Privacy Policy

1. Information We Collect

1.1 Information Business Owners Give Us

• Account registration: name, email address, phone number, business name, website URL, profile photo;
• Professional information: credentials, certifications, specializations, service descriptions, pricing;
• Financial information: Stripe Connect account details (we do not store raw bank account or card numbers);
• Calendar and scheduling data: availability windows, booking preferences, timezone;
• Integration credentials: third-party API keys and access tokens for connected services (encrypted at rest using AWS KMS — each Business Owner's credentials are scoped with a per-provider encryption context, making cross-provider decryption cryptographically impossible);
• Communications: messages sent through the Platform, support requests.

1.2 Information Clients Give Us

• Identity: name, email address, optional phone number;
• Booking information: selected Business Owner, service type, date/time, session notes;
• Call and message content: the text transcript of a call answered by a flyk AI assistant, and the content of texts, WhatsApp messages, and website-widget chats you send (we do not retain call audio recordings);
• Payment information: processed by Stripe; we retain only payment status and transaction IDs, never raw card numbers.

1.3 Information We Generate or Collect Automatically

• Business Owner Agent Cards: AI-generated structured profiles derived from publicly available information and Business Owner-submitted data, published in AFODP-compliant format;
• Reputation attestations: cryptographically signed records of session completions, verified credentials, and Client interactions stored in an append-only ledger;
• Conversation data: interactions between Clients and Business Owner AI agents, stored for 90 days hot and up to 12 months archived;
• Usage data: session logs, API call logs, feature usage, access timestamps;
• Device and technical data: IP address, browser type, operating system, referring URLs (via standard server logs);
• AI conversation content: the prompts and replies exchanged with an AI agent, retained so the Business Owner has a record of the conversation and so we can debug and improve the service. We do not use your conversations to train AI models.

1.4 Information From Third Parties

• Publicly available business data: Business Owner websites and similar sources — used with Business Owner consent during onboarding to pre-populate profiles;
• Calendar providers: availability data from connected Google Calendar, Apple iCal, Calendly, Acuity, Square Appointments, Mindbody, Vagaro, or other scheduling services a Business Owner chooses to integrate;
• Consumer Agent platforms: when a Consumer Agent (ChatGPT, Claude, Gemini, etc.) queries the flyk registry on a user's behalf, we receive the query and standard API authentication data. We do not receive the end user's identity unless they complete a Booking.

1.5 Information Our Mobile Apps Collect

Sections 1.1 to 1.4 apply to the apps too. In addition, the apps collect the information below. They contain no advertising, analytics, or crash-reporting software, do not use your phone's advertising identifier, and do not track you across other companies' apps or websites.

In Flyk Business (for business owners):

• Your account and business details: the email address you sign up with, and the business details you add or edit — name, phone number, address, services, hours, and the website we read to fill them in;
• Your replies and drafts: replies you send to customers from Messages, and follow-up messages you ask Flyk to improve before you send them (a draft may name a customer). A follow-up you send goes out through your phone's own Messages or Mail app, and we do not see it;
• Your chats with the assistant, and what it remembers: your conversations with the Flyk assistant, and a short list of facts it keeps about you and your business from past conversations — what you want, what you approved, your preferences. It is instructed never to remember anything about your customers, and email addresses and phone numbers are removed from what it keeps.

In Flyk Concierge (for people finding businesses), which you can use with or without an account:

• Your Concierge account (optional): if you sign in, the email address you sign in with, using a one-time code we email to you. Your account holds your people (My People), what Flyk remembers, your chats, and your appointments, so they stay with you on a new phone;
• Approximate location (optional): only when you tap to use your location, and only with your permission. The app asks your phone for an approximate, city-level location and turns it into a city name on the phone; your coordinates are not sent to us. The city name is sent with your searches and lookups so that results are near you. You can type a different city at any time, or turn off location access in your phone's settings;
• A contact you pick (optional): when you add someone to My People from your phone's contacts, the app opens your phone's contact picker and copies only the one contact you choose — their name, first phone number, first email address, and first postal address. We never read your address book. The entry is saved to your list on our servers;
• A device ID: the first time you open the app, it creates a random ID for that installation and registers it with us, along with the platform (iOS or Android) and the app version. It is not your phone's hardware ID or advertising ID. We use it to keep your things together when you are not signed in, and to limit abuse;
• Your searches: the businesses you search for, and the websites or phone numbers you look up, with your city name if you have set one;
• Your chats, and what Flyk remembers: your conversations with Flyk and with businesses in the app, and the notes Flyk keeps so it can help you next time (a preference, a need, an outcome). You can see these notes under What Flyk remembers and remove any of them;
• Calling Flyk from the app: if you tap Call instead, the app opens your phone's own dialer to Flyk's number with a one-time code. The app records nothing. When the call comes in, the code links the call, and the number you are calling from, to the app on your phone (see Section 3.7).

If an app sends push notifications and you allow them, we also receive a push token from Apple or Google so we can deliver them. You can turn notifications off at any time in your phone's settings.

2. How We Use Your Information

2.1 To Operate the Platform

• Create and maintain Business Owner and Client accounts;
• Generate, publish, and maintain Agent Cards and AFODP-compliant Business Owner profiles;
• Compute and maintain reputation trust scores based on verified attestations;
• Process Bookings and facilitate payments via Stripe Connect;
• Operate AI agent conversations between Clients and Business Owner agents;
• Manage calendar synchronization with connected third-party services;
• Enable masked communication sessions (where Twilio integration is active) between Business Owners and Clients without revealing real phone numbers to either party.

2.2 To Improve the Platform

• Analyze usage patterns to improve features and user experience;
• Debug, monitor, and improve the quality of agent replies — reviewing conversations when something goes wrong or when a surface is reported as inaccurate. We do not train AI models on your Content; if that ever changes we will update these terms and give notice first;
• Conduct research on matching quality, discovery effectiveness, and reputation signal accuracy.

2.3 To Communicate

• Send transactional communications: booking confirmations, reminders, payment receipts, integration status alerts;
• Send service notifications: credential verification results, subscription billing notices, credential expiry warnings;
• Send marketing communications with your consent, which you may opt out of at any time.

2.4 Legal Basis (for EEA/UK Users)

Where GDPR or UK GDPR applies, we process personal data on the following legal bases:

• Contract performance: processing necessary to deliver the Platform services you have requested;
• Legitimate interests: improving the Platform, preventing fraud, maintaining security, generating reputation signals, enabling discovery;
• Consent: marketing communications;
• Legal obligation: compliance with applicable laws and regulatory requirements.

3. How We Share Your Information

3.1 With Other Users

Business Owner profile information is shared publicly through the Platform and via Agent Cards discoverable by Consumer Agents. This includes name, business information, services, pricing signals, availability signals, trust score tier, and integration capabilities. Raw email addresses and personal phone numbers are not included in public Agent Cards.

Client identity is shared with the relevant Business Owner when a Booking is confirmed. Client information is not included in public-facing Agent Cards or AFODP discovery responses.

3.2 With Service Providers

We rely on a small number of third-party service providers to operate the Platform. They process data only on our instructions and only to provide their service to us — they may not use it for their own purposes. The categories:

All service providers are bound by data processing agreements requiring them to use data solely to provide services to flyk. The specific providers may change as the Platform evolves; our AI providers are named in Section 3.8, and the current list of all providers is available on request at privacy@flyk.app.

3.3 With Consumer Agent Platforms

Business Owner Agent Cards are accessible to Consumer Agent platforms (OpenAI, Anthropic, Google, Apple, Amazon, and others) via the AFODP protocol, MCP, UTCP, and published APIs. This is core to the Platform's purpose — enabling Business Owners to be discoverable by any AI agent without marketplace intermediaries. Business Owners can control discovery channel access via dashboard settings.

3.4 Legal Disclosures

We may disclose information as required by applicable law, court order, or government authority; to protect the rights, property, or safety of flyk, our users, or the public; or in connection with a corporate transaction (merger, acquisition, or sale of assets), with notice to affected users where legally required.

3.5 No Sale of Personal Data

flyk does not sell personal data to third parties for their own commercial purposes. This is consistent with our commitment to a business-owned, ad-free platform model. flyk products do not carry advertising, and we do not allow advertisers to target users through the Platform.

3.6 Mobile Phone Numbers and SMS Consent

When you provide your mobile phone number to flyk — by texting one of our numbers, booking an appointment, or verifying a business — we use it to respond to your messages and deliver one-time verification codes.

No mobile phone numbers or SMS opt-in consent data are ever sold or shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data will not be shared with any third party, except with SMS delivery providers acting on our behalf solely to deliver the messages you have requested.

You can opt out of SMS at any time by replying STOP to any message. Reply HELP for assistance.

3.7 Calls, Texts and Chat Answered by AI

Some Business Owners use flyk to answer their phone, texts, WhatsApp messages, and website chat. The channels a business can enable may change over time. When you call or message a flyk-powered number, or use a chat widget embedded on a business's website, you are interacting with an AI assistant, not a human employee of that business. The assistant identifies itself at the start of the conversation.

For phone calls: your speech is processed in real time and converted to text so the assistant can respond and so the business has a record of what you asked for. We do not retain a recording of the call audio — only the text transcript, kept per the retention table above. Transcripts and messages are visible to the Business Owner you contacted.

For texts and WhatsApp: reply STOP at any time to opt out, or HELP for help. Opting out is recorded durably by flyk, not only by your carrier. Text and WhatsApp messages are delivered through our communications provider and are subject to your carrier's or WhatsApp's own terms.

If you would rather not speak with an AI assistant, ask to be passed to the business directly, or contact the business through the phone number or website listed on its profile.

If you call Flyk from the Flyk Concierge app (Call instead), the call carries a one-time code that links the call, and the number you are calling from, to the app on your phone.

3.8 AI Providers

Flyk uses AI to answer people and to help Business Owners. To do that, we send some content to third-party AI providers. They process it as our service providers, on our instructions, to produce a result for us — not for their own purposes. Content is sent as it was written, so it includes any personal details you or a customer typed. We also use a web-search provider to find and verify business information; it never receives a person's chat. Our providers today:

Before your first chat in either app, a screen explains this and asks for your permission. If you decline, you can still use the parts of the app that do not use AI.

If we add or change an AI provider, we will update this list.

4. Data Retention

These are our target retention periods. We delete or anonymize data on request as described in Section 5, and we do not keep personal data longer than we need it for the purposes above or for a legal obligation. Automated enforcement of every period below is still being built, so some records may persist beyond their target until that work lands; request deletion at privacy@flyk.app and we will act on it.

4.1 What a deletion actually removes — and what it does not

There are two kinds of deletion, and they differ in scope:

• Deleting a single business removes that business and its data — conversations, bookings, client contacts, services, availability, and its AI agent configuration — and removes it from Flyk and from every AI-agent discovery surface. It is immediate and cannot be undone. Your account and any other businesses you own are unaffected.
• Deleting your account does the same for every business you own, and then removes your account itself. Your profile is permanently deleted, not archived or hidden.

In both cases we keep a small set of records, in the categories below. We keep them because we are permitted or required to — for fraud prevention, tax and financial-record obligations, and the ability to resolve a dispute — under GDPR Article 17(3) and CCPA §1798.105(d):

The principle, stated plainly: the money and ownership record stays, the person goes. Bookings are erased despite their financial relevance, because the payment record already carries what a tax or fraud enquiry needs without a client's name attached.

4.2 If you have a paid subscription

When you delete your account we cancel your subscription immediately and refund the unused remainder of the month you have already paid for. You do not need to cancel separately first, and you will not be charged again.

If we cannot cancel your subscription for a technical reason, we stop and delete nothing rather than leave you paying for an account we have erased — you keep your records, and we will contact you to complete the deletion.

4.3 Deleting your data from the apps

You can delete your data yourself:

• Flyk Business: go to Account › Delete account. This is the account deletion described in Sections 4.1 and 4.2, including the subscription cancellation and refund;
• Flyk Concierge: go to Account › Delete my account. This removes, right away and for good, your Concierge account and everything saved with it — the email you sign in with, your people (including contact details you saved for them), your chats with Flyk and with businesses, and what Flyk remembers. The phone you delete from is forgotten too, including its device ID; any other phone signed in to the account is signed out and clears its own copy the next time it checks in. There is no restore. You can also remove a single person, a single note, or a single business chat at any time;
• Without the app: visit flyk.app/delete-account to delete your account and its data yourself, or email privacy@flyk.app.

Delete your Flyk Concierge account on the web

If you use Flyk Concierge without an account, what is saved against your device is deleted after 12 months without use (see the table above), or sooner if you ask us.

5. Your Privacy Rights

5.1 All Users

Regardless of location, you have the right to:

• Access: request a copy of the personal data we hold about you;
• Correction: request correction of inaccurate data;
• Deletion (Right to Be Forgotten): delete your account from your dashboard or from either app (Section 4.3), or ask us to delete a single business at privacy@flyk.app. Deletion is immediate and permanent. Section 4.1 lists exactly what is removed and the small set of records we keep, and why. If you have a paid subscription we cancel it and refund the unused part of the month;
• Data portability: export your Business Owner profile, reputation attestations, and cryptographically signed portable reputation document at any time via the dashboard;
• Opt-out of marketing: unsubscribe from marketing emails at any time via the unsubscribe link in any email or by contacting privacy@flyk.app.

5.2 California Residents (CCPA / CPRA)

California residents have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know the categories and specific pieces of personal information collected, and the purposes for which they are used;
• Right to delete personal information, subject to exceptions for legal compliance and legitimate business purposes;
• Right to opt out of the sale or sharing of personal information (we do not sell or share personal information for cross-context behavioral advertising);
• Right to correct inaccurate personal information;
• Right to limit use and disclosure of sensitive personal information;
• Non-discrimination: we will not discriminate against you for exercising any of these rights.

To submit a verifiable consumer request, contact privacy@flyk.app. We will respond within 45 days.

5.3 EEA and UK Residents (GDPR / UK GDPR)

EEA and UK residents have the right to:

• Object to processing based on legitimate interests;
• Restrict processing in certain circumstances;
• Withdraw consent at any time where consent is the legal basis (withdrawal does not affect the lawfulness of processing before withdrawal);
• Lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your EU member state's DPA).

Flyk is not certified under the EU-US Data Privacy Framework. Where personal data is transferred from the EEA or UK to the United States, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable) together with supplementary technical measures, including encryption in transit and at rest.

To exercise any rights, contact us at privacy@flyk.app. We will respond within 30 days (or within applicable legal timeframes where shorter deadlines apply).

6. Data Security

We implement the following technical and organizational measures to protect your data:

• Encryption in transit: TLS 1.3 for all data in transit;
• Encryption at rest: AES-256 for databases and storage; AWS KMS envelope encryption for integration credentials and sensitive fields;
• Credential isolation: per-provider KMS encryption contexts make cross-provider credential decryption cryptographically impossible;
• Credential ephemerality: integration credentials are decrypted in memory only at the moment of use and are explicitly cleared from memory after each tool call;
• Access controls: role-based access control (RBAC) with tenant isolation; principle of least privilege across all system components;
• Audit logging: all access to sensitive data, credential events, and tool calls are logged in an immutable audit log;

No security system is impenetrable. In the event of a data breach that creates a risk to your rights and freedoms, we will notify affected users and regulators as required by applicable law, including within 72 hours for GDPR-covered breaches where feasible.

7. Cookies and Tracking

We use only strictly necessary cookies:

• Strictly necessary cookies: required to operate the Platform (session management, authentication, security). These cannot be disabled.
• No analytics cookies: we do not run third-party analytics on the Platform, so there is nothing to opt out of and no consent banner to click through.
• No advertising cookies: we do not use advertising, retargeting, or third-party behavioral tracking cookies.

You may block or delete cookies via your browser settings; note that blocking strictly necessary cookies will prevent you from signing in.

8. Children's Privacy

The Platform is not directed to children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children below these ages. If we become aware that we have collected information from a child without appropriate parental consent, we will delete it promptly. If you believe a child has provided us personal information, contact us at privacy@flyk.app.

Our mobile apps are not directed to children either: Flyk Business is a tool for business owners, and Flyk Concierge is intended for adults.

9. Changes to This Policy

We may update this Privacy Policy from time to time as the Platform evolves or as legal requirements change. We will provide notice of material changes via email or prominent platform notification at least 14 days before changes take effect. The updated effective date will be reflected at the top of this document. Your continued use of the Platform after the effective date constitutes acceptance of the revised policy.

10. Contact Us

For urgent security or breach-related matters, please include "URGENT" in your subject line.