Privacy Policy

Last updated 7 August 2026.

This policy explains what NetMediaOne, LLC ("Flyder", "we", "us") does with personal data across every Flyder service. It replaces the separate policies that previously covered each product.

Everything here applies to every service unless a section opens with a marked callout naming the products it covers. Nothing is repeated per product — where the products behave the same, it is said once.

#Which relationship you are in

Flyder Elevate is used by companies to support their own customers, so there are two different relationships and the difference decides who you ask:

In data-protection terms: for tickets and everything in them we are a processor acting for the account. For sign-up, logins, billing and service logs — and for everything in Flyder, Flyder Engage and Flyder Account — we are the controller.

#What we collect

Your login and profile (Flyder Account, and every product through it) — name, email address, whether it is verified, a hashed password, two-factor secrets, active sessions, the organizations you belong to and your role in each, the applications you can reach, invitations and access requests, and your notification preferences. Passwords are never stored in readable form.

Your content

• Flyder and Flyder Engage: the Input you provide — prompts, file uploads, feedback — and the Output generated from it.
• Flyder Elevate, on behalf of an account: ticket subjects and bodies, comments and internal notes, email headers and routing metadata, attachments, contacts and companies, tags, CSAT responses and knowledge base articles. This is whatever your customers and agents write; we do not choose what goes into it.

Communication and other information you give us — your name, contact details and the contents of messages you send us, anything you provide in events or surveys, and information used to verify your identity. If you interact with our pages on social media, whatever you choose to share there, plus the aggregate analytics those platforms give us.

Payment and transaction information for paid plans.

Email operations data (Flyder Elevate) — delivery and bounce results, complaint and unsubscribe records, suppression lists and spam signals. Suppression records are kept as long as needed to stop us mailing someone who asked us not to.

Technical data — IP address (read from the connecting address, never from a header a caller can set), user agent and device information, request paths and timings, date and time of access, and error records. Used to run the Service, enforce rate limits, and investigate abuse and incidents.

Usage counters — per-account ticket, storage and API volumes, for limits and billing.

Security and audit records — administrative actions taken on an account or an organization, sign-in failures, and rate-limiting counters.

#Cookies and analytics

#How we use it

To provide, administer, maintain and analyze the Services; to sign you in and tell an application who you are; to let your organization's administrators manage access; to improve the Services and develop new ones; to communicate with you about the Services; to bill you; to prevent fraud, abuse and misuse and to protect the security of our systems; to carry out business transfers; and to comply with the law and protect our rights and yours.

We may aggregate or de-identify data and use it for analysis, research and product improvement, and publish or share aggregate statistics. We will not attempt to re-identify it.

We do not sell personal data, and we do not "share" it for cross-context behavioural advertising. We do not process sensitive personal data to infer characteristics about anyone.

#AI and model training

How AI processing itself works differs by product:

#Connected mailboxes (Google / Microsoft)

If an admin connects a Gmail or Microsoft 365 mailbox, we request the narrowest scope for the capability you turn on — read access to poll for new support mail, and send access only if you enable sending. Messages are read to create tickets; they are not marked read, deleted, or used for anything else. Access and refresh tokens are encrypted at rest and used only to poll that mailbox. Disconnecting in Settings → Email deletes the tokens, and you can revoke access from your Google or Microsoft account at any time.

#Who else sees it

We disclose personal data only to:

Some features let you share information yourself — a shared link, an integration, a custom action. Trust the person or service you share it with; once shared, it is governed by them.

#Where data is held

The Services are intended for citizens of the United States only; use from elsewhere is unauthorised and those accounts may be removed. They run on Cloudflare's global network, so data may still be processed in countries other than your own, and any transfer out of the UK/EEA relies on Standard Contractual Clauses through our infrastructure provider.

#How long we keep it

• Account, login and session data — for as long as the account exists. Sessions expire on their own and are cleared.
• Tickets and comments (Flyder Elevate) — until the account deletes them. A deletion is a soft delete first; the account sets the window (Settings → Account, default 30 days), after which a nightly job hard-deletes them.
• People (Flyder Elevate) — deleting a person hides them immediately and purges them after 30 days. An admin can also erase a person outright, which strips their personal data from tickets and leaves the ticket history intact.
• Attachments — with their ticket, removed when the ticket is purged.
• Suppression and abuse records, audit logs and billing records — as long as needed for the purpose or as the law requires. These deliberately survive a ticket deletion, and audit entries outlive the account they describe, because their purpose is to answer "who changed this, and when" after the fact.
• A closed account — deleted 30 days after termination.

#Your rights

Depending on where you live you may have the right to know what we hold and how we process it, to access a copy, to correct it, to delete it, to export it, to restrict or object to processing, to withdraw consent where consent is the basis, to be free from discrimination for exercising these rights, and to complain to your data-protection authority.

• End users of a help desk: exercise these with the company you contacted — they control the ticket. We will help them respond.
• Account holders: most of it you can do yourself. Your profile, your sessions and account deletion are on the Account page in Flyder Account; Flyder Elevate's API exports everything in your account. For anything else, write to support@flyder.ai.

Verification. To protect your data we may ask you to verify your credentials before acting on a request to know, correct or delete. If you have no account with us, or we suspect fraud, we may ask for more information and proof of residency. If we cannot verify who you are, we cannot act on the request.

Authorized agents may submit a request with signed written permission; we may still verify you independently. You may appeal a decision on a request by contacting support.

A note about accuracy. Flyder and Flyder Engage generate responses by predicting likely text, so output about a person can be factually wrong. Tell support and we will correct it where we can; where the way the models work makes that impossible, you may ask us to remove your personal data from the output instead.

#Security

• Tenant isolation in Flyder Elevate is enforced mechanically, in one place, on every query — not by convention.
• Traffic is TLS-encrypted end to end. Data at rest is encrypted by our infrastructure provider, and secrets on top of that: passwords are hashed, and mailbox tokens, API keys and application signing secrets are hashed or encrypted.
• Sessions are scoped, expiring and individually revocable. Two-factor authentication and single sign-on are available, and an organization or application can require them.
• Attachments are checked structurally on upload and are never served as executable content.
• Staff access to an account is limited and logged.

No system is perfectly secure, and no email is. Take care what you send us. If a breach affects your data we will notify affected accounts, and the relevant regulator, without undue delay.

#Children

The Services are not directed to anyone under 18, and we do not knowingly collect their data. If you believe a child's data has reached us, tell us and we will delete it.

#Links to other sites

The Services may link to sites we do not operate. What you share there is governed by their policies, not this one. A link is not an endorsement.

#Changes

We may update this policy. We do not email or otherwise announce a change — a change takes effect when it is posted here, and the Last updated date at the top of this page is the record of when the current version was published. Check back for it.

#Contact

support@flyder.ai · Flyder, c/o NetMediaOne, LLC, 4101 Tates Creek Centre Drive, Suite 150 – PMB 118, Lexington, KY 40517, USA.