, how we protect it, who we share it with, how long we keep it, and the rights and choices available to you. It is designed to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), Brazil's Lei Geral de Proteção de Dados (LGPD), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable regional data protection laws.

By using FlagPilot, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

This policy applies to the FlagPilot website, dashboard, APIs, SDKs, CLI, MCP server, documentation, billing systems, customer support channels, and all related services (collectively, the "Service"). It covers information we collect directly from you, information generated through your use of the Service, and information you configure the Service to process on your behalf (such as Target User identifiers).

This policy does not cover the practices of third-party websites, applications, or integrations you choose to connect to FlagPilot (e.g., your own backend systems, Slack, or Discord) — please review their respective privacy policies separately.

FlagPilot is operated by FlagPilot ("FlagPilot", "we", "our", or "us") and is the data controller responsible for the personal information described in this Privacy Policy. FlagPilot is a trade name rather than a separate legal entity.

We have not appointed a formal Data Protection Officer, as we do not meet the GDPR threshold requiring one at our current scale. Privacy inquiries can be directed to the contact above, and we will respond within the timeframes required by applicable law.

Because this feature involves data about your end users, not just you as our customer, it warrants specific detail:

• FlagPilot stores only opaque identifiers supplied by you (e.g., a userId, a Firebase UID, an Auth0 subject, a Supabase UID) — strings with no inherent personal meaning to us.
• We do not require, request, validate, or cross-reference these identifiers against any real-world identity.
• We strongly recommend you avoid using directly identifiable personal information (names, emails) as the identifier value itself. If you choose to do so anyway, that data becomes subject to this policy as personal information, and you remain responsible for ensuring you have appropriate legal basis and user consent for us to process it as your data processor.
• Evaluation results for Target Users (whether a given ID matches your configured list) are computed on request and are not separately logged with identifying detail beyond aggregate evaluation counts (see §4.4 and §12).
• If you are a customer acting as a data controller for your own end users, and our processing of Target User identifiers on your behalf falls within scope of GDPR Article 28, contact us at support@tryflagpilot.com to discuss a Data Processing Agreement.

API keys authenticate applications connecting to FlagPilot's evaluation API, CLI, and SDKs. Keys are stored encrypted and scoped to a project and environment. You are responsible for protecting your API keys — treat them like passwords. If a key is compromised, rotate it immediately from your dashboard. We log key usage (timestamps, source IP where available) for security and abuse-detection purposes.

We do not sell your personal information, and we do not use it for purposes incompatible with those listed above without providing notice and, where required, obtaining your consent.

We share information with the following categories of service providers, each acting as our data processor (or sub-processor) under contractual data protection terms. In the interest of transparency, we name our current providers below; this list may change as our infrastructure evolves, and material changes will be reflected in an updated "Last Updated" date.

We may also disclose information:

• To comply with a legal obligation, court order, or governmental request
• To protect the rights, property, or safety of FlagPilot, our users, or the public
• In connection with a sale of the business or its assets, subject to confidentiality obligations
• With your consent, or at your direction (e.g., when you configure a Slack or Discord webhook integration)

We do not sell personal information, and we do not share personal information with third parties for their own independent marketing purposes.

We use the following categories of cookies:

• Necessary cookies: required for authentication, session management, and core security functionality. These cannot be disabled without breaking the Service.
• Analytics cookies (Google Analytics, PostHog): used with your consent, where required by applicable law (e.g., under the EU ePrivacy Directive and GDPR), to understand aggregate usage patterns and improve the product.

You can update your cookie preferences at any time via Cookie Preferences available from the website footer or Account Settings. Where required by law, we present a consent banner before setting non-essential cookies.

Your information may be processed outside your country of residence, including in the United States, using appropriate safeguards where required by law. Where we transfer personal data out of the European Economic Area, United Kingdom, or Switzerland, we rely on mechanisms which may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• The UK International Data Transfer Addendum, where applicable
• Transfers to jurisdictions covered by an adequacy decision

Where required, we rely on Standard Contractual Clauses (SCCs), adequacy decisions, or other lawful transfer mechanisms provided by our service providers.

We retain information only as long as reasonably necessary to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements:

• Account data: retained for the duration of your account, plus 30 days after closure for legal and dispute-resolution purposes
• Billing records: retained as required by applicable tax and accounting law (commonly 6-7 years, depending on jurisdiction)
• Project and flag configuration data: retained for the duration of your account
• Audit history: retained for 12 months, supporting your own team's accountability needs
• Aggregate usage/analytics data: retained per your plan's stated history window; we do not retain detailed per-evaluation logs beyond a short operational window
• Error monitoring data: retained per our error monitoring provider's default retention window, typically 30 days, sufficient for diagnosis but not indefinite storage

Upon account deletion, we delete or anonymize personal data within 30 days, except where retention is legally required.

We implement security measures designed to protect your information, including:

• HTTPS/TLS encryption in transit
• Encryption of API keys and authentication tokens at rest
• Access controls limiting data access to what's needed for support and operations
• Security headers and monitoring across our infrastructure
• Authentication safeguards for account access

No service can guarantee absolute security. In the event of a data breach affecting your personal information, we will notify affected users and relevant supervisory authorities as required by applicable law (e.g., within 72 hours under GDPR, where feasible).

We do not use your personal information for automated decision-making, including profiling, that produces legal or similarly significant effects on you. Flag evaluation logic operates on rules and identifiers you configure yourself and does not constitute automated decision-making about you as a data subject.

FlagPilot is not intended for children under 16 years of age, or the minimum age required by applicable law in your jurisdiction. We do not knowingly collect personal information from children. If we become aware that we have inadvertently done so, we will take steps to delete it.

The Service may allow you to configure integrations with third-party services (e.g., Slack, Discord, or your own backend systems). This Privacy Policy does not extend to the practices of third parties you choose to integrate with — review their respective privacy policies independently.

We may update this Privacy Policy periodically. The "Last Updated" date at the top reflects the most recent revision. Where changes are material, we will provide notice via email or a prominent notice within the Service prior to the change taking effect.

Questions regarding this Privacy Policy may be submitted via support@tryflagpilot.com or the contact methods published on the FlagPilot website. If you are located in the EEA or UK and believe we have not adequately addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority.