flewnt

Last updated: May 13, 2026 · EN only for now

Privacy Policy

Flewnt is operated by Flewnt. This policy describes what data we collect, why, and how long we keep it. Payments are processed by Paddle.com Market Limited, who is the merchant of record. Paddle has its own privacy policy at paddle.com/legal/privacy.

1. What we collect

From subscribers (Users)

When you sign up via the website and subscribe to a paid plan, we create an account record. Paddle collects your payment details on our behalf as merchant of record. The data we store includes:

  • Email address, display name, and password hash (for authentication).
  • LINE user ID (linked when you connect your LINE account).
  • Language preferences you configure (native language, reading languages, translation tone, gender context for gendered languages).
  • Subscription plan, status, billing period, and Paddle customer/subscription identifiers.
  • Usage counters (translation count and token consumption per billing period).

From Paddle, we receive subscription status, plan details, billing period dates, and subscription management URLs. We do not receive your card number, bank account, or full billing address. Country of purchase is handled by Paddle for tax compliance.

From group chat participants (Contacts)

When a non-subscriber sends a message in a LINE group where Flewnt is active, we create a lightweight Contact record to support translation. Contacts never sign up and never interact with Flewnt directly. We store:

  • LINE user ID (pseudonymous identifier assigned by LINE).
  • Display name (as shown in the LINE group).
  • A language observation profile built from messages that meet minimum length thresholds (20+ Latin characters or 8+ CJK/Thai characters). Short messages, universal phrases, and slash commands are excluded from profiling.
  • Group membership records (which groups the Contact has been seen in).

Contacts are never created as User accounts. Their message translations are billed to the subscriber(s) in the group.

Translation metadata

Flewnt is a per-user, inbound-only translation service. It translates messages that are already visible to you in groups you are a member of. It does not originate, send, or broadcast messages on your behalf. Message text is never stored. For each translation event, we retain the following metadata for up to 48 hours:

  • Internal group and sender identifiers.
  • Detected source language and target languages.
  • Token counts (input and output) and processing latency.
  • Whether the translation was served from cache, skipped, or required a quality retry.
  • Which subscriber was billed for the translation.
  • Timestamp.

After 48 hours, translation metadata rows are automatically purged. No message content is written to any persistent storage at any point in the pipeline.

Language detection uses a tiered system (local statistical models, then the Google Gemini API for ambiguous cases). Subscribers set their base language explicitly through slash commands or account settings. The system does not auto-assign a base language from group messages.

From affiliate partners

If you join the Flewnt partner programme, we collect your name, contact email, social profiles, Stripe Connect account identifier (for payouts), referral click data (hashed IP addresses and referrer URLs), and referral conversion records. This data is held for the duration of your affiliate agreement plus 12 months after termination, for audit purposes.

From website visitors

We collect first-party visitor attribution data (anonymised visitor identifier, UTM parameters, referrer URL, landing page, device type, country from request headers, and page view counts) for conversion analysis. This data is not linked to your identity unless you later create an account.

If you accept analytics cookies, we collect anonymised page-view data via Google Analytics 4 under consent mode. If you separately consent to marketing cookies, client-side tracking pixels from Meta (Facebook) and TikTok may fire on your browser. If you decline, no analytics or marketing pixel data is collected beyond the first-party attribution data described above. Additionally, when a purchase occurs, we send server-side conversion events (with hashed identifiers only) to Meta, TikTok, and Google Analytics to measure advertising effectiveness. We do not sell data to third parties.

From support and feedback

If you contact support (via the website, LINE DM, or contact form), we store your name, email, LINE user ID (if applicable), message content, and ticket metadata. If you submit a feature request via LINE DM, we store the request text and may generate a summary using the Google Gemini API.

Security and authentication

We log authentication events (login, logout, 2FA setup) with your IP address, user agent, and timestamp to detect unauthorised access. Cloudflare Turnstile is used on forms to verify that submissions come from real users, not automated bots. Turnstile processes a challenge token but does not set tracking cookies.

2. Legal bases for processing

  • Contract performance: processing your subscription, delivering translations, and managing your account.
  • Legitimate interest: 48-hour metadata retention for rate-limiting and deduplication; Contact language profiling to deliver accurate translations; first-party visitor attribution for conversion analysis; authentication event logging for security; server-side purchase conversion measurement (hashed identifiers sent to Meta, TikTok, and Google Analytics to measure advertising effectiveness).
  • Consent: analytics cookies and client-side marketing pixels (you may withdraw at any time via the cookie banner).
  • Legal obligation: tax records retained to meet tax compliance obligations in the buyer's jurisdiction.

3. Cross-border data transfers

Your data may be processed by the following sub-processors in the regions indicated:

  • Vercel (United States, global edge): web hosting; processes website request logs.
  • Railway (Singapore): Python bot hosting and PostgreSQL database; processes LINE webhook payloads transiently and stores account, subscription, Contact, and affiliate data.
  • Upstash Redis (Singapore): cache, queue, and rate-limit; stores translation metadata and rate-limit counters for 48 hours.
  • Google Gemini API (United States): primary LLM translation provider; message text is processed transiently and not retained by Google.
  • Google Cloud Translation API (United States): fallback translation provider used when the primary provider is unavailable; message text is processed transiently.
  • LINE Corporation (Japan): messaging platform; handles message delivery. Note: LINE acts as a controller, not a processor, under its own privacy policy.
  • Paddle (United Kingdom, London): payments merchant of record; processes payment details, billing, and tax records.
  • Stripe (United States): partner payout processing via Stripe Connect; processes affiliate payout details.
  • Google Analytics 4 (United States): analytics, consent-gated; collects anonymised page views only when you accept analytics cookies.
  • Meta Conversions API (United States): server-side conversion tracking for purchase events; processes hashed identifiers and transaction data to measure advertising effectiveness.
  • TikTok Events API (United States): server-side conversion tracking for purchase events; processes hashed identifiers and transaction data to measure advertising effectiveness.
  • Google Analytics 4 Measurement Protocol (United States): server-side conversion tracking for purchase events; processes anonymised identifiers and transaction data.
  • Sentry (EU-hosted): error tracking; stores PII-scrubbed error traces.
  • Axiom (United States): log aggregation; stores PII-scrubbed structured logs with 48-hour retention.
  • Cloudflare (global): DNS, edge WAF, and Turnstile bot protection; processes request metadata and challenge tokens.
  • Resend (United States): transactional email delivery; processes recipient email addresses and message content for service notifications.

Where required, transfers rely on standard contractual clauses or equivalent safeguards. For the complete list of sub-processors and their contact details, see /legal/sub-processors. To request a copy of our Data Processing Agreement, see /legal/dpa.

4. How we use your information

We use the information we collect for the following purposes:

  • To provide, maintain, and improve the translation service.
  • To process your subscription, manage billing, and deliver translations.
  • To build and maintain language profiles so translations are delivered to the right recipients in the right languages.
  • To detect and prevent abuse, spam, and service interference.
  • To comply with legal obligations (tax records, data protection requests).
  • To send service-related communications (subscription confirmations, security alerts, support replies).
  • To measure advertising effectiveness through conversion tracking (server-side for purchase events; client-side with your consent).

5. Data sharing and disclosure

We do not sell your personal information. We may share your information only in the following circumstances:

  • Service providers: We share data with third-party sub-processors who assist in operating the Service (listed in full at /legal/sub-processors).
  • Legal requirements: We may disclose your information where required by law, regulation, or legal process.
  • Business transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

6. Data security

We implement appropriate technical and organisational measures to protect your information, including:

  • HTTPS encryption (TLS 1.2+) for all data in transit.
  • Encryption at rest for stored data.
  • Database role restrictions and cryptographic signing keys to enforce access boundaries between application components.
  • Automated 48-hour purge of translation metadata.
  • No message text written to any persistent storage at any point in the translation pipeline.
  • PII scrubbing applied to error traces and application logs before transmission to third-party monitoring services.

No method of electronic transmission or storage is completely secure. We take all reasonable steps to protect your information but cannot guarantee absolute security.

7. Applicable privacy laws

  • Thailand: Personal Data Protection Act B.E. 2562 (PDPA-TH). You may exercise rights to access, correct, delete, or restrict processing.
  • Japan: Act on the Protection of Personal Information (APPI / PIPA-JP). You may request disclosure, correction, or deletion of your personal information.
  • Taiwan: Personal Data Protection Act (PDPA-TW). Rights to access, correct, delete, and restrict processing apply.
  • EU / EEA: General Data Protection Regulation (GDPR). You have rights to access, portability, erasure, restriction, objection, and complaint to your supervisory authority.
  • United Kingdom: UK GDPR and the Data Protection Act 2018. You have the same rights as EU data subjects. You may also lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. Your rights

Depending on your location, you have the following rights regarding your personal information:

  • Access: You may request a copy of the personal information we hold about you.
  • Rectification: You may request correction of inaccurate personal data.
  • Erasure: You may request deletion of your personal data. Cancel your subscription via the Paddle customer portal, then email us to confirm deletion.
  • Data portability: You may request your data in a machine-readable format.
  • Restriction: You may request restriction of processing in certain circumstances.
  • Objection: You may object to processing based on our legitimate interest.
  • Withdraw consent: You may withdraw consent for analytics and marketing cookies at any time via the cookie banner.
  • Complaint: You have the right to lodge a complaint with your local data protection authority.

To exercise any of these rights, email . We will respond within 30 days.

9. Data retention

  • Translation metadata: 48 hours, then auto-deleted.
  • Webhook event records: 30 days, then auto-deleted.
  • Contact records and language profiles: held while the Contact remains a participant in at least one active group. Deleted upon request or when no longer needed for service delivery.
  • Subscription records: held for the life of the subscription plus 7 years to meet tax record-keeping obligations.
  • Affiliate data: duration of agreement plus 12 months.
  • Support tickets: held for the life of the account plus 12 months after closure.
  • Authentication event logs: 90 days.
  • Visitor attribution data: 14 months.
  • Analytics data: governed by GA4 data retention settings (14 months by default).
  • Account deletion: upon request, personal data is deleted within 30 days, except where retention is required by law.

10. Children's privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that personal information has been collected from a child, we shall take steps to delete that information.

11. Changes to this policy

We may update this Privacy Policy from time to time. We shall notify you of material changes by email or through the Service prior to the change becoming effective. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact

Flewnt is a trading name operating under the laws of England and Wales.

Flewnt · · flewnt.chat