Effective date: April 30, 2026
Last updated: April 30, 2026
This Privacy Policy ("Policy") explains how Alternative Data Pte. Ltd., a private limited company incorporated in Singapore, with its registered office at 68 Circular Road, #02-01, Singapore 049422 ("Flash AI", "we", "us", or "our"), collects, uses, discloses, transfers, and safeguards personal data when you visit or use the website at flash.ai and the related products, applications, dashboards, APIs, and services we make available (collectively, the "Service"). It also describes your choices and the rights you have over your personal data.
This Policy is written to comply with the Singapore Personal Data Protection Act 2012 ("PDPA"), the European Union General Data Protection Regulation ("GDPR"), the United Kingdom Data Protection Act 2018 and UK GDPR, the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), and other applicable data-protection laws.
By creating an account or otherwise accessing or using the Service, you acknowledge that you have read this Policy. If you do not agree with our practices, do not use the Service.
1. Who We Are and How to Contact Us
The data controller (or, under PDPA, the organisation responsible for personal data) is:
Alternative Data Pte. Ltd.
68 Circular Road, #02-01
Singapore 049422
Email: [email protected] (privacy matters)
Email: [email protected] (legal notices)
Email: [email protected] (general support)
1.1 Data Protection Officer (GDPR Article 37 and PDPA section 11(3))
We have designated the following entity as our Data Protection Officer ("DPO") under Article 37 of the GDPR, the equivalent provision of the UK GDPR, and section 11(3) of the PDPA. The DPO is the single point of contact for any question, complaint, access request, correction request, deletion request, or other data-protection matter relating to the Service:
Financial Technology OÜ
Attn: Data Protection Officer for flash.ai
Narva mnt 5
Kesklinna linnaosa
Tallinn, Harju maakond 10117
Estonia
Email: [email protected]
You may contact the DPO at [email protected] in any official EU language or in English. For convenience you may also continue to use [email protected]; messages received at that address are routed to the DPO for matters that fall within the DPO's remit.
1.2 EU / UK Representative (GDPR Article 27)
For users located in the European Economic Area ("EEA") or the United Kingdom, our designated Article 27 representative is the same entity that serves as our DPO:
Financial Technology OÜ
Narva mnt 5
Kesklinna linnaosa
Tallinn, Harju maakond 10117
Estonia
Email: [email protected]
You, and any supervisory authority, may contact the representative directly with respect to any matter related to the processing of your personal data under the GDPR or UK GDPR. The representative acts on our behalf and may be addressed in addition to, or instead of, Alternative Data Pte. Ltd.
2. Scope
This Policy applies to personal data we process about (a) visitors to flash.ai, (b) registered users of the Service, including users on free and paid plans, (c) members invited to a Team workspace by an organisation customer, (d) participants in our Affiliate Program, (e) users of our public APIs, and (f) people who contact us by email or other channels.
This Policy does not apply to data processed by third-party services that you choose to integrate, by AI providers under their own terms (see Section 6), or by websites that link to or from the Service.
3. Personal Data We Collect
We collect the following categories of personal data:
3.1 Information you provide directly
- Account information: name, email address, password (stored as a one-way salted hash), profile photograph, country, language preference, time zone, and, optionally, organisation name.
- Identity verification: if we are required to verify your identity (for example, to investigate suspected fraud or to comply with a legal request), we may ask for additional information such as a government-issued ID.
- Billing and payment information: if you subscribe to a paid plan or purchase prepaid credits, our payment processor (Stripe) collects your payment card details, billing address, and tax-relevant information. Flash AI does not store full card numbers; we receive a tokenised reference, the card brand, the last four digits, and the expiration month and year. We retain invoice records as required by Singapore tax law.
- User Content (prompts and outputs): the text prompts, chat messages, files (including documents and PDFs), images (including images uploaded for vision analysis or as references), audio recordings (including voice samples for cloning), video reference material (including likeness images for AI Influencer features), brand guidelines, and other inputs you submit to the Service, together with the outputs the Service returns to you (collectively, "User Content").
- Voice and likeness data: if you use voice cloning, you upload audio samples; if you use the AI Influencer feature, you upload still images and/or video of a face. These constitute biometric or biometric-derived data in some jurisdictions and are treated as Sensitive Personal Data (see Section 4).
- Team and organisation data: if you join or are invited to a Team workspace, we collect the email address used for the invitation, the role assigned to you, and any User Content you submit within that Team. The Team owner has administrative visibility into Team activity.
- Affiliate Program data: if you enrol in the Affiliate Program, we collect the payout method (such as PayPal email, bank account information, or another supported method), tax-relevant information where required, and metadata about referrals you generate.
- API access data: if you generate an API key, we record the key (stored hashed), the time of creation and last use, and metadata about API requests (endpoint, status code, token consumption, IP address).
- Communications: support requests, survey responses, feedback, and other messages you send to us, together with any attachments.
- Marketing preferences: your choices about receiving promotional emails and other marketing communications.
3.2 Information we collect automatically
- Device and connection data: IP address, approximate location derived from IP, browser type and version, operating system, device identifiers, screen resolution, referring URL, and pages visited.
- Usage data: the features you use, the AI models you select, prompts per session (counts, not contents, for analytics), token and credit consumption, latency, error reports, and feature performance telemetry.
- Log data: server logs containing the date and time of requests, endpoints accessed, HTTP status codes, and identifiers needed to investigate security or abuse incidents.
- Cookies and similar technologies: see Section 11.
3.3 Information we collect from third parties
- Identity providers: if you sign in using a third-party identity provider (such as Google), we receive the basic profile information that the provider releases to us based on your authorisation: typically your name, email address, profile photograph, and a unique identifier.
- Payment processors: we receive transaction status, charge amount, currency, dispute and refund information, and limited card metadata from Stripe.
- Affiliate referrals: if you arrive at the Service through an Affiliate link, we record the affiliate's identifier and the timestamp of your arrival.
- Anti-fraud and abuse: we may receive risk signals and reputation data from anti-fraud and security vendors.
4. Sensitive Personal Data
Voice samples uploaded for voice cloning and facial images or video uploaded for the AI Influencer feature are biometric or biometric-derived data and are treated as Sensitive Personal Data under the PDPA, Article 9 of the GDPR, and equivalent laws.
We process such data only:
- with your explicit consent, given when you upload the sample;
- for the specific, narrow purpose of generating the cloned voice or generated video that you request;
- without using it to train any general-purpose model;
- with deletion available to you at any time from your dashboard.
By uploading a voice sample or facial likeness, you represent and warrant that (a) it is your own voice or likeness, or (b) you have obtained the prior written, informed, and revocable consent of the individual whose voice or likeness it is, that you can produce that consent on request, and that the use you intend does not violate any law (including laws prohibiting non-consensual intimate imagery, deceptive election content, or impersonation). Uploads of public figures, deceased persons, or minors without verifiable consent are prohibited.
5. How We Use Personal Data and Legal Bases
We use personal data for the purposes listed below. Where the GDPR or UK GDPR applies, we also identify the legal basis on which we rely.
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Create and authenticate your account; provide the Service to you | Performance of a contract (Art. 6(1)(b)) |
| Process payments, manage subscriptions, apply credits, issue invoices | Performance of a contract; legal obligation (Art. 6(1)(b), (c)) |
| Forward your prompts to the AI provider you selected and return the output | Performance of a contract (Art. 6(1)(b)) |
| Process voice samples or facial likeness to generate the requested output | Explicit consent (Art. 9(2)(a)) |
| Respond to support requests, send service announcements | Performance of a contract; legitimate interests (Art. 6(1)(b), (f)) |
| Send promotional emails about new features or related products | Consent (Art. 6(1)(a)); legitimate interests for existing customers (Art. 6(1)(f)) |
| Monitor for fraud, abuse, security incidents; enforce the Terms of Service | Legitimate interests in protecting the Service (Art. 6(1)(f)) |
| Calculate and pay Affiliate commissions; investigate suspected affiliate fraud | Performance of a contract; legitimate interests (Art. 6(1)(b), (f)) |
| Analyse aggregate usage to improve the Service | Legitimate interests (Art. 6(1)(f)) |
| Comply with legal obligations and respond to lawful requests | Legal obligation (Art. 6(1)(c)) |
We do not use your User Content, your prompts, your voice samples, your facial likenesses, or any other input to train Flash AI's own machine-learning models, and we do not authorise the third-party AI providers to do so on our behalf where they offer a "no training" or "zero retention" mode for API customers (we route requests through that mode by default; see Section 6).
6. AI Providers and Output Generation
To deliver AI features the Service forwards your inputs to third-party AI providers, which may include (depending on the model you select and the features you use):
- OpenAI (GPT family, DALL-E, Whisper, TTS)
- Anthropic (Claude family)
- DeepSeek
- Google (Gemini family)
- ElevenLabs (voice generation and cloning)
- Replicate (image and video models)
- Stability AI / Stable Diffusion
- Azure OpenAI Service
- OpenRouter (model routing)
- Other model and inference providers we may add or remove from time to time.
These providers process your inputs solely to generate the response that is returned to you, subject to their own terms and privacy commitments. You should assume that any text, image, audio, video, or document you submit will leave Flash AI's servers and be processed by the relevant provider for the duration of the request. Do not submit information you are not authorised to share with those providers.
Where the underlying provider offers a "no training" or "zero retention" mode for API customers, we route requests through that mode by default. We cannot, however, guarantee the data-handling practices of any third party.
We retain your prompts and the corresponding outputs in your account history so that you can revisit, continue, or export your conversations and generations. You can delete individual conversations, individual generations, or your entire history at any time from your dashboard.
7. How We Share Personal Data
We do not sell personal data, and we do not share personal data for cross-context behavioural advertising. We share personal data only as described below.
7.1 Service providers (data processors)
- Cloud infrastructure: DigitalOcean (server hosting, Singapore region) and Cloudflare (DNS, CDN, WAF, DDoS protection).
- AI providers: as listed in Section 6.
- Payment processing: Stripe (and other gateways we may add for local methods).
- Email delivery: Resend.
- Customer support tools, error monitoring, and product analytics as we adopt them, listed and updated in our subprocessor inventory available on request.
These vendors process personal data on our behalf under contractual confidentiality and security obligations and may only use the data for the purposes we direct.
7.2 Within a Team workspace
If you are a member of a Team workspace, the Team owner and administrators may have visibility into the User Content you submit within that workspace, including prompts, generations, and consumption data. They may also remove your access to the workspace at any time. If you create personal projects, do so in your personal workspace, not in a Team workspace.
7.3 Affiliate Program
If you arrive at the Service through an Affiliate's link and subsequently sign up or make a payment, the Affiliate may be informed that a referral occurred and may receive aggregate or limited identifying information about the referral (such as the timestamp, plan purchased, and commission amount) so that we can pay the commission and so the Affiliate can understand performance.
7.4 Legal and safety
We may disclose personal data if we believe in good faith that disclosure is required by law, regulation, court order, or government request; necessary to enforce our Terms of Service; necessary to investigate or prevent fraud, security incidents, or harm to any person; or necessary to establish, exercise, or defend legal claims.
7.5 Business transfers
If Flash AI is involved in a merger, acquisition, financing, restructuring, or sale of all or a portion of its assets, personal data may be transferred as part of that transaction. We will notify you and provide any choices required by law.
7.6 With your consent
We may share personal data for any other purpose disclosed to you at the time, with your consent.
8. International Transfers
Flash AI is operated from infrastructure located in Singapore. The third-party providers listed above may process personal data in the United States, the European Union, the United Kingdom, India, Singapore, and other jurisdictions where they or their subprocessors operate.
For transfers from the EEA or the UK to a country that has not received an adequacy decision from the European Commission or the UK Information Commissioner, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (2021/914) supplemented where necessary by the UK International Data Transfer Addendum.
For transfers from Singapore, we comply with section 26 of the PDPA by ensuring that the recipient is bound by legally enforceable obligations to provide a standard of protection comparable to that under the PDPA.
You may request a copy of the safeguards that apply to a specific transfer by contacting [email protected].
9. Data Retention
We retain personal data only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required by law.
| Category | Retention period |
|---|---|
| Account profile | For the life of your account; deleted within 30 days of account closure (subject to legal holds). |
| User Content (prompts, files, outputs) | Until you delete it or close your account; backups purged within 90 days. |
| Voice samples and facial likenesses | Until you delete the asset; deleted within 30 days of account closure. |
| Billing and tax records (invoices, receipts) | Five years after the relevant transaction, as required by Singapore tax law. |
| Server logs and security telemetry | Up to 12 months. |
| Support communications | Three years from last contact. |
| Affiliate Program records | Five years after the last commission, as required by tax law. |
| Inactive accounts | Accounts with no sign-in activity for 12 consecutive months may be deleted following 30 days' email notice (see Terms of Service). |
10. Your Rights
Depending on where you live, you may have the following rights with respect to personal data we hold about you:
- Access: request confirmation of whether we process your personal data and a copy of that data.
- Correction (rectification): ask us to correct inaccurate or incomplete information.
- Deletion (erasure): ask us to delete your personal data, subject to limited exceptions (such as legal retention duties).
- Portability: receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller.
- Restriction or objection: restrict or object to our processing on legitimate-interests grounds, including for direct marketing.
- Withdraw consent: withdraw any consent you previously gave, without affecting the lawfulness of processing performed before withdrawal.
- Automated decision-making: the Service does not subject you to decisions based solely on automated processing that produce legal or similarly significant effects on you.
- Lodge a complaint: with your local data-protection authority (see Section 14 for the Singapore PDPC; see also Sections 12 and 13 for region-specific notes).
To exercise any of these rights, email our Data Protection Officer at [email protected] — or, for convenience, [email protected] — from the email address associated with your account. We respond within the timeframe required by applicable law (typically 30 days under the GDPR and UK GDPR, extendable by a further two months for complex requests with notice to you, and as soon as reasonably possible under the PDPA). We may need to verify your identity before fulfilling certain requests, and we may decline a request that is manifestly unfounded or excessive.
You will not be discriminated against for exercising any of these rights.
11. Cookies and Similar Technologies
We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service against fraud, attribute Affiliate referrals, and understand how the Service is used.
| Category | Purpose | Examples |
|---|---|---|
| Strictly necessary | Authenticate you, prevent CSRF, store locale, store theme, store consent choices. | session, XSRF-TOKEN, locale, theme |
| Functional | Remember UI preferences and recently used templates. | preferences cookies |
| Analytics (first-party) | Understand which features are used, where errors occur, and aggregate performance. | analytics cookies |
| Affiliate attribution | Record the Affiliate that referred you so we can pay the correct commission. | affiliate, ref |
You can control cookies through your browser settings. Disabling strictly necessary cookies may prevent parts of the Service from functioning. Where required by law, we will request your consent before setting non-essential cookies.
12. Notice for European Economic Area, United Kingdom, and Switzerland Residents
If you are located in the EEA, the UK, or Switzerland, the data controller is Alternative Data Pte. Ltd. (Section 1). The legal bases on which we rely are set out in Section 5. You have the rights set out in Section 10 plus the right to lodge a complaint with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.
Our designated Data Protection Officer (Article 37) and our Article 27 representative is Financial Technology OÜ, Narva mnt 5, Kesklinna linnaosa, Tallinn, Harju maakond 10117, Estonia, reachable at [email protected]. You may address the DPO directly for any data-protection question, complaint, or rights request, in any official EU language or in English; you do not need to contact the controller in Singapore first.
The lead supervisory authority for our representative is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee); you remain free to lodge a complaint with the supervisory authority of your own jurisdiction.
13. Notice for California Residents
The CCPA/CPRA grants California residents the rights described in Section 10 (under the labels "right to know", "right to delete", "right to correct", "right to portability", and "right to limit use of sensitive personal information"). Flash AI does not "sell" personal information and does not "share" personal information for cross-context behavioural advertising as those terms are defined in the CCPA/CPRA.
You may exercise your rights by emailing [email protected]. You may designate an authorised agent to make a request on your behalf, in which case we will require proof of authorisation and may ask you to confirm directly with us that you have authorised the agent.
14. Notice for Singapore Residents (PDPA)
For PDPA matters, you may contact our Data Protection Officer at [email protected] (Section 1.1) or, for convenience, at [email protected]. If your concern is not resolved to your satisfaction, you may contact the Personal Data Protection Commission of Singapore at www.pdpc.gov.sg.
15. Children
The Service is not directed to children under the age of 13 (or under the age of 16 in jurisdictions where that higher age applies). We do not knowingly collect personal data from children below those ages. If you believe a child has provided us with personal data, contact [email protected] and we will take steps to delete the information.
16. Security
We implement administrative, technical, and physical safeguards designed to protect personal data, including:
- encryption in transit using TLS 1.2 or higher;
- hashed passwords using a modern adaptive hashing algorithm;
- encryption at rest for sensitive credentials and tokens;
- role-based access controls and the principle of least privilege;
- isolated production environments;
- vendor due diligence and contractual data-protection commitments;
- regular software updates and dependency monitoring;
- logging and monitoring for suspicious activity.
No method of transmission over the internet or electronic storage is 100% secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials and any API keys confidential, and for promptly notifying us at [email protected] if you suspect unauthorised use.
17. Data Breach Notification
In the event of a personal data breach that is likely to result in significant harm or that meets the notification threshold under the PDPA, GDPR, UK GDPR, or other applicable law, we will notify the relevant supervisory authority and affected individuals without undue delay and in any event within the timeframe required by the applicable law.
18. Third-Party Links and Integrations
The Service may contain links to, or integrations with, third-party websites and services. We are not responsible for the privacy practices or content of those third parties. Review their privacy policies before sharing personal data with them.
19. Changes to this Policy
We may update this Policy from time to time. If we make material changes, we will post the updated Policy on this page and update the "Effective date" above. Where required by law, we will provide additional notice (for example, by email or an in-product banner) before the changes take effect. Your continued use of the Service after the updated Policy takes effect constitutes your acceptance of the changes.
20. Contact
If you have any questions, complaints, or requests regarding this Policy or our processing of your personal data, you may contact either of the following:
Data Protection Officer and EU / UK Article 27 representative
Financial Technology OÜ
Attn: Data Protection Officer for flash.ai
Narva mnt 5
Kesklinna linnaosa
Tallinn, Harju maakond 10117
Estonia
Email: [email protected]
Operator (data controller)
Alternative Data Pte. Ltd.
68 Circular Road, #02-01
Singapore 049422
Privacy: [email protected]
Legal notices: [email protected]
General support: [email protected]
For any matter governed by the GDPR or UK GDPR — including access, rectification, erasure, restriction, portability, objection, withdrawal of consent, or a complaint — you may address the DPO directly at [email protected].