This Privacy Policy describes how Flikac ("Flikac," "we," "our," or "us") collects, uses, discloses, stores, and protects personal information when you visit www.flikac.com or use the Flikac software platform. Flikac is an Illinois-based software-as-a-service (SaaS) company providing estimating, invoicing, and related business management tools for contractors.
This document is a comprehensive template intended for publication and should be reviewed by legal counsel before launch to ensure it reflects your final business operations, integrations, and regulatory obligations.
1. Scope
This Privacy Policy applies to visitors of the website, registered users, trial users, business customers, prospective customers, and individuals whose information is processed through the Services.
2. Information We Collect
We may collect account information, profile information, billing information, payment-related metadata, customer records uploaded by users, communications, support requests, usage information, device identifiers, IP addresses, cookies, browser information, log files, and analytics data.
3. Customer Data
Our users may upload names, addresses, phone numbers, email addresses, project details, estimates, invoices, photographs, files, and similar information relating to their own customers. In connection with such information, Flikac generally acts as a data processor or service provider on behalf of the user.
4. How We Use Information
We use information to provide and improve the Services; authenticate users; create estimates and invoices; provide customer support; detect fraud; maintain security; comply with legal obligations; communicate regarding accounts; send service notifications; and develop new features including OCR, PDF generation, automation, and AI-assisted tools.
5. Legal Bases
Where applicable under the GDPR, processing is based upon contract performance, legitimate interests, consent, legal obligations, and other lawful bases.
6. Cookies
We use essential cookies, authentication cookies, security cookies, analytics cookies and, where permitted, marketing cookies. Users may manage cookies through browser settings or our cookie consent mechanism.
6a. Invoice and estimate tracking
When a contractor emails you an invoice or estimate, that email contains a small invisible image hosted by us. If your email application loads it, we record the date and a count, so the contractor can see roughly when their document was opened. Many email applications block this image, and some load it automatically without you reading anything — so it is an approximate signal rather than a record of what you read.
We also record the date and a count each time the invoice or estimate page itself is opened using the link in that email.
What we store for this is a timestamp and a number, against the document. We do not record your IP address, your location, your device or your email application for this purpose. If you would rather not be counted, blocking images in your email application prevents the first of these, and the document remains fully readable.
7. Payments
Paying a contractor. Where a contractor has connected a Stripe account, their customers may pay an invoice by card through the Services. Card details are entered on a payment page hosted by Stripe and are never transmitted to, or stored on, Flikac's servers. The contractor is the merchant for those payments and Stripe is the payment processor; Flikac does not receive, hold or disburse the funds.
For each payment attempt we retain the amount, the currency, the outcome, the identifiers Stripe assigns, and — where Stripe provides them — the card brand and the last four digits, so that a payment can be identified and reconciled against an invoice. We do not store complete payment card numbers or card security codes.
Flikac subscriptions. Flikac's own paid plans are not yet available and we do not collect payment card details for them. When they are introduced, processing will be performed by Stripe and that payment information will be governed by the processor's privacy policy.
8. Third-Party Service Providers
We use the following third-party service providers to operate the platform. Each receives only the information needed for its function.
- Bluehost — website and database hosting.
- Amazon Web Services (Amazon SES) — delivery of email sent by the Services.
- Stripe — payment processing and contractor account onboarding. Receives the card details a customer enters on Stripe's own payment page, and the identity and business details a contractor provides when connecting a payment account. See Section 7.
- OpenAI — speech-to-text transcription for the voice entry feature. Receives the audio you record. See Section 17.
- Anthropic — AI-assisted drafting of estimate text. Receives the project description you provide. See Section 17.
We do not currently use analytics providers, advertising providers, or third-party customer support tools. We may add or change service providers as the Services develop; changes will be reflected in this list and communicated as described in Section 18.
9. Data Sharing
We do not sell personal information. Information may be shared with service providers, affiliates, professional advisors, law enforcement where required, or during a merger, acquisition, or asset sale.
10. International Transfers
Where information is transferred outside the country of collection, appropriate safeguards may be implemented where required by applicable law.
11. Data Retention
Information is retained only as long as reasonably necessary for legitimate business purposes, legal compliance, dispute resolution, enforcement of agreements, backup integrity, and fraud prevention. Where we can state a specific period, we do:
- Closed accounts. When an account is closed, its data enters a 30-day grace period during which the closure can be reversed. After 30 days the company record and its associated data are permanently deleted.
- Voice recordings. Audio submitted for transcription is deleted from our servers immediately after the transcript is returned, on both the success and failure paths. It is never stored in our database. The resulting text is retained with the estimate it belongs to.
- Estimates, invoices and customer records. Retained for as long as the account is active, because they are the user's own business records, and then deleted with the account as described above.
- Operational logs. Records of email delivery and of automated feature usage are retained without a fixed period at present. We intend to publish a specific schedule for these, and this section will be updated when we do.
12. Security
We maintain administrative, technical, and physical safeguards designed to protect information, including encryption where appropriate, access controls, authentication measures including optional two-factor authentication, logging, and encrypted transmission to our service providers. No method of transmission or storage is completely secure.
13. User Rights
Subject to applicable law, individuals may request access, correction, deletion, portability, restriction of processing, objection to processing, or withdrawal of consent where consent is the legal basis.
14. California Privacy Rights
California residents may have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and limit certain processing of personal information.
15. Illinois Notice
Flikac is headquartered in Illinois. Illinois law may provide additional protections depending upon the nature of information processed. We comply with applicable Illinois privacy and data security laws.
16. Children's Privacy
The Services are not directed to children under 13, and we do not knowingly collect personal information from children.
17. AI Features
Flikac offers AI-assisted features, currently as a limited beta. When you use them, the content you provide is transmitted to the AI service providers identified in Section 8 and processed only to return the result you requested.
- AI-assisted estimate drafting — the project description you enter is sent to Anthropic to produce draft estimate text. You review and edit that draft before using it.
- Voice entry — the audio you record is sent to OpenAI for transcription and returned to you as text. The audio file is deleted from our servers immediately after transcription and is not retained. We keep only the resulting transcript, the length of the recording, and the processing cost, which are used for usage metering.
Flikac does not use your content to train AI models. We access these providers through their business APIs under terms that do not permit content submitted through those APIs to be used to train their models; their processing of that content is otherwise governed by their own terms.
18. Changes
We may update this Privacy Policy from time to time. Material changes will be communicated through the website, dashboard, or email where appropriate.
19. Contact
Privacy requests may be directed to privacy@flikac.com (recommended) or another designated privacy contact published by Flikac.
Additional Provisions
Flikac may maintain audit logs, backups, and system records for security, business continuity, legal compliance, and platform reliability. Users remain responsible for ensuring they have appropriate authority to upload customer information and for complying with all applicable privacy laws when using the Services.