Privacy Policy

This policy explains what personal data Flatfight handles, why, for how long, and what you can ask us to do about it. The short version: we collect what we need to fight your disputes and nothing more, we set no tracking cookies, we never sell data, and your customers' data is used only for your disputes.

1. Who is responsible

Flatfight is a product of Dripwork, a business registered in Finland. Under the General Data Protection Regulation (GDPR), the data controller for the processing described in sections 3 to 8 is:

We have not appointed a Data Protection Officer, as Article 37 of the GDPR does not require one for us. Privacy questions go to the address above.

2. Our two roles

• Controller. For people who visit flatfight.com, use the free calculator, email us, or sign in to Flatfight for their business, we decide how their data is used. This policy covers that.
• Processor. For the data our customers' businesses send us or let us read from Stripe about their customers (cardholders), the business is the controller and we process the data on its instructions, under our Data Processing Agreement. Section 9 summarises it. If you are a cardholder and want to exercise your rights, contact the business you paid. We will help them answer you.

3. Visiting the website

Server logs. Our web server records each request so we can deliver the site and protect it from abuse: your IP address, browser user agent, the page requested (without query strings) and the time. Cookies and authorisation headers are removed before logging.

• Legal basis: our legitimate interests in keeping the service available and secure (Article 6(1)(f)).
• Retention: the logs rotate automatically and are overwritten, normally within 30 days.

Analytics. We count visits with Umami, which we host ourselves on the same EU servers. It sets no cookies and does not store your IP address. It records the page, the referring site, browser, operating system, device type and country, so we can see which pages help people. Nothing is shared with advertising networks.

• Legal basis: legitimate interests in understanding how the site is used (Article 6(1)(f)).

4. Cookies

Flatfight sets one cookie, ff_session. It keeps you signed in and protects forms against cross-site request forgery. It is strictly necessary, so it needs no consent, and it expires after 30 days or when you sign out. We use no analytics, advertising or social media cookies. That is why there is no cookie banner.

5. Your Flatfight account

When you or your team use Flatfight, we process:

• Account details: team members' email addresses, your business name and website, time zone and settings.
• Sign-in records: one-time sign-in links (stored only as a hash), the IP address that requested them, and sign-in times.
• Audit log: what was done in the account, by whom, when, and from which IP address. Examples are submitting evidence, accepting a dispute and changing settings.
• Service emails: the dispute notifications we send to your team.

• Legal basis: performing our contract with your business (Article 6(1)(b)). For sign-in records and the audit log, also our legitimate interests in security and in being able to show who approved a submission (Article 6(1)(f)).
• Retention: for as long as the account exists. Sign-in links are deleted a day after they expire. Audit entries older than your retention setting are deleted with the disputes they relate to. Deleting your account deletes all of it immediately.

6. Billing

Paid plans are sold through Stripe Managed Payments. Link, a Stripe company, resells Flatfight subscriptions as merchant of record. Link collects your payment details, handles taxes and invoices, and is an independent controller for that data under its own privacy policy. We never see your full card details.

We receive and store your plan, subscription status, billing period, payment dates and amounts, and the Stripe customer and subscription identifiers, so we can unlock your plan.

• Legal basis: performing our contract (Article 6(1)(b)), and keeping records the law requires (Article 6(1)(c)).
• Retention: for as long as the account exists. Accounting records are kept as long as the Finnish Accounting Act requires.

7. The free calculator

The calculator reads your last 12 months of disputes from Stripe with a restricted key you paste in. The key and the dispute data are used once, in memory, and are never stored. We keep only the totals (number of disputes, currency and the estimated fees) so you can open and share the result. Totals contain no personal data.

If you ask us to email you a PDF of your report, we store your email address with those totals.

• Legal basis: taking the step you asked for (Article 6(1)(b)).
• Use: sending the report, and replying if you write back. We do not add you to a mailing list.
• Retention: 12 months, then deleted automatically. Ask us and we will delete it sooner.

8. If you contact us

When you email us, we receive whatever you put in the message: your email address, your name if you include it, and the content.

• Legal basis: legitimate interests in answering people who contact us (Article 6(1)(f)), or steps at your request before or under a contract (Article 6(1)(b)).
• Retention: while the matter is open, then up to 24 months, so we can follow up on recurring issues.

Please do not email us your customers' personal data, passwords or API keys. Use the app instead.

9. Data we process for our customers

To fight a business's disputes, Flatfight processes data about that business's customers:

• from Stripe: the customer's name, email, billing and shipping address, purchase IP address, card checks (AVS, CVC, 3D Secure), the card's brand, last four digits and fingerprint, payments, subscriptions, invoices and refunds. We never receive full card numbers;
• from the business: product activity (such as logins, downloads and lessons completed, with time, IP address, user agent, device and account identifiers), its policies, and customer messages it uploads;
• generated by us: case scores, evidence drafts and PDF documents.

We use this data only to prepare and submit that business's dispute responses, as described in the DPA. The business chooses how long it is kept (6 to 36 months after a dispute is decided, default 18). Open disputes are never deleted early.

10. Who processes data for us

We keep the list of providers short. They act on our instructions under data processing agreements:

Link (Stripe) is not on this list because it acts as an independent controller for billing (section 6). When you connect Stripe, data flows between your own Stripe account and Flatfight; Stripe is your provider, not ours.

We do not sell personal data or share it for advertising. We disclose data to authorities only when the law requires us to.

11. International transfers

Our servers and backups are in the EU. Anthropic, Resend, Sentry and Zoho are companies based in the United States or with US operations. Where personal data is transferred outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses, by an adequacy decision such as the EU-US Data Privacy Framework where the provider is certified, or by another safeguard permitted under Chapter V of the GDPR. Ask us for a copy of the relevant safeguards.

12. How long we keep things

13. Your rights

The GDPR gives you the following rights over your personal data:

• Access. Ask whether we hold data about you, and get a copy.
• Rectification. Have inaccurate data corrected.
• Erasure. Ask us to delete data, where there is no overriding reason to keep it.
• Restriction. Ask us to pause processing while something is being resolved.
• Portability. Receive data you gave us in a machine-readable format. Account owners can export everything as a ZIP file from Settings.
• Objection. Object to processing based on legitimate interests.

To use any of these, email privacy@flatfight.com. We answer within one month, as Article 12(3) requires, and tell you if a complex request needs longer. It is free.

Flatfight scores dispute cases automatically, but this is about the strength of evidence, not a decision about a person. Every outcome is decided by the card issuer, and submissions are approved by the business. We make no decisions with legal or similarly significant effects on individuals in the sense of Article 22.

14. Complaints

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to a supervisory authority. Ours is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto) in Finland, at tietosuoja.fi. If you live in another EEA country, you can complain to your local authority instead.

15. Security

Everything travels over HTTPS. Stripe tokens and API keys are encrypted at rest and never logged. Backups are encrypted before they leave the server. Access to production is limited to the operator. Our security page has the details.

16. Children

Flatfight is a business tool and is not directed at children. We do not knowingly collect data from anyone under 16.

17. Changes to this policy

If we change how we handle personal data, we update this page and the date at the top. For significant changes we also email account owners before the change applies.