Last updated: July 1, 2026

Privacy Policy

This Privacy Policy describes how Flatgrin (“Flatgrin,” “we,” “us,” or “our”), collects, uses, shares, and protects personal information when you visit flatgrin.online, use our team task management and project progress tracking services (the “Services”), or communicate with us. By using our website or Services, you acknowledge the practices described here. If you do not agree, please do not use the Services.

1. Information we collect

We collect information that you provide directly, information generated through your use of the Services, and limited information from third parties you connect to Flatgrin. Account and profile information may include your name, work email address, password or authentication credentials, company name, job title, team size, and preferences you configure in the product. When you request a demo or contact us, we collect the details you submit in forms, including optional messages and team-size selections.

Workspace content is information that your organization chooses to store in Flatgrin, such as task titles, descriptions, comments, assignees, due dates, project names, attachments, activity history, and configuration of boards and reports. We process this content to provide the Services to your organization. Depending on your plan and settings, we may also process integration tokens and metadata needed to sync with tools such as messaging, calendar, or development platforms that an administrator connects.

Usage and device data include log information (IP address, browser type, referring pages, timestamps), approximate location derived from IP, product interaction events (for example, feature usage and performance metrics), and diagnostic data that help us maintain reliability. Payment-related information for paid plans is typically processed by our payment processors; we receive limited billing metadata such as plan tier, invoice status, and last four digits of a card where applicable, rather than full card numbers in our primary application systems.

2. How we use information

We use personal information to provide, operate, and improve the Services—including authenticating users, displaying and syncing tasks and progress, delivering notifications you or your admin enable, and generating reports within your workspace. We use contact and account data to respond to inquiries, schedule demos, provide customer support, and send service-related messages such as security alerts, billing notices, and material product updates.

We also use aggregated or de-identified analytics to understand feature adoption, capacity planning, and reliability trends. Where permitted by law and your communication preferences, we may send product education or marketing messages about Flatgrin; you can unsubscribe from marketing emails using the link in those messages. We do not use customer workspace content to train third-party general-purpose models for unrelated commercial products, and we do not sell personal information as that term is commonly understood under U.S. state privacy laws.

We may process information as necessary to enforce our Terms of Service, prevent abuse and fraud, protect the rights and safety of users and Flatgrin, and comply with legal obligations. If we pursue a legitimate interest, we balance that interest against your rights and expectations.

3. How we share information

We share information with service providers that process data on our behalf under contractual confidentiality and security obligations. Categories include cloud hosting and storage providers, email and customer support tools, analytics infrastructure, payment processors, and security monitoring vendors. These providers may access personal information only to perform services for Flatgrin and not for their own independent marketing.

Within a customer organization, workspace content and certain profile information are visible to other members according to roles and permissions set by your administrators. If your organization connects integrations, data may flow to and from those third-party services under your configuration; their privacy practices are governed by their own policies. We may disclose information if required by law, subpoena, or governmental request, or if we believe disclosure is necessary to protect rights, property, or safety. In connection with a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of the transaction, subject to continuing privacy protections where required.

4. Security

Flatgrin implements administrative, technical, and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption in transit using industry-standard protocols, access controls and authentication for production systems, logging and monitoring of administrative activity, and employee access limited by role. No method of transmission or storage is completely secure; we cannot guarantee absolute security, but we work continuously to reduce risk and to respond appropriately to incidents.

Customers are responsible for maintaining the confidentiality of account credentials, configuring workspace permissions thoughtfully, and promptly revoking access when teammates leave the organization. If you believe an account has been compromised, contact us immediately at privacy@flatgrin.online or hello@flatgrin.online.

5. Your rights and choices

Depending on your location and applicable law, you may have rights to access, correct, delete, or export personal information we hold about you; to object to or restrict certain processing; and to withdraw consent where processing is based on consent. Workspace administrators may manage many account and content requests directly in the product. Individual users may also contact privacy@flatgrin.online to submit a request. We may need to verify your identity and, for organization-controlled data, direct you to your employer or workspace admin when they are the controller of that information.

You may update profile details in account settings, opt out of non-essential marketing emails, and control many notification preferences in the product. If you are in the European Economic Area, United Kingdom, or similar jurisdictions, our legal bases for processing may include contract performance, legitimate interests, consent, and legal obligation. Where we transfer personal information internationally, we use appropriate safeguards recognized under applicable law.

6. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, measure site and product performance, and understand how visitors navigate our marketing pages. Essential cookies are required for core functions such as authentication and security. Analytics cookies help us improve the website and Services; where required by law, we obtain consent before setting non-essential cookies. You can control cookies through browser settings, though disabling certain cookies may limit functionality. We do not use cookies to enable third-party advertising networks to track you across unrelated sites for the purpose of selling your personal information.

Logs and analytics may retain IP addresses and device identifiers for security and operational purposes for periods consistent with our retention practices. Marketing pages may load fonts or scripts from content delivery networks; those providers receive standard technical request data when your browser fetches resources.

7. Data retention

We retain personal information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Account information is generally retained while the account remains active and for a reasonable period thereafter for backup, audit, and legal purposes. Workspace content is retained according to customer configuration and plan, including enterprise retention options where available. When retention ends, we delete or de-identify information in accordance with our procedures, subject to residual copies in secure backups that expire on a rolling schedule.

8. Children

The Services are designed for business use and are not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact privacy@flatgrin.online and we will take appropriate steps to delete it.

9. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page and, where appropriate, provide additional notice through the Services or by email. Continued use of the Services after an update constitutes acceptance of the revised policy to the extent permitted by law.

10. Contact us

For privacy questions, requests, or complaints, contact Flatgrin at:

Flatgrin
Email: privacy@flatgrin.online

We will review and respond to legitimate requests in accordance with applicable law. If you are not satisfied with our response, you may have the right to lodge a complaint with a supervisory authority in your jurisdiction.