Privacy Policy

Version 2026-11-03

Bu belge İngilizcedir. Rusça olarak da mevcuttur: Русский.

This policy explains what Flatma stores about you, why, and who else sees it. Flatma is run by LLP Aivitu Project, Republic of Kazakhstan. Questions and requests: [email protected].

We follow the law of the Republic of Kazakhstan “On personal data and their protection” and, for people in the European Union, the EEA, the United Kingdom and Switzerland, the General Data Protection Regulation (GDPR).

What we store

• Account: your email address, a hash of your password (never the password itself) or, if you sign in with Google, your Google account ID; your plan and its dates; your AI tokens; the author name you choose for public projects; your settings, such as units of length; when you accepted these terms.
• Projects: the projects you save, their earlier versions, covers and descriptions of published projects, and the pictures you upload. A project you haven’t saved yet stays only in your browser.
• Companies: for a company account — the company’s name, phone, email, address and logo, its site, price list, offers, CRM and the people of the company. What a company keeps about its clients — see “Data of companies’ clients” below.
• Payments: what you bought, the price, currency and date, and the email given at checkout. Card details go straight to the payment provider — we never see them.
• AI: how many tokens each request used and which tools it called. The text of your questions and the pictures you attach are sent to the AI provider to get an answer; we don’t keep them on our servers.
• Technical data: your IP address and the times of logins, sign-ups, saves and AI requests — to protect the service from abuse and to apply limits; the browser of each login session; reports of errors in the studio (the message, the page, the browser) — to fix them.

Cookies and your browser’s storage

• Needed for Flatma to work: cp_sid keeps you logged in (30 days after your last visit); lang remembers your language; id and hash keep you logged in on the older parts of the site if you had an account there; city remembers the city you chose among the makers; fm_ai counts the AI questions of a visitor on a company site; cookie_consent remembers your answer about cookies. Your browser also keeps drafts of your projects and your settings (theme, interface mode and the like) on your device.
• Analytics: on the information pages of flatma.com — the home page, articles and the older parts of the site — Yandex Metrica, Google Analytics and Microsoft Clarity show us how people use these pages: visits, clicks, scrolling. Clarity also records how a page is used (mouse movements and clicks, not what you type). The studio and your account have no analytics.
• Ads: in the studio on wide screens, for visitors and the Free plan — Google AdSense, or the Yandex Advertising Network in Russia and neighbouring countries. Ad networks use cookies to show and measure ads and may personalise them. Paid plans have no ads.
• In the EU, the EEA, the UK and Switzerland analytics and ad cookies are used only with your consent: analytics — after you press Accept in the cookie bar, ads — after you agree in Google’s consent window. You can withdraw your consent at any time.

Why we use it

• To run your account, keep your projects, take payments and give you what you paid for — this is our contract with you (the Terms of Service).
• To protect the service, apply the limits of plans and fix errors — our legitimate interest in a service that works and is safe.
• Analytics and personalised ads — your consent where the law requires it, otherwise our legitimate interest in knowing how the site is used and in paying for the Free plan.
• Payment records — because tax and accounting law requires them.

We don’t sell your data, and we don’t use it to make automated decisions about you.

Who else sees it

• Everyone — public projects with their author name. Never your email.
• Companies — when you send a request through a company’s site or reply to its offer, the company sees what you sent.
• Providers who work for us, each only what it needs: Google Cloud — our servers and database (a data centre in Finland, EU); Cloudflare — delivers the site outside Russia and stores uploaded pictures; DeepSeek (China) and, as a reserve, Anthropic (USA) — the text of AI requests, a description of your model and attached pictures, only when you use the AI designer; WaveSpeed AI — a picture of your scene and your wish, only when you order an AI render; PayPro Global and Robokassa — payments; Mailjet — emails such as a password reset; Google — sign-in, if you choose it; Google, Yandex and Microsoft — analytics and ads, as described above.
• Authorities — only when the law requires it.

Data of companies’ clients

Companies on Flatma keep data of their clients here: requests from their sites, offers and the client’s replies, CRM cards. For this data the company decides what is collected and why — it is the controller, and Flatma stores and processes the data on its behalf. If you are a client of a company, ask that company about your data; we’ll help it answer.

Data abroad

Our servers are in the EU (Finland). The company that runs Flatma is in Kazakhstan, and some of the providers above are in other countries, including the USA and China, where data protection may be weaker than where you live. We send each provider only what it needs for its job.

How long

• Your account and projects — as long as the account exists. A deleted project stays in the trash for 30 days and is then removed for good, with its versions. Earlier versions are kept as your plan allows.
• Login sessions — 30 days after your last visit. Records of logins and sign-ups kept for limits — 1 day.
• IP addresses in records of AI use and in error reports — up to 12 months.
• Payment records — as long as tax and accounting law requires (in Kazakhstan — 5 years).
• Records that prove something — when you accepted these terms or published a project, when a client accepted an offer — as long as the thing they belong to.
• Backups are overwritten automatically after a limited time; until then, something you deleted may still be in a backup.

How we protect it

Passwords are stored only as hashes, everything travels over HTTPS, and only the people who run Flatma have access to the servers and the database.

Your rights

You can see and change your data in your account, export your projects and delete them. You can also ask us for a copy of your data, to correct or delete it, to delete your account and everything in it, or to stop using your data for a purpose — write to [email protected]. We answer within 30 days. You can withdraw a consent at any time; this doesn’t affect what was done before. You can also complain to your data protection authority.

Children

Flatma isn’t meant for children under 16, and we don’t knowingly collect their data.

Changes

If this policy changes in a way that matters, we’ll tell you in the app or by email, and the date of the version above changes.