Privacy Policy
We explain what personal data Flyp processes in connection with the use of the platform and what rights you have under the GDPR.
Data controller
The controller of the User’s account data (photographer/studio) is Usługi Programistyczne Marcin Rzepecki, ul. Bakalarska 15B/6, 02-212 Warszawa, Tax ID (NIP) 5223218129, the operator of the Flyp platform. Contact for all personal data matters: kontakt@flyp.pl or in writing to the address above.
What data we process
Registration and contact data (first name, last name, email address), plan billing data, technical data (IP address, logs, device and browser type) and data about how you use the platform. If you sign in with Google or Facebook, that provider gives us your account identifier, your name, your email address together with whether it has been verified, and your profile picture; we do not receive your password or access to any other account data. If you do not have an avatar yet, we save a copy of that picture as your account avatar; you can change or remove it in the account settings. When an error occurs in the app, we also process an error report (see “Error monitoring”).
Purposes and legal bases
Providing the service and performing the contract, including sign-in with the provider you choose (Art. 6(1)(b) GDPR); legal obligations such as billing and invoicing (point c); legitimate interest: platform security, abuse prevention, detecting and fixing errors, and product development (point f); with your consent: marketing communication and analytics and marketing cookies on studio pages (point a).
Your studio’s client data
Data you enter about your clients (e.g. name, email, contract details) is processed on your behalf as a processor: you remain its controller and you provide your clients with your own privacy information. This also applies to visitors of your studio’s galleries and booking pages: we collect gallery visit statistics on your behalf, and advertising pixels (Meta, Google, TikTok) run only if you configure them and only with the visitor’s consent; you are jointly responsible for their use with the pixel provider.
The rules for processing your clients’ data, including the list of sub-processors, are set out in the data processing agreement.
Error monitoring
To detect and fix faults we use Sentry (Functional Software, Inc.); the data is stored in a data centre in the European Union (Germany). When an error occurs in the browser, we send a report: the error description, page address, IP address, browser and operating system type, and a recording of the page view from the last minute before the error, in which all text and form fields are masked and images are blocked. No recordings are sent without an error, unless you report a problem yourself. When you use the “Report a problem” button, together with your description and email address we send a screenshot, which may contain data visible on the screen, and a recording of the last minute of your session with its content masked. Reporting is voluntary, and before sending you can choose not to attach the screenshot. For some visits we also send page load timings, without page content. Nothing is stored on your device for this purpose. The legal basis is our legitimate interest in a stable and secure platform (Art. 6(1)(f) GDPR). You can object by writing to kontakt@flyp.pl.
Cookies
Essential cookies keep you signed in, protect against abuse and remember your settings; they do not require consent. Analytics and marketing cookies work only in studio galleries and on booking pages, and only after you consent, which you can change or withdraw at any time. The full description is in the Cookie Policy.
Retention period
We keep account data for the duration of the contract and for the period required by law (e.g. accounting rules). After a studio is closed you have 30 days to cancel the closure and download the data; after that we delete the data of the studio and its clients. After an account is deleted, we delete or anonymise the data, except for data we are legally required to keep.
Database backups are kept on the server for 7 days and copies of them on the operator’s device in Poland in a rotation cycle. We keep the log of sent e-mails for 365 days (their content for 90 days) and the platform administrator’s action log for 3 years. Individual gallery statistics events (with a browser identifier) are deleted after 90 days; only aggregate visit counts remain. Error reports are kept for as long as needed to detect and fix the fault, and your cookie choice expires after a year.
Your rights
You have the right to access, rectify and erase your data, to restrict its processing and to data portability, and the right to object to processing based on legitimate interest. You can withdraw consent at any time; this does not affect the lawfulness of processing before withdrawal. You can delete your account yourself in the account settings; this also deletes the data we received from Google or Facebook (identifier, name, email address, the copy of your profile picture). You can also request this at kontakt@flyp.pl. To revoke Flyp’s access to your Facebook account, go to Facebook: Settings & privacy → Settings → Apps and websites → Flyp → Remove. Send any other requests to kontakt@flyp.pl; we reply within 30 days. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).
Recipients and subprocessors
Filling the studio wizard with AI
When creating a studio you can use the "Fill it in for me" feature. It is voluntary and runs only on your request. We then pass to the language model provider, Anthropic, PBC (USA), the content of the website you indicated and its subpages, the social media profile addresses you gave and the materials you uploaded (e.g. a price list, contract or terms), and, if you tick the option, the addresses of the logo and photos on the site. The model may also use the provider's public web search to confirm your offer; we do not fetch content from social media directly. The purpose is to prepare a suggestion of studio settings that you review and approve yourself (Art. 6(1)(b) GDPR; for files and data from your website, your consent, point (a)). The provider processes the data on our instructions under a data processing agreement, using standard contractual clauses and the EU-US Data Privacy Framework certification, and does not use it to train models. Uploaded files are deleted right after the suggestion is prepared, and the suggestion itself with the website address after 7 days; the provider retains request content under its own retention policy (currently up to 30 days). Do not include your clients' personal data in the materials unless necessary.
Data from Google services
If you connect your Google account, Flyp uses Google APIs only within the scope you approve on the Google consent screen and only to run the feature you chose: (1) Sign in with Google: your account identifier, name, e-mail address and profile picture, to create and recognise your account; (2) Google Calendar (calendar.events scope): reading and writing events in the calendar you choose, so that Flyp sessions appear in your calendar and busy slots from your calendar are visible in bookings; (3) Google Drive (drive.file scope): access only to the files you pick yourself in the Google window, to copy them into the selected session; we do not browse any other files on your Drive. Access tokens are stored encrypted; we do not sell or transfer Google data to third parties, do not use it for advertising or to train AI models, and Flyp staff can see it only at your request while resolving an issue or where the law requires it. You can revoke the connection at any time in Flyp settings or at myaccount.google.com/permissions; we then delete the token, and photos or events already copied remain in your studio as your data. Flyp's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.