Privacy Policy

Last Updated: October 7, 2026

This Privacy Policy explains how Flax ("Flax," "we," "us," or "our") collects, uses, stores, and shares personal information through flaxsites.com and the Flax website builder, hosting platform, editor, dashboards, support tools, and related services (the "Service"). It applies to account holders, their authorized collaborators, and people who visit a website hosted with Flax.

Flax is operated by Michael Kelly. Our postal address for privacy questions and legal notices is 202 High Road, Whitehaven, Cumbria, CA28 9ES, United Kingdom.

Flax controls personal information used to operate Flax accounts and the Service. A customer who creates a website using Flax decides what information that website collects from its visitors and customers. In those cases, the customer is responsible for its own privacy notices and lawful instructions, and Flax generally processes the information to provide hosting and website features.

1. Information We Collect

1.1 Account, identity, and access information

We collect information needed to create and protect accounts and provide access to sites and agency workspaces, including:

  • Email address, name, profile photo, phone number, language preference, and authentication identifiers you provide or receive from a sign-in provider.
  • Supabase Auth handles password sign-in, password-reset and confirmation flows, and account sessions; Flax's user-profile records do not include your password.
  • Account roles, agency name and branding, site invitations, access permissions, ownership changes, and account or site settings.
  • Authentication and security information such as sign-in timestamps, session and device details, IP address, user agent, security events, and multi-factor authentication data where enabled.

1.2 Business information and website content

We collect the information and content you provide when you create, import, edit, publish, or manage a site, such as business names, locations and contact details; page text, images and documents; products, services, menus, events, courses, reviews, FAQs, forms, policies and SEO settings; domain and deployment settings; and design, translation, and feature configuration. Drafts and uploads may remain in your browser until you publish, synchronize, replace, or clear them.

If you use Flax agent or AI features, we may also process the instructions, site information, files, proposed edits, generated content, review decisions, task history, and related usage information needed to provide those features.

1.3 Information from visitors to Flax-powered sites

Depending on the features a site owner enables, a Flax-powered site may collect contact-form messages and attachments, customer or member records, orders and delivery details, bookings, event registrations, ticket and check-in records, course access and progress, staff accounts, point-of-sale activity, and related communications. Site owners determine what their sites collect. This information is handled under the site owner's instructions and privacy notices.

1.4 Domains, billing, and transactions

When you connect, register, or renew a domain, or buy a Flax plan, we may receive domain names, registration and renewal details, registrant contact information, consent records, order identifiers, subscription and invoice details, currency, tax and payment status, discount or affiliate attribution, and provider customer or transaction identifiers. Domain consent records may include the time of consent, IP address, user agent, and the version of the agreement accepted.

Dodo Payments processes Flax subscriptions and checkout. Stripe processes payments or connected-payment features where enabled. These providers handle payment-card details; Flax does not store full payment-card numbers.

1.5 Connected services and Google data

If you connect a third-party service, we process the information needed for that integration. For Google integrations, this may include your Google account email, name and profile image; the Search Console properties you connect; site-verification status; and Search Console performance information such as queries, page URLs, clicks, impressions, click-through rate, and average search position. If you use another enabled Google feature, we may also process the Google account or property information and content you choose to use with that feature.

Flax requests Google account profile, Search Console, and site verification permissions for the related features. OAuth access and refresh tokens are stored in a restricted Supabase table and used by server-side integration services. We use them to establish the connection, verify a site when you request that action, display Search Console information, and provide reports or SEO tools you request or enable. We retain the connection data while the integration is connected or as otherwise described in Section 7.

When a site owner requests an AI-assisted SEO feature or enables a scheduled workflow that uses Search Console information, the relevant queries, metrics, and site context may be sent to the configured AI service provider to generate that report or recommendation. Flax does not sell Google user data, use it for advertising, or use it to train or improve general-purpose AI models. AI providers process that information only to provide the requested feature and under the restrictions that apply to the service.

You can disconnect Google integrations in Flax where supported. Disconnection stops future access and starts removal or revocation of stored tokens; copies needed for security, legal, backup, or already-generated report records may remain for the periods described in Section 7.

1.6 Analytics and social integrations

If you connect or enable analytics or social features, we may process Google Analytics property and measurement details, Microsoft Clarity project credentials and aggregated insights, or Meta account, page, and Instagram business-account identifiers and tokens. These integrations are optional and are used to provide the feature you connect. Analytics or social tools installed by a site owner on their own published website are controlled by that owner.

1.7 Support, communications, referrals, and usage

If you contact us or use support tools, we may collect your contact details, messages, files, site identifiers, diagnostic packages, support history, and related logs. We also collect service usage, error, performance, billing-counter, referral, waitlist, and affiliate information. Referral records may include a code or campaign, checkout identifiers, and hashed IP-address or user-agent values used for attribution and abuse prevention.

2. How We Use Information

We use information as needed to:

  • Create and secure accounts, administer permissions, and provide support.
  • Build, edit, translate, publish, host, back up, and deliver websites and related content.
  • Operate forms, checkout, products, bookings, events, courses, memberships, staff tools, domains, and other features selected by a site owner.
  • Process subscriptions and payments, calculate usage, prevent fraud and abuse, and maintain financial and domain-registration records.
  • Connect and maintain integrations that an account holder enables, including Google Search Console, website verification, analytics, and social services.
  • Create requested reports, website recommendations, and AI-assisted content or edits, including by using relevant site information with the configured AI provider.
  • Communicate about account activity, service changes, transactions, scheduled reports, support requests, and security matters.
  • Monitor reliability, troubleshoot errors, protect the Service, comply with law, and enforce our agreements.

3. Where Information Is Stored

Flax uses more than one infrastructure provider. The systems used depend on the feature and type of information:

  • Supabase provides account authentication and the managed PostgreSQL database used for account profiles, site and subscription metadata, invitations, domain records and consent receipts, integration credentials and metadata, reports, usage information, and other Service records.
  • Bunny.net provides CDN delivery, DNS and edge services, storage for published website files and assets, and databases used by some site features. Per-site databases may contain operational records such as orders, bookings, form submissions, attendees, tickets, staff, courses, and memberships.
  • Your browser may temporarily store drafts, editor state, uploaded files, preferences, and other working data until you publish, synchronize, replace, or clear them.
  • Payment, domain-registration, analytics, social, email, and AI providers may retain information under their own service settings and agreements while performing services for Flax or for you.

Published pages and assets may be copied to CDN caches so they can be delivered to site visitors. Site owners should not place confidential information in content intended to be publicly published.

4. How We Share Information

We share information only as needed to operate the Service, carry out your instructions, protect people and the Service, or meet legal obligations. We do not sell personal information for money or use Google user data for advertising.

  • Supabase for authentication, database, and backend services.
  • Bunny.net for CDN delivery, DNS, edge services, storage, and per-site databases.
  • Dodo Payments and Stripe for subscription, checkout, payment, billing, tax, and fraud-prevention services, as applicable.
  • OpenSRS and other domain providers for domain search, registration, renewal, and required registrant records.
  • Google, Meta, and Microsoft Clarity when you enable the corresponding integration. Google data is limited to the purposes described in Section 1.5.
  • OpenAI, OpenRouter, and the configured model providers for AI features you request or enable. For Google data, processing is limited to returning the requested user-facing report or recommendation.
  • Email delivery, CAPTCHA and anti-abuse providers, and internal support or incident-management tools for messages, security, and support.

We may also share information with people you authorize, such as site collaborators or an agency, and with professional advisers, a successor in a business transfer, or public authorities where the law requires or permits it.

5. International Processing

Flax serves customers worldwide. We and the providers that support the Service may process information in countries other than the country where you live or operate, including where our infrastructure, CDN, support, and service providers operate. CDN delivery may serve public website content from locations around the world.

Where applicable law requires a transfer safeguard, we use a lawful transfer mechanism appropriate to the transfer, such as an adequacy decision, standard contractual clauses, or another legally recognized safeguard. Contact us if you need information about processing arrangements for your account.

6. Cookies and Similar Technologies

Flax uses cookies, local storage, IndexedDB, and similar technologies for sign-in, session management, security, drafts, editor preferences, and Service operation. The Flax platform does not use third-party advertising cookies. A site owner may add analytics, advertising, embedded media, payment, or other third-party tools to a published site; the owner's notices and settings govern those tools.

7. Retention and Deletion

We keep information for as long as needed to provide the Service, keep an account or site operating, honor your settings, resolve disputes, meet legal and financial obligations, maintain security, and recover from mistakes or outages. Retention depends on the type of information and the service involved; there is no single deletion period for all account and site data.

When an account or site is closed or data is deleted, active copies are removed or deactivated through the applicable workflow. Backup, CDN-cache, fraud-prevention, domain-registration, billing, security, or legally required records may remain for a limited period or until the relevant provider's retention cycle ends. Integration tokens are retained while connected and are revoked or removed when the integration is disconnected where the provider supports revocation.

8. Security

We use technical and organizational measures designed to protect information, including encrypted connections, managed authentication, database access controls, restricted server-side access to integration tokens and service credentials, and monitoring intended to detect abuse and operational issues. No method of transmission or storage is completely secure, and we cannot promise absolute security.

9. Your Privacy Rights

Depending on where you live and the laws that apply, you may have the right to request access to, correction of, deletion of, or a copy of personal information; to object to or restrict certain processing; to withdraw consent; or to complain to a privacy regulator. You may also be entitled to appeal a decision about a rights request. These rights are subject to applicable exceptions and may differ by jurisdiction.

To make a request about information Flax controls, email contact@flaxsites.com. We may need to verify your identity and account relationship before acting. If your request concerns information collected by a Flax customer through their website, contact that site owner first; we will assist the owner as required by our agreement and applicable law.

10. Site Owner Responsibilities

If you use Flax to operate a website, you decide what personal information to request from visitors, which features and third-party tools to enable, and how long to keep your own records. You must provide required notices, obtain any required consent, respond to rights requests, secure access to your site, and comply with the laws that apply to your business and visitors. This includes rules about privacy, cookies, marketing, consumer transactions, payments, accessibility, children, and regulated services where relevant.

11. Children's Privacy

The Flax account and website-builder Service is intended for business users and is not directed to children under 16. Account holders must meet the eligibility requirements in our Terms of Service. Site owners who use Flax for classes, events, courses, or youth programs are responsible for the notices, permissions, and safeguards required for their own audience.

12. Changes and Contact

We may update this Privacy Policy as the Service or applicable law changes. We will post the current version here and update the date above. If a change materially affects how we use personal information, we may also notify affected users through the Service or by email where appropriate.

For privacy questions or requests, email contact@flaxsites.com or write to Michael Kelly, Flax, 202 High Road, Whitehaven, Cumbria, CA28 9ES, United Kingdom.