Flamelink
Privacy Policy

Registered Business: ​Regal Digital B.V
Overschiestraat 184, 1062XK Amsterdam
Last Updated: ​14 November 2018

PrivacyThis document contains the rules and restrictions that govern your use of our website(s) and theFlamelink Software as a Service (the “Flamelink Service” or “Flamelink Services”). It is
Flamelink’s policy to respect your privacy regarding any information we may collect while
operating our website(s) and the Flamelink Software as a Service and using our Services inaccordance with applicable laws.
“Customers” are persons who, on behalf of themselves or an entity request information from us
regarding the Website or Flamelink Service either for a limited time free trial or by purchasing
the Flamelink Service.
For purposes of this Privacy Policy, we are the ​Data Controller​ only with respect to our sales
and billing operations and any interactions with Visitors or Customers via our website(s) and theFlamelink Software as a Service.
In the course of Customers using the Flamleink Service, their customers, members, contractors
or employees (“End Users”) may provide personally identifiable information to us using theFlamelink Service via Customer websites or applications.

Your rights
You have the following rights towards us regarding your personal data:-

Right to information
Right to correction or deletion
Right to restrict processing
Right to object to the processing
Right to data transferability
Right to be forgotten

Please send an email to ​legal@flamelink.io​ in order to exercise one or more of theaforementioned rights. If you believe that the processing of personal data concerning you
violates the GDPR, you have the right of appeal to a supervisory authority, without prejudice toany other remedies.

Information about the processing of your data
In accordance with Article 12 of the General Data Protection Regulation (hereinafter referred toas the GDPR), we are obliged to inform you about the processing of your data when you use
our website or services. We take the protection of your personal data very seriously, and thisprivacy policy informs you about the details of the processing of your data and about your legal
rights in this regard.
1Changes
The Privacy Policy may need to change along with the Flamelink Service. We reserve the rightto change the Privacy Policy at any time and if we do, we will bring it to your attention by placing
a notice on the Flamelink Service, and/or by sending you an email and/or by some other means.
If you choose to reject the Privacy Policy before or after changes you will no longer be able touse the Flamelink Service. Flamelink will inform the user if any part of the processing or
information previously given to the data subject has changed, since user has given consent andwould have to provide consent on the changed policy.

Information you provide to us
We may receive and store any information you knowingly provide to us, including information
you post on our Services and information in correspondence with us. For example, we may
collect Personal Information such as your name and email address. Certain information may berequired to use our Flamelink SaaS.

Security
We have taken comprehensive technical and organisational precautions to protect yourpersonal data from unauthorised access, abuse, loss and other external disruption. To this end,
we regularly review our security measures and adapt them to current standards.
We endeavor to protect the privacy of your account and other Personal Information we hold in
our records, but unfortunately, we cannot guarantee complete security. Unauthorized entry oruse, hardware or software failure, and other factors, may compromise the security of user
information at any time. In particular, you acknowledge that Flamelink is not responsible for any
loss of any passwords or login information which you receive for access to Flamelink Services
which results from your failure to keep that information secure.
Although we believe our security methods are adequate, you acknowledge that no security
methods are perfect and that any transfer of information is at your own risk.

Personal data
Customers who access Flamelink’s Services choose to interact with Flamelink in ways that
require Flamelink to gather personally-identifying information such as name, address (email or
physical), credit card billing information, username, passwords. The amount and type of
information that Flamelink gathers depends on the nature of the interaction.
We ask Visitors who sign up for an account at Flamelink or who have questions to provide ausername and email address.

2

Those who engage in transactions with Flamelink by purchasing access to the Flamelink
platform to use the SaaS or sign up for the free tier - are asked to provide name, address andadditional payment and billing information (e.g. purchase order or bank information) and username and password. Once signed up and the SaaS is purchased, Customer employees orcontractors will be asked to provide their name and email address and a password.
Transmission of personal data for credit card payments. In principle, your personal data is only
passed on to the extent necessary for the execution of the payment contract. Specifically, forpayment processing, we transmit the payment data required for this to the bank commissioned
with the payment or, if applicable, to the payment and invoicing service provider commissioned
by us.
We also collect Customer content and track Customer usage of the SaaS and other Services aspart of the Services.
The information you can view, update, and delete may change as the SaaS changes. The
following details are captured:User details• sign up date for Flamelink• last active date
• email address• first name, last name, display name• linked Firebase projects (including the Firebase Auth UID for their project)
Project Details• active / inactive state• encrypted connection config• sign up date
• database type (realtime db or cloud firestore)• project ID• project Flamelink alias• project CMS users (enabled state and type - either `OWNER` or normal `USER`)• billing plan/subscription• available features
Billing• customer ID• customer type (business or individual)• billing contact name
If you have any queries regarding your Personal Data, please feel free to contact us atlegal@flaemlink.io​,3

How we use your information
Visitors
For Visitors, if you do not purchase the SaaS but want information, we use your contact
information to follow up on your request. We may also ask your consent to communicate withyou regarding the provision of services or notify you about new services, changes andimprovements.

For Customers
To Provide the Services
With respect to our Customers and their account users, Flamelink does not disclose personal
identifying information for marketing purposes other than as described below. We use such
personal data, as well as Tracking Information connected with your personal data for purposesof account and services administration and providing the Services.
If you provide your Billing information, we will use that information to charge you for the Services
you purchase.

Fraud and SaaS stability and security
We use Personal Data, Tracking Information, and your usage history to detect fraud, abuse,
violation of our contract terms, violation of any laws, rules or regulations, to ensure the stability
and security of our Services, to protect the rights, property or safety of Flamelink or to protect
public safety and threats to public healthDirect Marketing and Updating You Regarding the Use of the Services
We will use Customer contact information to contact you via email or by phone, if necessary, to
let Customers know about Services we provide, new Services or features or to update you
regarding Customer use of the Services.

To Improve the Quality of Services
We use Tracking Information and usage history to improve the quality of our Services, including,but not limited to user experience.

Aggregated Statistics
To the extent permitted by law, Flamelink will use Tracking Information to compile and/or create
for analytical purposes, statistical, aggregated data relating to our users and the Sites andServices and display or share this information. Aggregated data is derived from Personal
Information and Tracking Information but in its aggregated form it is de-identified in a manner sothat it cannot be used to identify any individual or individuals. This data is used to understandour customer base, their needs, to develop, improve, and market our services.

4How we share information
We will not sell, rent, or share Personal Data with third parties outside of our company without
your consent, except in the following ways:

Law Enforcement and Internal Operations
Personal Data, Tracking Information, Content and End User Data may be provided where weare required to do so by law, or if we believe in good faith that it is reasonably necessary (i) torespond to claims asserted against Flamelink or to comply with the legal process (for example,
discovery requests, subpoenas or warrants); (ii) to enforce or administer our policies andagreements with users; (iii) for fraud prevention, risk assessment, investigation, customer
support, product development and debugging purposes; or (iv) to protect the rights, property orsafety of Flamelink, its users or members of the general public. We will use commerciallyreasonable efforts to notify users about law enforcement or court ordered requests for data
unless otherwise prohibited by law. However, nothing in this Privacy Policy is intended to limit
any legal defenses or objections that you may have to any third party request to compel
disclosure of your information.

Business Transfer
Flamelink may sell, transfer or otherwise share some or all of its assets, including your Personal
Data, in connection with a merger, acquisition, reorganization or sale of assets or in the event ofbankruptcy. Under such circumstances, Flamelink will use commercially reasonable efforts to
notify its users if their personal information is to be disclosed or transferred and/or becomessubject to a different privacy policy.

Third Parties
We sometimes contract with other companies and individuals to perform functions or services
on our behalf, such as software maintenance, data hosting, sending email messages, etc. We
necessarily have to share your Personal Data with such third parties as may be required toperform their functions. We take steps to ensure that these parties take protecting your privacy
as seriously as we do, including entering into Data Processing Addendum, EU Model Clauses
and/or ensuring they have EU-U.S. and Swiss-US Privacy Shield certification.

Third Party Service Providers
Here is a list of the third party tools and applications we use which may collect Personal Data or
Tracking Information from you directly on our behalf and share it with us
We use ​Intercom​​ in connection with our Sites and Services to store and track usage statistics,
support conversations and contact information such as name and email in connection with those
support live chat conversations. Intercom is used for customer support purposes. In particular,
we provide a limited amount of your information (such as sign-up date and some personal
information like your email address) to Intercom, Inc. (“Intercom”) and utilize Intercom to collectdata for analytics purposes when you visit our website or use our product. As a data processor
acting on our behalf, Intercom analyzes your use of our SaaS and tracks our relationship by way
of cookies and similar technologies so that we can improve our service to you. For more
information on Intercom's use of cookies, please visit
5https://www.intercom.com/terms-and-policies#cookie-policy. We may also use Intercom as a
medium for communications, either through email, or through messages within our product(s).
As part of our service agreements, Intercom collects publicly available contact and social
information related to you, such as your email address, gender, company, job title, photos,
website URLs, social network handles and physical addresses, to enhance your user
experience. Processing takes place in the United States. Intercom is self-certified under the
US-EU Privacy Shield and we have entered into a Data Processing Addendum with them. For
more information on the privacy practices of Intercom, please visit their privacy policy.
Intercom’s services are governed by Intercom’s terms of use which can be found athttps://www.intercom.com/terms-and-policies#terms.
We also use ​Mailchimp​​ to send you emails after you sign up for the Services or use the SaaS if
you indicate an interest in receiving information and track your interaction with those emails
based on the email address Customers provide to us. Mailchimp is also self-certified under the
US-EU Privacy Shield program and we have a Data Processing Addendum with EU Standard
Contractual Clauses in place with them. If you wish for us to remove yourself, just follow the
instructions at the bottom of the email communications. For more information on Mailchimp,
follow the link to ​https://mailchimp.com/legal/privacy//​.
We use ​Profitwell​​ to analyse SaaS Metrics. It is only for overall aggregated usage and data
analysis to improve the product and service. No customer specific use.
https://www.profitwell.com/terms-security
We use ​Stripe​​ to capture, store and manage payment processes when users sign-up with asubscription plan. Stripe handle the security of your billing details. Stripe is also self-certified
under the US-EU Privacy Shield program and we have a Data Processing Addendum with EU
Standard Contractual Clauses in place with them.
For more information on Stripe, follow the link tohttps://mailchimp.com/legal/privacy//​.​https://stripe.com/us/privacy
Quaderno​​ integrates directly with Stripe and handles the Tax calculations, sales invoices &receipts and sales tax return-ready reports for Flamelink user subscriptions. Quaderno values
your Privacy and strives for its services to be safe and enjoyable for everyone. Quaderno’s
Policy explain how they collects and processes personal data, the purposes for processing andhow they protect it. For more information on Quaderno, follow the link tohttps://quaderno.io/privacy/Your Information Choices
Right to Review and Rectify Your Personal Data
Customers can update most of their Personal Data by logging on to their account. However, if
additional assistance is required to change or delete inaccuracies within your Personal Data or
you would like to know what information about you was collected, please contact us atlegal@flamelink.io​.

6

Right to Remove
You may request that we delete your Personal Data or remove your Data completely from theFlamelink Service. You can delete your Personal Data by logging into your account and deletingyour account.
If you receive communications from us and no longer wish to receive them, please follow theremoval instructions in the email or change your account settings.
However, since your Personal Data is required for us to provide the Services to you, deleting it,
especially your email address and billing details if assigned to a subscription plan, will also
terminate your access to the services. Deleting your Personal Data does not mean that all of it
will be removed. We may be required by law, to retain your data to exercise or defend legal
claims, fulfill contractual obligations with our customers; retain some information in connection
with our obligation to provide the Services. We may de-identify and anonymize some data for
purposes of retaining it.

Third Party Links and Services
The Website and SaaS may contain links to other websites and services or use services notprovided by Flamelink. Flamelink cannot be, and is not responsible for the use of data, privacy
practices or the content of those websites or services. You should be aware of this when you
leave our site and be sure to review the privacy statements of each website you visit thatcollects information. This Privacy Policy applies solely to personal information collected by
Flamelink.

Processing and transmission of personal data whensubscribing to our services
If you wish to subscribe to the Flamelink service, it is necessary for the initiation and conclusionof the contract that you provide personal data such as your name, your address and your email
address. The mandatory data required for activating the subscription is marked as such; further
information is provided voluntarily. We process your data for order processing; in particular, we
will forward Payment data to the payment service provider or our main bank through Stripe. To
prevent unauthorised third parties from accessing your personal data, the order process on thewebsite is encrypted using TLS technology.
You can voluntarily create a user account in which we store your data for future visits to thewebsite. When you create a user account, the data you enter is processed. Once you havesuccessfully logged in, you are free to edit or delete all other data, including your user account.
As soon as processing is no longer necessary, we delete the data generated in this context or, if
statutory retention obligations apply, restrict processing of the data. Due to mandatory
commercial and tax regulations, we are obliged to keep your address, payment and subscription
data for a period of ten years.

7

Users Under 16 Years of Age
The Sites and Services do not knowingly collect personal information from users under the ageof 16 nor are they intended to be used by anyone under 16. If you are under the age of 16, you
are not permitted to use the Sites and Services or to disclose Personal Information using theSites and Services. If we learn we have collected or received Personal Information from a childunder 16, we will delete that information. If you believe we might have any information from orabout a child under 16, please contact us at ​legal@flamelink.io​.
If you have any questions or concerns regarding our privacy policy, please send us a detailed
message, and we will try to resolve your concerns.
Kind Regards the Flamelink Team8