Flaggity Privacy Policy

Flaggity Inc. is a Delaware corporation ("Flaggity," "we," "us," or "our") that operates a production and quality management platform for fabricators and manufacturers at flaggity.com. We are committed to protecting the personal information of our users and the companies they represent.

If you have questions about this Privacy Policy or how we handle your data, contact us at privacy@flaggity.com.

This Privacy Policy applies to:

• Visitors to flaggity.com and our marketing pages
• Users who create a Flaggity account
• Team members invited to a Flaggity account by their employer
• Companies and organizations that subscribe to Flaggity ("Customers")

This policy does not apply to third-party websites or services linked from our platform.

We use the data we collect exclusively for the following purposes:

• Providing, operating, and maintaining the Flaggity platform
• Processing your transactions and managing your subscription
• Sending transactional communications — account confirmations, inspection certificates, team invitations, password resets, and security alerts
• Sending operational notifications — certification expiry alerts, procurement deadline alerts, CAPA overdue alerts, and weekly AI digest reports (where applicable to your plan)
• Sending product communications — updates, new features, and occasional news about Flaggity (only where you have opted in and only where permitted by applicable law)
• Improving the platform based on usage patterns and feedback
• Detecting, investigating, and preventing fraudulent, unauthorized, or illegal activity
• Complying with legal obligations
• Enforcing our Terms of Service

We do not sell your personal data to third parties. We do not use your personal data for advertising purposes. We do not share your data with third parties except as described in Section 5 of this policy.

We retain your data for as long as your account is active and for a reasonable period thereafter to comply with our legal obligations, resolve disputes, and enforce our agreements.

Specifically:

• Account data: retained for the duration of your subscription plus 3 years after account closure
• Inspection and quality records: retained for the duration of your subscription plus 7 years — inspection records may have legal and regulatory significance for our customers
• Financial and billing records: retained for 7 years to comply with tax and accounting regulations
• Usage and technical logs: retained for 24 months
• Deleted user data: when a user account is deleted at the request of a Master Admin or through our account deletion process — personal identifiers are removed within 30 days. Operational records (inspections, NCRs, reports) are anonymized rather than deleted to preserve the integrity of quality records for the company account.
• Closed company accounts: all data deleted within 90 days of account closure upon written request

Flaggity is based in the United States. If you access our platform from the European Union, United Kingdom, Canada, or other regions with laws governing data collection and use — your data will be transferred to and processed in the United States.

For transfers of personal data from the European Economic Area or United Kingdom to the United States — we rely on Standard Contractual Clauses approved by the European Commission as our transfer mechanism. You may request a copy of the applicable Standard Contractual Clauses by contacting privacy@flaggity.com.

For Canadian users — we comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation.

Depending on where you are located you may have the following rights regarding your personal data:

Right of Access:

You may request a copy of the personal data we hold about you.

Right of Rectification:

You may request that we correct inaccurate personal data.

Right of Erasure:

You may request that we delete your personal data. Note that we may retain certain data where required by law or where deletion would compromise the integrity of quality records that have legal significance. Account deletion requests must be submitted to privacy@flaggity.com and will be processed within 30 days of verification of your identity. We do not offer self-serve account deletion — all deletion requests are reviewed and processed by Flaggity to ensure the integrity of quality records and the protection of all parties.

Right of Portability:

You may request an export of your personal data in a structured, machine-readable format.

Right to Object:

You may object to processing of your personal data for direct marketing purposes at any time by using the unsubscribe link in any marketing email or by contacting privacy@flaggity.com.

Right to Restrict Processing:

In certain circumstances you may request that we restrict processing of your personal data.

Right to Withdraw Consent:

Where we process your data based on your consent — you may withdraw that consent at any time without affecting the lawfulness of processing before withdrawal.

Exercising Your Rights:

To exercise any of these rights contact us at privacy@flaggity.com. We will respond within 30 days. We may need to verify your identity before processing your request. We will not discriminate against you for exercising your privacy rights.

EU and UK Residents:

If you are located in the EU or UK and believe we have not addressed your concerns adequately — you have the right to lodge a complaint with your local supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu. The UK supervisory authority is the Information Commissioner's Office at ico.org.uk.

Canadian Residents:

If you are located in Canada and have concerns about our privacy practices — you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.

Our security measures include:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of sensitive data at rest
• Role-based access control ensuring users only access data appropriate to their role
• Complete data isolation between company accounts — no company can access another company's data
• Regular security testing and vulnerability assessment
• Access logging and audit trails for all data access and modifications
• Webhook encryption and secure credential storage
• Rate limiting and brute force protection on authentication endpoints
• OWASP security headers on all responses
• MongoDB injection protection

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data we cannot guarantee absolute security. In the event of a data breach that is likely to affect your rights and freedoms we will notify you and relevant supervisory authorities within the timeframes required by applicable law.

Flaggity is a business-to-business platform designed for manufacturing and industrial operations. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected data from a minor please contact privacy@flaggity.com and we will delete it promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes we will:

• Update the effective date at the top of this policy
• Notify active users by email at least 30 days before changes take effect
• For material changes that affect how we process data — request renewed consent where required by law

Your continued use of Flaggity after the effective date of a revised policy constitutes your acceptance of the changes.

Privacy inquiries:
privacy@flaggity.com

General support:
support@flaggity.com

Mailing address:
Flaggity Inc.  8 The Green, Suite A, Dover, DE 19901, United States