Skip to main content

    Privacy Policy / Datenschutzerklärung

    Version / last updated: 4 Jun 2026

    Controller and contact

    Controller: KROMA UG (haftungsbeschränkt), Halberstädter Str. 17, 28215 Bremen, Germany. Managing Director: Roman Koliada.

    Privacy contact (DSAR / GDPR requests): [email protected]. General legal: [email protected]. Security: [email protected]. Phone: +49 174 3503631.

    We have not appointed a separate Data Protection Officer; the managing director acts as the responsible point of contact under Art. 13(1)(b) GDPR.

    Product covered

    flyzle.com: AI-assisted content generation, website/social analysis, content planning, and publishing integrations across 73 social platforms.

    Data we process

    • Account data such as email, user ID, display name, avatar, authentication events, workspace/team membership, and plan/role data.
    • Profile, workspace, brand and business information entered during onboarding.
    • Website URLs submitted for analysis, generated strategies, roadmaps, posts, comments, media assets, scheduled posts, and approval/review data.
    • AI prompts, inputs, outputs, context, generated content, model job status, and safety/quality metadata.
    • Payment/subscription status, plan, invoices/receipts and customer portal references processed via Polar/payment providers; full card data is not stored by us.
    • Usage, operational, diagnostics, device/browser, IP/log, request ID, and security monitoring data.
    • For social/autoposting integrations: connected platform identifiers, authorization tokens/metadata (encrypted at rest), scheduled/published content, and analytics where enabled.

    Legal bases

    • Art. 6(1)(b) GDPR for account, contract, billing, core SaaS, AI generation, subscription and support processing.
    • Art. 6(1)(a) GDPR for optional cookies, marketing, connected integrations, and other consent-based features.
    • Art. 6(1)(f) GDPR for security, fraud prevention, abuse prevention, service improvement, necessary diagnostics, and legal-defense interests, balanced against user rights.
    • Art. 6(1)(c) GDPR for statutory retention, tax/accounting, and legal obligations.

    AI processing and automated output (EU AI Act transparency)

    Our services use third-party AI models (OpenAI, Google Gemini, Anthropic and others) to generate text, images, video scripts and analytics. AI output can be inaccurate, incomplete, biased, or unsafe and is provided for drafting/assistance — never as legal, tax, financial, medical, therapeutic or other professional advice. Users remain responsible for reviewing and approving content before use or publication. We do not perform fully automated decisions with legal or similarly significant effects on individuals under Art. 22 GDPR.

    Cookies, local storage and analytics

    Necessary storage is used for authentication and session support, app preferences, theme and language, service-worker behaviour, and consent records. Non-essential analytics and marketing storage is only enabled after explicit, granular consent via our cookie banner. See /cookies.

    Product analytics: with your analytics consent we use PostHog (EU Cloud, eu.i.posthog.com) on the basis of Art. 6(1)(a) GDPR to measure the conversion funnel (landing view → signup → first strategy → checkout → subscription). Autocapture and session recording are disabled. Events contain a pseudonymous device identifier, your Flyzle user ID once signed in, event name, page path and UTM/referrer values — never your email, prompts, brand data or generated content. Withdrawing consent stops collection immediately and clears the stored identifiers.

    Error monitoring and security telemetry (legitimate interest)

    We operate a privacy-hardened error and security monitoring layer (Sentry) on the basis of Art. 6(1)(f) GDPR (legitimate interest in detecting bugs, fraud, abuse, and security incidents). This layer is configured with sendDefaultPii=false, masks all UI text and input fields in any error replays, blocks media capture, strips authorization headers, cookies, IP addresses, email addresses and OAuth tokens from outgoing events, and caps performance tracing at ≤10%. No user-typed content, prompts, brand data, generated content, or payment details are sent. You may object at any time via [email protected] — we will then disable telemetry for your account.

    Recipients and processors (subprocessor list)

    We rely on a number of subprocessors to operate Flyzle. Where required under Art. 28 GDPR, we maintain a Data Processing Agreement or equivalent contractual safeguards with each processor, and we rely on EU Standard Contractual Clauses (2021/914) where data leaves the EU/EEA. The authoritative, live list of subprocessors — including the type of processing, hosting region and transfer mechanism — is maintained at /subprocessors. Material additions or replacements are announced at least 14 days in advance via email to billing contacts. The summary below is a snapshot at the time of this version of the policy and may lag behind /subprocessors.

    • Supabase (managed Postgres, auth, storage, edge functions) — EU region.
    • Cloudflare (CDN, DNS, edge caching, WAF) — global edge.
    • Polar Software Inc. (subscription billing, invoicing, Merchant of Record) — US; full card data never reaches our servers.
    • Google LLC — Gemini API (text/image/video generation) — US; per Gemini API enterprise terms, inputs and outputs are not used to train Google's foundation models.
    • OpenAI, L.L.C. (legacy AI generation paths) — US; per OpenAI API data policy, API inputs and outputs are not used for model training.
    • Anthropic PBC (Claude API, used selectively) — US; per Anthropic's commercial terms, API inputs are not used for training.
    • ElevenLabs Inc. (text-to-speech for video) — US.
    • HeyGen Labs Inc. (AI avatar video generation, including processing of user-supplied facial imagery — see "Avatar and biometric-style content" below) — US.
    • Creatomate B.V. (MP4 rendering pipeline) — Netherlands / EU.
    • Replicate Inc. (selective image/video model inference) — US.
    • Perplexity AI Inc., DataForSEO LLC, Firecrawl Inc. (research, SERP and crawl data) — US.
    • Zernio, Late and Upload-Post (scheduled cross-platform publishing) — only the social content and credentials you explicitly connect are shared.
    • Sentry (Functional Software Inc., privacy-hardened error monitoring) — EU region; configured with sendDefaultPii=false and PII scrubbing.
    • PostHog (product analytics / conversion funnel, consent-gated, autocapture and session recording disabled) — EU Cloud (eu.i.posthog.com).
    • Datadog, Inc. (server-side logs, metrics and traces; browser RUM currently inactive) — EU region (datadoghq.eu).
    • Resend (transactional email delivery) — US.
    • Pexels GmbH (royalty-free stock photo and video search/download for AI-generated videos and posts; only the derived search query is sent, no end-user PII) — EU/US (CDN).
    • GitHub Inc. (release-note automation, optional) — US.

    Connected social and messaging platforms (separate disclosure). When you explicitly connect an account, content and platform-issued OAuth credentials are transmitted to that platform, which then acts as an independent controller for what it stores, publishes and analyses. This currently includes — depending on which integrations you enable — Meta Platforms Ireland Ltd. (Facebook, Instagram, Threads, WhatsApp Business), LinkedIn Ireland Unlimited Company, TikTok Technology Ltd., X Corp. (X / Twitter), Google LLC (YouTube), Pinterest Europe Ltd., Reddit Inc., Telegram FZ-LLC, Discord Inc., Bluesky Social PBC, Mastodon gGmbH and instance operators, Snap Inc., Ghost Foundation, Dev.to / Forem Inc., Hashnode Inc. and others listed at /subprocessors. Each of these platforms processes data under its own privacy policy and may transfer data outside the EU/EEA.

    You may request the latest signed copy of the subprocessor list and the underlying DPAs at any time from [email protected].

    Google sign-in (OAuth)

    If you choose to sign in with Google, we receive only the basic profile scopes required for authentication: your Google account identifier (sub), primary email address, name, locale and profile picture URL. We use these solely to create and identify your Flyzle account.

    We do NOT request or receive access to your Gmail messages, Google Drive files, Google Calendar, Google Contacts, Photos, Search history or any other Google product data. You can revoke Flyzle's access at any time from your Google Account security page; this revokes future logins but does not delete data already stored in Flyzle — use /data-deletion for that.

    Avatar and biometric-style content (HeyGen / image inputs)

    If you upload a photo, voice sample, or pre-recorded video to generate an AI avatar (via HeyGen or a comparable provider), that input is transmitted to the provider for the sole purpose of producing the avatar or video you requested. Depending on the configuration this may include processing of facial imagery, voiceprints or other features that — while not used by us for identification — can qualify as special-category data under Art. 9 GDPR in some jurisdictions.

    By uploading such content you confirm that (i) you have all necessary rights and, where applicable, the explicit consent of any identifiable person depicted or recorded, (ii) you are not uploading the face, voice or likeness of a third party without their documented permission, and (iii) you will not use the generated avatar in a defamatory, deceptive, sexual, political-endorsement or otherwise unlawful manner. Uploads that appear to violate these rules may be removed and the underlying assets deleted from the avatar provider on request. Provider-side retention of avatar source material follows the relevant provider's terms; you may request its deletion via [email protected].

    AI prompts, brand inputs and generated outputs

    Prompts, brand passport data, uploaded reference materials, website analyses and similar inputs are processed solely for the purpose of generating, refining, scheduling and publishing the outputs you request, and for operating directly related features (quality checks, abuse prevention, retries, support). The legal basis is performance of the contract (Art. 6(1)(b) GDPR) and, for security/abuse-prevention aspects, our legitimate interest (Art. 6(1)(f) GDPR).

    We do not use your prompts, brand passport, generated content, analyses, or publishing data to train our own AI models, and we do not allow our AI subprocessors to use them to train their foundation models. We rely on the enterprise / API terms of Google (Gemini), OpenAI, Anthropic, ElevenLabs, HeyGen, Replicate and Creatomate, all of which contractually prohibit training on API inputs.

    AI providers may retain prompts and outputs in their own infrastructure for a short abuse-monitoring window (typically up to 30 days for OpenAI, up to 55 days for Google API logs, and similar windows for other providers) before automatic deletion. We do not have access to those provider-side logs and cannot expedite their deletion; data inside our own systems is purged or anonymised within the retention periods described in this policy.

    If an AI provider's terms change in a way that would weaken these protections, we will either renegotiate, replace the provider, or notify affected customers in advance before continuing to route their data through that provider.

    International transfers

    Where personal data is transferred outside the EU/EEA (e.g. US-based AI providers), transfers rely on an adequacy decision (EU-US Data Privacy Framework where applicable), EU Standard Contractual Clauses (2021/914), or another lawful transfer mechanism, supplemented by appropriate technical and organisational measures.

    Retention

    Account and workspace data is kept while the account is active. When you request deletion via /data-deletion or /profile, the account enters a 30-day deletion lock period and is then purged or anonymised by an automated cron job. Records required for tax, accounting, fraud prevention, security logs, dispute handling, or legal obligations may be retained for the statutory minimum (typically 6–10 years under German HGB/AO for invoicing-related records).

    Your rights

    You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3)). You can exercise data export and deletion self-service from /data-deletion and from your /profile page. For other requests, email [email protected]. You can also lodge a complaint with the competent supervisory authority — in our case the Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen.

    Children and minors

    The services are not intended for users below 16 years of age (Art. 8 GDPR, Germany).