Privacy policy

FLIIX — named after the platforms we serve: Facebook, LinkedIn, Instagram and X — is operated by One Digital Technologies Limited, 20 Walter Close, LE8 9AF, United Kingdom. We are the data controller for the personal data described in this policy.

For any privacy question, request or complaint, email all.info@onedgtal.com. We aim to respond within five working days and, for formal rights requests, within one month.

This policy applies to the FLIIX web application and its marketing pages. It does not apply to Facebook, Instagram, LinkedIn or X themselves — once a post is published to one of those platforms, that platform's own privacy policy governs how it handles the content and any engagement data.

We only collect what the service actually needs to work. In practice that means:

• Account data. Your name, email address and password hash. If you sign in with Google, we receive your name, email address and profile picture from Google — we never receive your Google password.
• Workspace and brand profile data. Workspace name, brand voice notes, preferred and banned terms, default calls to action, hashtag and emoji preferences, and team membership.
• Briefs and instructions. The topic, brief text, regeneration instructions and any edits you type into the composer or the AI assistant chat.
• Uploaded media and documents. Images, PDFs, Word documents and video files you upload as a brief or as post media, together with file names, sizes, dimensions and video duration.
• Generated content. Captions, alt text, hashtags and AI-generated images produced for each platform, plus their revision history.
• Connected social account data. Platform account identifiers, page or profile names, avatars, granted permission scopes, and access and refresh tokens. Tokens are encrypted before they are stored.
• Publishing records. Scheduled times, destinations, job status, platform post identifiers and any error messages returned by a platform.
• Billing data. Subscription tier, renewal dates and payment status. Card details are entered directly with our payment provider and never reach our servers.
• Technical data. IP address, browser and device type, timestamps, and application error and security logs.

Please do not upload special category data (for example health, biometric or political information) or other people's personal data unless you have a lawful basis to do so.

Some concrete examples of what happens to your data as you use FLIIX:

• You type a brief and upload a product photo. Your brief text, brand profile and the image are sent to our AI provider so it can write Facebook, Instagram, LinkedIn and X versions of the post and, if you ask for one, generate an image. The uploaded photo is treated as part of the instructions and can also be kept as the post image.
• You upload a PDF or Word brief. We extract the text so the model can read it. The original file stays in your media library until you delete it.
• You ask the AI assistant to shorten a caption. Your original brief plus the current caption and your instruction are sent to the model, and we store the before and after versions so you can see the diff.
• You connect a social account. We store the identifiers and encrypted tokens needed to list your pages and destinations and to post on your behalf when you ask us to.
• You publish or schedule a post. We queue a job per destination, send the caption and media to that platform's API at the right time, and record the outcome so you can retry or republish.
• Account, billing and support. Authenticating you, enforcing plan limits, taking payment, and answering your emails.
• Security and service quality. Detecting abuse, debugging failures and improving reliability using aggregated and error data.

We do not sell your data, we do not use your content for advertising, and we do not use your briefs, media or generated posts to train our own models.

• Performance of a contract. Creating your account, generating content, publishing to the destinations you choose, and taking subscription payments.
• Legitimate interests. Keeping the service secure, preventing abuse, fixing faults, and understanding aggregate usage so we can improve the product. We balance these against your rights and you can object at any time.
• Consent. Optional items such as product update emails and any non-essential analytics. You can withdraw consent at any time without affecting processing carried out before withdrawal.
• Legal obligation. Tax and accounting records, and responding to lawful requests.

Content generation is the core of FLIIX, so it is worth being explicit. When you generate or regenerate a post, the following is transmitted to our AI provider over an encrypted connection: your brief and instructions, relevant brand profile settings, the current caption when you are revising it, and any images or extracted document text you attached.

The provider processes that input to return captions and images and does not use it to train its models under our agreement. We keep the input and output in your workspace so your content library and revision history work.

Output is generated by a model and can be wrong. It may contain inaccurate statements or imagery that does not match your product. You remain responsible for reviewing every post before you publish it, and for making sure it complies with advertising rules and each platform's policies.

Connecting an account is entirely optional — you can generate and export content without ever connecting one. When you do connect, you grant permissions through the platform's own consent screen, and we request the narrowest set that supports publishing:

• Facebook. Listing the Pages you manage and publishing text, photo or video posts to the Pages you select.
• Instagram. Identifying the Instagram business accounts linked to your Pages and publishing images or Reels to them.
• LinkedIn. Identifying your member profile and the organisations you administer, and posting to whichever you choose.
• X. Identifying your account and posting tweets with optional media.

Access and refresh tokens are encrypted with AES-256-GCM before storage, and connections are strictly isolated per user — no other user of FLIIX can see or use your connections. We only publish when you press publish or when a schedule you created falls due. We never read your direct messages, and we do not post anything you have not created in the app.

You can disconnect an account at any time from the Accounts page, which deletes the stored tokens. You can also revoke access directly in the platform's own security settings.

We share personal data only with the categories of recipient below, and only as far as necessary:

• Cloud hosting, database and file storage provider. Stores your account, content and uploaded media.
• AI provider. Processes briefs, instructions and media to produce captions and images.
• Payment provider. Handles subscription checkout, card data and invoices as a separate controller.
• Email delivery provider. Sends verification, password reset and service emails.
• Social platforms you choose. Receive the caption and media for each post you publish.
• Professional advisers and authorities. Where we are legally required to disclose, or to establish or defend legal claims.
• A successor entity. If our business is reorganised or acquired, subject to this policy.

Our suppliers act as processors under written terms and may not use your data for their own purposes.

Some of our providers process data outside the UK and the European Economic Area, including in the United States. Where that happens we rely on appropriate safeguards — an adequacy decision where one applies, or the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, supported by encryption in transit and at rest. You can request more detail about a specific transfer by emailing us.

• Account and workspace data. For as long as your account is active, then up to 30 days after deletion to allow recovery from mistakes and backups.
• Briefs, generated posts and media. Until you delete them, or until your account is deleted.
• Social connection tokens. Until you disconnect the account or the token is revoked by the platform.
• Publishing job records and error logs. Typically 12 months, so you can audit what was posted and when.
• Technical and security logs. Usually up to 90 days.
• Billing records. Six years, as required by UK tax law.

The controls we have in place today include:

• Encryption in transit using HTTPS/TLS for every request.
• Encryption at rest for stored files and database contents, with additional application-level AES-256-GCM encryption for social access tokens and developer credentials.
• Row-level access rules in the database so each user and workspace can only reach their own records.
• Least-privilege access for our team, with privileged operations restricted to server-side code.
• Server-side validation and authentication on every endpoint that touches your data.

No online service can promise perfect security. If a breach affects your rights, we will notify the ICO within 72 hours where required and tell you without undue delay when the risk to you is high.

If you are in the UK or the EEA, you have the right to:

• Access a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased where we no longer need it.
• Restrict processing while a concern is investigated.
• Receive your data in a portable, machine-readable format.
• Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent where consent is the basis we rely on.

Email all.info@onedgtal.com to exercise any of these. Exercising your rights is free and we will not treat you differently for doing so. If you are unhappy with our response you can complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority in the EEA.

In the last 12 months we have collected the categories of personal information described in section 2 — identifiers, commercial information (subscription records), internet activity (log data), and the content you choose to upload. We collect it for the business purposes described in section 3, from you directly and from the social platforms and sign-in provider you connect.

We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not process it for cross-context behavioural advertising. We do not knowingly collect personal information from anyone under 16.

California residents may request to know, delete or correct their personal information, and may limit the use of sensitive personal information. We do not use sensitive personal information for anything beyond providing the service. You will not be discriminated against for exercising these rights. Send requests to all.info@onedgtal.com; we will verify you through the email address on your account, and an authorised agent may act for you with written permission.

We keep this deliberately minimal. FLIIX uses strictly necessary cookies and browser storage to keep you signed in, to remember where you were heading before you signed in, and to protect against cross-site request forgery. These are required for the service to function and cannot be switched off from within the app.

If we later add non-essential analytics or marketing cookies, we will ask for your consent first and update this section. Blocking essential cookies in your browser will prevent you from signing in.

FLIIX is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has created an account, email us and we will delete it.

We may update this policy as the product changes. The date at the top always reflects the current version. If a change materially affects how we use your data, we will tell you by email or with an in-app notice before it takes effect, and where the law requires it we will ask for your consent.