FLATLAY, Inc. Privacy Policy

Last Updated: August 10, 2026

FLATLAY, Inc. (the "Company" or "FLATLAY") prides itself on ensuring the privacy of its clientele and other visitors to its website (the "Site") and users of its applications, including the FLATLAY Social Commerce application for Shopify (collectively, the "Apps"). This privacy policy is one step we take in our commitment to the fair treatment of private information and to protecting your privacy rights.

This policy is an agreement between the Company, as operator of the Site and the Apps, and you as a user. It tells you when this policy is effective, what information we collect, how we use it, how you can review or change information you provided to us, how we may change this policy, and the steps we take to protect your information. Contact information is at the end.

This privacy policy is published at https://flatlay.io/privacy.

Agreement to the terms of the policy and terms of use

This policy covers information collected on the Site, through our Apps, and in connection with a FLATLAY account.

This policy covers both visitors to the Site and registered users of the Site and the Apps. All activities in which you may engage are voluntary. You are not required to provide personal information unless you choose to access features that require it. If you do not agree with this policy or our terms of use, you should not provide us with personal information and should discontinue use of the Site and the Apps.

Although we operate the Site and the Apps, the nature of our products and services requires interaction with third parties, third-party websites, and third-party service providers. We do not own, operate, maintain, or control those third parties, and this policy informs you only of our own internal practices.

The terms of use of the Site and the Apps are expressly incorporated by reference. Please read this policy carefully, as it affects you directly.

Effective date & agreement changes

This privacy policy is effective as of the Last Updated date above and remains in effect except with respect to provisions changed in the future, in which case the changes become effective on the date they are posted or we otherwise notify you. We reserve the right to change this policy at any time. Your continued use of the Site after we post modifications constitutes your acknowledgment of the modified policy. We will revise the Last Updated date when we post changes.

What information do we collect?

This policy does not extend to anything inherent in the operation of the Internet and beyond the Company's control, and is not to be applied contrary to applicable law or governmental regulation.

The information we collect falls into three categories: (i) information you provide to us, (ii) information we collect while you use the Site, the Apps, or your account, and (iii) information we collect from elsewhere. We do not ask for your Social Security Number, driver's license, financial-institution credentials, or other government identification.

Information you give us

We may ask you for "personal information" (also known as personally identifiable information), which may include your name, email address, or telephone number. If you do not provide requested personal information, you may not be able to access certain features. When you register for an account, we will ask you for personal information. We may also request your feedback regarding the Site or the Apps.

Information we collect when you visit the Site or use the Apps

When you first come to the Site we collect information that does not identify you personally ("general information"). This may include your Internet Protocol (IP) address, which identifies your device on a TCP/IP network. General information, including click stream data and cookies, may be collected whenever you access the Site, whether or not you provide personal information. When you use our Apps, we may collect a device identifier assigned by the device maker, carrier, or operating system.

When you use a mobile device to access the Site or Apps, we may collect information about your physical location if location services are enabled and device permissions allow it. You can opt out by changing the preferences and permissions on your device.

Information we collect elsewhere

We may collect information made available publicly, including information you submit to a blog, chat room, or social network. We may also collect information about you from other companies or organizations in order to correct inaccurate information.

Shopify merchant and customer data

This section governs data FLATLAY receives through its Shopify application and takes precedence over any more general statement in this policy.

What we access. When a Shopify merchant installs our application and authorizes it, we read a deliberately minimal set of order fields for the merchant's own orders: the order identifier, order note attributes, financial status, cancellation timestamp, and creation timestamp.

What we do not access. We do not request, read, or store customer names, postal addresses, email addresses, telephone numbers, or payment details. Our application does not request the read_customers or read_all_orders permissions, and automated tests in our codebase enforce that these permissions are never requested.

Why we access it. Solely to attribute a referral we originated to a resulting merchant order, so that merchants and their partners can see which referrals produced sales. We use this data for no other purpose.

Who we share it with. We do not sell this data, and we do not share it with third parties for their own research, marketing, promotional, or advertising purposes. It is shared only with the sub-processors listed below, strictly as necessary to operate the service, under contractual confidentiality and security obligations.

How long we keep it. Order attribution records are retained no longer than necessary for the attribution purpose above and are deleted thereafter. Records generated by data-deletion requests are retained only for the limited period needed to evidence compliance, and then automatically expire.

Deletion and merchant requests. We implement Shopify's mandatory privacy webhooks — customers/redact, customers/data_request, and shop/redact — as well as app/uninstalled. Requests received through these endpoints are authenticated and honored; a shop/redact request results in deletion of the associated data. A merchant may also contact us directly using the details below.

Sub-processors

We use the following sub-processors to operate the service. This list is kept current; material additions will be reflected here.

How do we collect this information, and how do we respond to Do Not Track signals?

You may voluntarily provide general and personal information to the Company through the Site.

We may use cookies to gather information about your visits and enhance your experience. A cookie is a small string of information transferred to your device for identification purposes. Cookies help us understand your preferences and improve your experience, and are used for functions such as remembering your username. You can turn off all cookies or have your browser warn you when cookies are used by adjusting your browser settings. Rejecting cookies may limit functionality and access to some features. For more information about cookies, including how to refuse them, see www.allaboutcookies.org.

When you visit the Site we may also collect click stream data (server address, domain name). This may be combined with information you provided at registration to analyze and customize your visits, and for traffic or e-commerce analysis.

Do Not Track. We honor "Do Not Track" (DNT) signals and Global Privacy Control (GPC) signals. When your browser or device transmits a DNT or GPC signal to us, we treat it as a request to opt out of tracking and of any sale or sharing of your personal information, and we do not track you across third-party websites for advertising purposes. You do not need to be a resident of any particular jurisdiction for us to honor this signal.

How do we use this information?

We use general information to keep the Site and the Apps performing well. This includes troubleshooting, resolving disputes or complaints, managing administrative tasks, keeping you updated, enforcing agreements, complying with legal requirements, and cooperating with law enforcement.

We may use the general and personal information you provide to offer and provide products and services, including:

• To administer a promotion, survey, or contest and to provide relevant products or services;
• To send you information by email about products, offers, and news we think may interest you. You can opt out in your account settings or at the time your account is set up;
• To protect FLATLAY's rights and property, as well as the rights and property of others;
• To analyze visits to the Site and understand the interests of our visitors in aggregate and for internal operations, including troubleshooting, data analysis, testing, research, and service improvement;
• To allow service providers to help us provide services, as described below;
• To process your purchases of products and services;
• To respond to your customer service inquiries and requests for information;
• To post your comments or statements on the Site, where you have chosen to submit them;
• To maintain and improve the Site, the Apps, and the products and services we offer;
• To detect, prevent, or investigate security breaches or fraud; and
• To maintain appropriate records for internal administrative purposes.

We do not sell your personal information, and we do not disclose it to third parties for those third parties' own research, marketing, promotional, or advertising purposes.

We may disclose your information:

• To respond to subpoenas, court orders, or legal process;
• To investigate, prevent, defend against, or take other action regarding violations of our Terms of Service, illegal activities, suspected fraud, or situations involving potential threats to the legal rights or physical safety of any person or the security of our network, Site, or Apps;
• To respond to claims that any posting or other content violates the rights of third parties;
• In an emergency, to protect the health and safety of our users or the general public; or
• As otherwise required by applicable law.

Important information about third parties and website links

FLATLAY's Site and the information collected through it are managed and controlled by FLATLAY, Inc., located at 8 The Green, Ste A, Dover, DE 19901. The servers that make the Site available may be located in multiple regions. If you are located outside the United States, please note that information you provide will be transferred to FLATLAY, and by submitting the information you authorize this transfer. FLATLAY has entered into agreements with its hosting providers to provide safeguards for the protection of your data consistent with this policy.

We provide some services through contractual arrangements with affiliates, service providers, and partners ("service partners"). Service partners may use your personal information only to operate our sites and deliver their services to us — for example, hosting providers and parties who assist us in operating the Site or analyzing collected data. These parties may use your data only for the purpose of carrying out work as agreed with us and are required to keep the information confidential.

For your convenience we may include links to third parties on the Site. This privacy policy does not apply to third-party websites. Those sites have their own privacy policies, and although we seek to protect the integrity of our Site, FLATLAY is not liable for the content and activities of those sites. Your access to such websites is at your own risk. Those sites may send their own cookies, collect data, or solicit personal information.

As is the nature of business today, the Company may be acquired by or merged with another company, or go through another corporate event or change, including bankruptcy protection. In any of these scenarios, your personal or general information may transfer to the new entity. Information you provide after such an event may be governed by another privacy policy.

How do we protect your information?

Security measures. To protect the personal and general information we receive, we have implemented security measures including authentication of your identity through sign-in and password verification, and validation of your email address. Data is encrypted in transit using current TLS standards.

Risk of interception. Whenever you provide personal information online there is a risk that third parties may intercept and use that information. While FLATLAY strives to protect your personal information and privacy, we cannot guarantee the security of any information you disclose online, and any information you provide through the Site is provided at your own risk.

What can you do about deleting or modifying your data?

You may opt out of receiving messages from FLATLAY. You may also request that all of your personal information be deleted from our database. To opt out, or to delete or modify your personal information, email us at support (at) theflatlay.com. We encourage you to contact us promptly when your personal information changes.

Shopify merchants may additionally exercise deletion rights through the Shopify privacy webhooks described above.

How old do you have to be?

FLATLAY intends only persons who are 13 years or older to use this website. FLATLAY is committed to protecting the privacy of children and has no intention of collecting personal data from children under the age of 13. We encourage parents and guardians of children under 18 to monitor their children's online activities. We do not knowingly collect personal information from anyone under the age of 13. If we learn or have reason to suspect that a user is under age 13, we will promptly delete any personal information in that user's account.

Retention and legal demands

We may access, preserve, and share your information in response to a legal request (such as a search warrant, court order, or subpoena) where we have a good-faith belief that the law requires us to do so. This may include responding to legal requests from jurisdictions outside the United States where we have a good-faith belief that the response is required by law in that jurisdiction, affects users in that jurisdiction, and is consistent with internationally recognized standards. We may also access, preserve, and share information where we have a good-faith belief it is necessary to detect, prevent, and address fraud or other illegal activity; to protect ourselves, you, and others, including as part of investigations; or to prevent death or imminent bodily harm. We may retain information from accounts disabled for violations of our terms for at least a year to prevent repeat abuse.

Security best practices — how you can help stay safe

We take your security seriously, and you should too. We recommend adopting healthy security habits, including:

• Protect your username and password, and do not share them.
• If you receive an email related to our Company that you believe may not be legitimate, tell us as soon as possible at support (at) theflatlay.com. We will never ask you in an email to provide your password.
• Change your password regularly.
• Do not reuse passwords across online accounts.
• Choose a password that is easy for you to remember but difficult for others to guess.
• Be cautious on public Wi-Fi, and limit the sensitive data you send over public networks.
• When entering sensitive information into a website, confirm the URL begins with https.

A global reality: locality, choice of law, and your privacy rights

FLATLAY, Inc. is a Delaware corporation with its registered office in Dover, Delaware. We recognize that not all of our users are located in the United States. If you are outside the United States, please be aware that your local privacy rules and regulations may differ from those applicable to us. By providing us with your information and using the Site or the Apps, you consent to having your information sent to the United States for processing, storage, and maintenance. You also consent to the application of the laws of the State of Delaware and applicable U.S. federal laws to all matters related to this privacy policy, our terms of use, and our application agreements, without regard to conflict-of-laws principles.

Your privacy rights

We extend the following rights to all of our users, regardless of the state or country in which you reside. You may:

• Know what categories of personal information we collect about you, the purposes for which we use it, and the categories of parties with whom we share it — all of which are described in this policy;
• Access a copy of the personal information we hold about you;
• Correct personal information that is inaccurate;
• Delete your personal information, as described in "What can you do about deleting or modifying your data?" above;
• Opt out of marketing communications at any time; and
• Opt out of tracking, including by transmitting a Do Not Track or Global Privacy Control signal, which we honor as described above.

We do not sell your personal information, and we do not share it with third parties for their own direct-marketing purposes. Because we do not engage in those practices, there is no separate disclosure to request regarding them.

To exercise any of these rights, email support (at) theflatlay.com, or write to FLATLAY, Inc., ATTN: Legal, 8 The Green, Ste A, Dover, DE 19901. We will make every effort to respond promptly, and in any event within thirty (30) calendar days. There is no charge for exercising these rights, and we will not discriminate against you for doing so.

How to contact us

If you have questions or comments about the Site or this privacy policy, email support (at) theflatlay.com with the subject line "Privacy Policy," or write to us at the address below.

Post: FLATLAY, Inc., 8 The Green, Ste A, Dover, DE 19901

Email: support (at) theflatlay.com