Privacy policy
The Flipa privacy policy: what data of yours we process, what for, who we share it with, and how you can ask us to change it or delete it.
Last updated: 12 November 2026. The Spanish version of this page is the reference one.
1. Who the controller is
TRES PUNTOS COMUNICACIÓN SL, tax ID B66018490, Calle Sant Josep 22, 08921 Santa Coloma de Gramenet (Barcelona), Spain. Privacy contact: hola@trespuntoscomunicacion.es.
We process personal data in accordance with the General Data Protection Regulation (GDPR) and with Spanish data protection law.
2. If you write to us from this website
The contact form collects your name, your work email, the name of your company and, if you choose to, whatever you want to tell us.
- What for: to answer you.
- Legal basis: your request, made when you send the form.
- How long: as long as needed to deal with your message. At most 12 months from when you write to us, unless you ask us to delete it sooner.
If you write to us by email, we use your address and what you tell us to answer you.
3. If you use Flipa: two different roles
For your account data (name, email, use of the service) we are the controller.
For the content your company uploads to Flipa, which may include personal data of your customers or employees, your company is the controller and we act as processor: we process it only on your company's instructions, to provide the service. The terms of that processing are in the terms of use.
4. What data we process and what for
| Data | What for | Legal basis |
|---|---|---|
| Name, email and encrypted password | Creating the account and letting you sign in | Performance of the contract |
| Documents, notes and conversations | Answering and preparing texts with what your company knows | Performance of the contract (as processor) |
| Billing details: name, company, tax ID and address. Card details are kept by Stripe, not by us | Charging the plan and issuing invoices | Performance of the contract and legal obligation |
| Log of who did what and how much was consumed | Security, support and billing | Legitimate interest and contract |
| IP address in the activity log | Security and abuse prevention | Legitimate interest |
| Visits to this website: pages viewed, where you came from, approximate location and the random identifier in the Google Analytics cookie | Knowing which pages help and improving the website | Your consent, which you can withdraw under “Cookie settings” |
The activity log does not store passwords, keys, or the content of documents or conversations.
5. Who it is shared with
We do not sell data. To provide the service we work with these providers:
| Provider | What for | Where |
|---|---|---|
| Anthropic | The artificial intelligence that writes the answers. It receives the text needed for each answer. Under its commercial terms, it does not use this data to train its models. | United States, with the European Commission's standard contractual clauses |
| Hostinger | The server that holds the application and the database | United Kingdom, a country with an EU adequacy decision |
| Hostinger | Sending the application emails (welcome, team invitations, passwords), this website and contact form messages | United Kingdom and European Union |
| Stripe | Charging plans and top-ups, and invoices. Flipa never sees or stores the card | Ireland and United States, with the European Commission's standard contractual clauses |
| Statistics for this website (Google Analytics, through Google Tag Manager), only if you accept them in the cookie banner | Ireland (Google Ireland Limited) and the United States (Google LLC), under the EU-U.S. Data Privacy Framework and, in some cases, standard contractual clauses |
The server and the sign-in system are shared today with other services of the same owner. Flipa's data is kept in its own separate area.
If your company connects tools of its own, Flipa accesses them with the permission you give and for what you ask of it. What is looked up in them also passes through the artificial intelligence provider.
6. Google data
If your company connects Google Search Console or Google Analytics with its Google account, Flipa receives data through Google APIs. That connection with your own account is not open yet: what follows is how it works as soon as it is.
Flipabrain's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.
- What is read: the figures from Search Console (clicks, impressions, average position and queries) and from Analytics (sessions, visitors, engagement and key events) for the property chosen by whoever administers your account. Also the email address of the Google account that grants the permission, to show you which one it is connected with. The permission is read-only: Flipa changes nothing in Google.
- What for: to answer, inside Flipa, the questions of your own company, for example how a page is doing. We do not sell these figures, we do not use them for advertising, and we ourselves do not use them to train artificial intelligence systems.
- Where they are stored: the permission is stored, encrypted, together with that email address. The figures are not stored: they are looked up at the moment of answering and pass through the artificial intelligence provider that writes the answer. Any that end up written in an answer stay in that conversation, like any other text.
- How to withdraw it: in Flipa, under Connections (“Conexiones” in the app), with “Disconnect” (“Desconectar”), which deletes the permission and also revokes it at Google. Or from your Google account, at myaccount.google.com/permissions.
7. Your company's content
The documents, notes and conversations belong to your company. We do not use them to train artificial intelligence systems and we do not show them to other customers.
8. How they are protected
We describe what is in place, without adjectives:
- Each company has its own separate space, with two independent barriers: the server filters by company and, in addition, the database rejects anything that does not belong to whoever is asking.
- The keys of connected tools are stored encrypted and tied to their company.
- Passwords have a minimum of ten characters, and sign-in attempts are limited.
- A copy of the whole database is made every night and leaves the server for external storage.
- Removing a person or a company cuts off their access immediately.
We explain this in more detail, including what is still missing, in security.
9. How long they are kept
For as long as the account is active. Billing data, for the years required by law (six, under the Spanish Commercial Code). After the account is closed, the content is kept for 30 days in case you want to recover it and is then deleted, except for what the law requires us to keep. Backups are kept for 7 days on the server and 14 days outside it.
Today, export and deletion are done by our team by hand, when you ask for them.
10. Your rights
You can ask for access, rectification, erasure, objection, restriction and portability by writing to hola@trespuntoscomunicacion.es. You can also lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es).
11. Cookies and website statistics
The website only measures visits if you agree to it in the cookie banner. In that case we use Google Analytics, through Google Tag Manager, to see which pages are visited and how people reach them. The legal basis is your consent, and you can withdraw it at any time with “Cookie settings”, at the bottom of every page. We don’t use advertising.
- Who provides it: Google Ireland Limited, acting as processor.
- What data: pages viewed, where you came from, approximate location (city, region, country) and a random identifier stored in the _ga cookie. According to Google, for visits from the European Union it does not log or store the IP address: it uses it only to work out the approximate location and then discards it.
- How long: the period set in Google Analytics, 14 months at most, which is the limit of the free version. The cookies last as stated in the cookie policy.
- Transfers: data may pass to Google LLC, in the United States, under the EU-U.S. Data Privacy Framework and, in some cases, standard contractual clauses (Google’s page on data transfers).
The details are in the cookie policy.
12. Changes
If we change this policy in an important way, we will announce it here and, if you have an account, by email or inside the application.