Privacy Policy

01 Overview

This policy explains what personal data Flare ("Flare", "we", "us") collects when you use flares.in and the Flare application, why we collect it, who we share it with, and the choices you have. Flare is an organizational work system: it turns projects, meetings, and customer conversations into a context graph that humans and AI agents can act on — through the app, API, SDK, and MCP.

If your organization uses Flare, your organization (the "Workspace Owner") controls the account and is responsible for the instructions it gives us about your data. If you are a person reporting a bug through a Flare-powered widget embedded in someone else's product, that product's owner is the data controller and Flare processes your report on their behalf.

02 Data we collect

Account & workspace data - name, email address, password hash or OAuth identity, organization and workspace membership, role, and profile details you add.

• Product content you create: tickets, comments, project plans, epics, stories, tasks, acceptance criteria, risks, decisions, and project updates.
• Bug report evidence submitted through the Flare reporter widget or SDK: screenshots, annotated images, session replay recordings, console logs, failed network requests, device and browser metadata, and the URL or route at the time of capture.
• Meeting data: calendar events and metadata read from connected Google or Microsoft calendars, meeting recordings, transcripts, participant lists, and agent-generated outcomes, decisions, and follow-ups extracted from calls.
• AI-generated content: summaries, extracted requirements, generated plans, and other outputs our AI features produce from the content above.
• Billing data: your plan, subscription status, invoices, and usage counters. Card and payment details are collected and processed directly by our payment processor, not stored on our servers.
• API tokens and MCP session data: hashed personal access tokens, granted scopes, and an audit trail of the actions taken through the API or Model Context Protocol server.
• Usage and diagnostic data: log-in activity, feature usage, and, once you interact with the page, anonymized analytics events via Google Analytics.

03 Calendar and meeting data specifically

Connecting a calendar is optional and requires you to explicitly authorize Flare through Google or Microsoft sign-in. We request the minimum scopes needed to detect and schedule around meetings: read-only access to your calendar list and event details. We do not request access to send email, modify unrelated files, or read your inbox.

Recording a meeting requires a separate, explicit action. When enabled, our capture provider joins the call as a participant to record and transcribe it, and we log a consent event for that session. Anyone who does not want a call recorded should say so before it starts or leave before the recorder joins - your organization is responsible for following the recording-consent laws that apply in its jurisdiction and participants' locations.

You can disconnect a calendar or delete a meeting recording and its transcript at any time from within the app; doing so removes our access going forward and deletes the stored recording, subject to the retention rules below.

04 How we use data

• To operate Flare: authenticate you, run your workspace, and display your projects, tickets, and meetings.
• To power AI features: our agents read the content described above to triage tickets, plan projects, and extract meeting outcomes. AI processing for these features is performed using Google's Gemini models under a processing agreement that prohibits use of your data to train Google's general-purpose models.
• To provide evidence for bug reports: screenshots, recordings, and logs are made available to your team through short-lived signed URLs (typically valid for fifteen minutes) rather than public links.
• To bill your account through our payment processor, Razorpay, and send billing-related notices.
• To maintain security: we keep audit logs of sensitive actions (ticket changes, plan publication, agent task execution) so admins can review who changed what.
• To communicate with you about your account, changes to the service, or in response to a support request.

05 Who we share data with

We do not sell personal data. We share data only with the service providers that help us run Flare, each bound by a data processing agreement, and only to the extent needed to provide their service:

• Supabase - our database, authentication, and file storage provider.
• Vercel - application hosting.
• Google - Calendar API (calendar read access you authorize), Gemini API (AI processing described above), and Google Analytics (aggregated site usage).
• Microsoft - Outlook/Microsoft Graph calendar access you authorize.
• Recall.ai - joins and records meetings you choose to capture, and returns the recording and transcript to us.
• Razorpay - payment processing and billing.

We may also disclose data if required by law, to enforce our Terms of Service, or to protect the rights, safety, or property of Flare, our users, or the public.

06 Data retention

We retain workspace content for as long as your account is active. If you delete a project, ticket, meeting recording, or calendar connection, we remove it from active systems promptly and from backups within our standard backup rotation window. If you close your account, we delete or anonymize your personal data within a reasonable period, except where we must retain records to comply with legal, tax, or accounting obligations.

07 Security

Data is encrypted in transit. Workspace data is isolated with row-level security policies so that one organization cannot read another's records. Evidence media (screenshots, recordings, attachments) is served through time-limited signed URLs rather than being publicly accessible. API tokens are stored hashed, scoped, and rate-limited, and sensitive actions are recorded in an audit log. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

08 Your rights and choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent (such as a calendar connection) at any time without affecting processing that already occurred. Workspace members should generally exercise these rights through their organization's admin, since the organization controls most workspace content; if you contact us directly at hello@flares.in, we will route your request appropriately and respond within a reasonable time.

09 Children's privacy

Flare is a business tool and is not directed at, or intended for use by, children. We do not knowingly collect personal data from children under 16.

10 International data transfers

Flare and its service providers operate infrastructure in multiple regions, including India and other regions used by our hosting and database providers. Where we transfer personal data across borders, we rely on appropriate safeguards such as standard contractual clauses or the transfer mechanisms our providers make available.

11 Changes to this policy

We may update this policy as Flare's features change. If a change is material, we will notify workspace admins by email or through the product before it takes effect. The "Effective" date above reflects the version currently in force.

12 Contact us

Questions about this policy or a data request can be sent to hello@flares.in.