Privacy Policy

Last updated 14 September 2026.

This policy explains what NetMediaOne, LLC ("Flyder", "we", "us") does with personal data across every Flyder service. It replaces the separate policies that previously covered each product.

Everything here applies to every service unless a section opens with a marked callout naming the products it covers. Nothing is repeated per product — where the products behave the same, it is said once.

#Which relationship you are in

Flyder Elevate is used by companies to support their own customers, so there are two different relationships and the difference decides who you ask:

In data-protection terms: for tickets and everything in them we are a processor acting for the account. For sign-up, logins, billing and service logs — and for everything in Flyder, Flyder Engage and Flyder Account — we are the controller.

#What we collect

Your login and profile (Flyder Account, and every product through it) — name, email address, whether it is verified, a hashed password, two-factor secrets, active sessions, the organizations you belong to and your role in each, the applications you can reach, invitations and access requests, and your notification preferences. Passwords are never stored in readable form.

Your content

• Flyder and Flyder Engage: the Input you provide — prompts, file uploads, feedback — and the Output generated from it.
• Flyder Elevate, on behalf of an account: ticket subjects and bodies, comments and internal notes, email headers and routing metadata, attachments, contacts and companies, tags, CSAT responses and knowledge base articles. This is whatever your customers and agents write; we do not choose what goes into it.

Communication and other information you give us — your name, contact details and the contents of messages you send us, anything you provide in events or surveys, and information used to verify your identity. If you interact with our pages on social media, whatever you choose to share there, plus the aggregate analytics those platforms give us.

Payment and transaction information for paid plans.

Email operations data (Flyder Elevate) — delivery and bounce results, complaint and unsubscribe records, suppression lists and spam signals. Suppression records are kept as long as needed to stop us mailing someone who asked us not to.

Technical data — IP address (read from the connecting address, never from a header a caller can set), user agent and device information, request paths and timings, date and time of access, and error records. Used to run the Service, enforce rate limits, and investigate abuse and incidents.

Activity recorded by the Elevate Time desktop app — recorded on your own computer and never sent to us. See The Elevate Time desktop app and browser extension below.

Usage counters — per-account ticket, storage and API volumes, for limits and billing.

Security and audit records — administrative actions taken on an account or an organization, sign-in failures, and rate-limiting counters.

#Cookies and analytics

#How we use it

To provide, administer, maintain and analyze the Services; to sign you in and tell an application who you are; to let your organization's administrators manage access; to improve the Services and develop new ones; to communicate with you about the Services; to bill you; to prevent fraud, abuse and misuse and to protect the security of our systems; to carry out business transfers; and to comply with the law and protect our rights and yours.

We may aggregate or de-identify data and use it for analysis, research and product improvement, and publish or share aggregate statistics. We will not attempt to re-identify it.

We do not sell personal data, and we do not "share" it for cross-context behavioural advertising. We do not process sensitive personal data to infer characteristics about anyone.

#AI and model training

How AI processing itself works differs by product:

#Connected mailboxes (Google / Microsoft)

If an admin connects a Gmail or Microsoft 365 mailbox, we request the narrowest scope for the capability you turn on — read access to poll for new support mail, and send access only if you enable sending. Messages are read to create tickets; they are not marked read, deleted, or used for anything else. Access and refresh tokens are encrypted at rest and used only to poll that mailbox. Disconnecting in Settings → Email deletes the tokens, and you can revoke access from your Google or Microsoft account at any time.

#The Elevate Time desktop app and browser extension

Elevate Time is a timer that runs on your own computer. The time entries you save with it are ordinary Flyder Elevate data and are covered by everything above: they reach your account over the same API the web app uses, under a token that can read and write time and reach nothing else.

Everything else the app is able to record is different in kind, and one sentence governs all of it:

It is off until you turn it on. A new install records nothing, and neither does an update. When you do switch it on, the app records — locally — which application was in front and for how long; the title of that window, if you enable window titles separately; the address and title of the browser page you were on, and the sites of your other open browser tabs, if you install the browser extension; a count of key presses and mouse clicks; and a screenshot every few minutes, if you enable screenshots separately.

Counts, never content. The app counts how many times a key was pressed. It never reads which key: on each operating system it is built so that the keystroke is not available to the program at all, rather than being read and then discarded. Nothing you type is recorded, and on Windows and Linux nothing that could read input is installed until you turn counting on.

Screenshots carry stricter rules than anything else here, because a picture of your screen is not the same as an application's name — it is whatever happened to be on it. They need their own permission from your operating system, have their own switch and their own shorter retention, are skipped while you are away from the machine and while an excluded application is in front, and have a delete-them-all button of their own.

You can exclude an application or a site, and excluding one also deletes what has already been recorded about it — the activity, the screenshots and anything learned from them. Turning the exclusion back off starts again from nothing; there is no hidden history to restore.

The browser extension tells the app on the same computer two things, through the local channel your browser provides for talking to a program already installed on that machine: the address and title of the page in your active tab, and the site and title of your other open tabs, so the app can offer your own sites when you set up automatic time tracking.

For those other tabs it is the site only — figma.com, not the page you have open on it. The path, the query string and anything after a # are removed inside the browser before anything is sent, because the site name is all the app uses them for. Tabs in a private or incognito window are never read at all. The extension makes no network requests of any kind — no server, no account, no analytics — and it reports nothing while its own switch is off or while the app is not running.

Idle time is the one measurement that needs no permission and has no switch: the app asks the operating system how many seconds have passed since you last touched the keyboard or mouse, so it can ask you whether a running timer should keep running. That is a number of seconds, and the app learns nothing else from it.

#Who else sees it

We disclose personal data only to:

Some features let you share information yourself — a shared link, an integration, a custom action. Trust the person or service you share it with; once shared, it is governed by them.

#Where data is held

The Services are intended for citizens of the United States only; use from elsewhere is unauthorised and those accounts may be removed. They run on Cloudflare's global network, so data may still be processed in countries other than your own, and any transfer out of the UK/EEA relies on Standard Contractual Clauses through our infrastructure provider.

#How long we keep it

• Account, login and session data — for as long as the account exists. Sessions expire on their own and are cleared.
• Tickets and comments (Flyder Elevate) — until the account deletes them. A deletion is a soft delete first; the account sets the window (Settings → Account, default 30 days), after which a nightly job hard-deletes them.
• People (Flyder Elevate) — deleting a person hides them immediately and purges them after 30 days. An admin can also erase a person outright, which strips their personal data from tickets and leaves the ticket history intact.
• Attachments — with their ticket, removed when the ticket is purged.
• Activity records (Elevate Time) — held on your own computer and deleted automatically after 30 days, screenshots after 7. They are never uploaded, so there is no copy of them for us to keep or to delete for you. Excluding an application deletes its records at once, and each can be deleted outright from the app at any time.
• Suppression and abuse records, audit logs and billing records — as long as needed for the purpose or as the law requires. These deliberately survive a ticket deletion, and audit entries outlive the account they describe, because their purpose is to answer "who changed this, and when" after the fact.
• A closed account — deleted 30 days after termination.

#Your rights

Depending on where you live you may have the right to know what we hold and how we process it, to access a copy, to correct it, to delete it, to export it, to restrict or object to processing, to withdraw consent where consent is the basis, to be free from discrimination for exercising these rights, and to complain to your data-protection authority.

• End users of a help desk: exercise these with the company you contacted — they control the ticket. We will help them respond.
• Account holders: most of it you can do yourself. Your profile, your sessions and account deletion are on the Account page in Flyder Account; Flyder Elevate's API exports everything in your account. For anything else, write to support@flyder.ai.

Verification. To protect your data we may ask you to verify your credentials before acting on a request to know, correct or delete. If you have no account with us, or we suspect fraud, we may ask for more information and proof of residency. If we cannot verify who you are, we cannot act on the request.

Authorized agents may submit a request with signed written permission; we may still verify you independently. You may appeal a decision on a request by contacting support.

A note about accuracy. Flyder and Flyder Engage generate responses by predicting likely text, so output about a person can be factually wrong. Tell support and we will correct it where we can; where the way the models work makes that impossible, you may ask us to remove your personal data from the output instead.

#Security

• Tenant isolation in Flyder Elevate is enforced mechanically, in one place, on every query — not by convention.
• Traffic is TLS-encrypted end to end. Data at rest is encrypted by our infrastructure provider, and secrets on top of that: passwords are hashed, and mailbox tokens, API keys and application signing secrets are hashed or encrypted.
• Sessions are scoped, expiring and individually revocable. Two-factor authentication and single sign-on are available, and an organization or application can require them.
• Attachments are checked structurally on upload and are never served as executable content.
• Staff access to an account is limited and logged.

No system is perfectly secure, and no email is. Take care what you send us. If a breach affects your data we will notify affected accounts, and the relevant regulator, without undue delay.

#Children

The Services are not directed to anyone under 18, and we do not knowingly collect their data. If you believe a child's data has reached us, tell us and we will delete it.

#Links to other sites

The Services may link to sites we do not operate. What you share there is governed by their policies, not this one. A link is not an endorsement.

#Changes

We may update this policy. We do not email or otherwise announce a change — a change takes effect when it is posted here, and the Last updated date at the top of this page is the record of when the current version was published. Check back for it.

#Contact

support@flyder.ai · Flyder, c/o NetMediaOne, LLC, 4101 Tates Creek Centre Drive, Suite 150 – PMB 118, Lexington, KY 40517, USA.