Privacy Policy

FlashAI (getflashai.app) is operated by East and West LTD, a company based in Israel. This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and what choices you have.

This policy applies when you use our website, web app, and related services (collectively, the "Service"). By using FlashAI, you acknowledge that you have read this policy.

We collect the following categories of information:

Account information

• Email address (required to create an account)
• Display name and avatar URL (when you sign in with Google OAuth)
• Account creation date and time
• Subscription tier (free, trial, or pro) and trial start/end dates

Content and usage data

• Decks you create, including titles, cards, and detected languages
• Study progress (answers, ratings, correct/incorrect results)
• Monthly generation counts (for usage limits on free accounts)
• Gamification data such as streaks, points, and badges
• PDF and text content you upload for AI flashcard generation

Payment-related data

Payments are processed by Lemon Squeezy (Merchant of Record). We do not store full payment card numbers. We store billing-related identifiers needed to manage your subscription:

• Lemon Squeezy customer ID and subscription ID
• Plan tier (monthly, annual, or lifetime)
• Subscription expiration date and customer portal URL

Technical data

• IP address and request logs (via Vercel hosting)
• Browser type, operating system, and device information (via PostHog)
• Pages visited, clicks, and product events (via PostHog)
• Session recordings (PostHog — sensitive form inputs are masked where possible)

We use your information to:

• Provide, maintain, and improve the FlashAI Service
• Authenticate you and secure your account
• Generate flashcards from your uploaded materials using AI
• Process subscriptions and manage billing through Lemon Squeezy
• Send service-related communications (e.g., account or billing notices)
• Understand product usage and improve features (analytics)
• Enforce our Terms of Service and prevent abuse
• Comply with legal obligations

We do not sell your personal data. We share data only with service providers that help us operate FlashAI, and only as needed for those purposes:

We may also disclose information if required by law, to protect our rights, or in connection with a merger or acquisition, with appropriate safeguards.

Your account data and decks are stored in Supabase, which may process data in the EU and/or US depending on project configuration. We use encryption in transit (HTTPS/TLS) and rely on our providers' encryption at rest.

We retain your data while your account is active. If you request account deletion, we delete or anonymize personal data within 30 days, except where we must retain certain records for legal, tax, or fraud-prevention purposes.

No method of transmission or storage is completely secure. We use reasonable safeguards, but we cannot guarantee absolute security.

GDPR (EEA, UK, and similar laws)

If you are in the European Economic Area, UK, or another region with similar laws, you may have the right to:

• Access — request a copy of your personal data
• Deletion — request erasure ("right to be forgotten")
• Portability — receive your data in a portable format
• Rectification — correct inaccurate data
• Object — object to certain processing
• Withdraw consent — where processing is based on consent
• Lodge a complaint — with your local data protection authority

CCPA (California residents)

California residents may have the right to:

• Know what personal information we collect and how we use it
• Request deletion of personal information
• Opt out of the "sale" of personal information — we do not sell personal data
• Not be discriminated against for exercising these rights

To exercise any of these rights, email eastandwestltd2021@gmail.com. We may need to verify your identity before fulfilling a request.

FlashAI is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, contact us at eastandwestltd2021@gmail.com and we will take steps to delete it.

East and West LTD is based in Israel. Your data may be processed in Israel, the United States, the European Union, and other countries where our service providers operate (including Supabase, PostHog US Cloud, and Vercel).

Where required, we rely on appropriate safeguards such as Standard Contractual Clauses and our providers' compliance programs for international transfers.

We use cookies and similar technologies for:

• Authentication — necessary cookies to keep you signed in (Supabase session)
• Analytics — PostHog cookies to understand how the product is used
• Preferences — e.g., language or accessibility settings stored locally

You can control cookies through your browser settings. Blocking authentication cookies may prevent you from using signed-in features. A cookie notice is shown when you first visit the site; you can also review this policy for details on analytics cookies.

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through an in-app notice. The "Last updated" date at the top of this page shows when the policy was last revised. Continued use of FlashAI after changes take effect means you accept the updated policy.

For privacy questions or to exercise your rights, contact:

• Email: eastandwestltd2021@gmail.com
• East and West LTD, Israel
• Web: Contact form