What we hold, and why we hold it.

What this notice covers

This site, the live demo, and the client portal we run at this address. It does not cover the businesses we build software for. Their data is theirs.

This site and the portal. Everything below is about flexvivid.com: the homepage, the live demo, and the client portal where our clients report issues and preview changes to their own systems.

Not the systems we build. When we build software for a business, that system holds the business's own records: their customers, their orders, their invoices. The business owns that data and decides how it is used. We operate the system on their instructions. If you are a customer of one of our clients and want to know what they hold about you, ask them. We will help them answer.

Who you are writing to. FlexVivid is an independent team of software developers in Lakewood, New Jersey. Nothing here goes through a support desk. Write to hello@flexvivid.com and the person who built the thing will answer you.

Everything we collect

This is the whole list. There is no hidden category, and no field on this site quietly does something other than what its label says.

The contact form

Your name, your business, your email, an optional phone number, whatever you type in the message box, and your answer to "how did you hear about us". Only the first three are required.

A referral code

A link or a "built by" badge on a client's website can carry a short code that tells us which site you came from. If it is there, we store it with your inquiry so we know who to thank. It identifies the site, not you, and it is not used to follow you anywhere else.

Visit counts

When you read these pages, our own counter records the page, the site or search that sent you, your country, and your browser and device type. It keeps a random id in your browser's storage so a repeat visit counts once, and stores only a scrambled form of that id. It does not store your IP address or your full browser details. See cookies and the visit counter.

A portal account

For clients: your name, your email, your role on the project, and your password stored as a one-way hash. We never hold the password itself and can't read it. We also keep a record of each sign-in (the time, the IP address and the browser) so you and we can spot one that wasn't you.

Issue reports

What you type when you report something, plus any screenshot, screen recording or voice note you choose to attach. Attachments are always optional. Nothing is captured from your screen unless you deliberately send it.

Calls and texts

If you call or text our number, or agree to receive texts from us: your number, the time, your messages, and any voicemail you leave, which is turned into text. Some calls are recorded and transcribed so nothing you tell us gets lost. See text messages and your phone number.

Server logs

Our hosts keep ordinary request logs (IP address, time, page, browser), which we use to keep the site up and to look into abuse. We don't build anything on top of them.

Outreach records

If we write to your business about our work, we hold its business contact details, usually from a public listing or a referral, and a note of whether we have written and whether you replied.

What we do with it

Every use on the left has a reason we can say out loud. Everything on the right is something we could technically do and have chosen not to build.

There is no data broker, ad network or reseller behind any of this.

Cookies and the visit counter

These pages set no cookies, which is why there is no cookie banner. The portal sets two once you sign in, and both are needed to keep you signed in safely.

In the portal. Signing in sets a session cookie, flexvivid_session, which holds an encrypted reference to your session and nothing readable. A second cookie, XSRF-TOKEN, stops other websites from submitting forms in your name. Both are sent only to this site. The session ends after a period without use or when you sign out. If you tick "Remember me", a third cookie keeps you signed in on that device until you sign out.

On these pages. The homepage, the service pages and these documents set no cookies. Our visit counter keeps one random id in your browser's local storage so a repeat visit counts once. It is sent only to our own app, it is never shared, and clearing your browser data removes it.

Do Not Track and Global Privacy Control. If your browser sends either signal, the visit counter records nothing at all.

Fonts. The typefaces are served from this site, so your browser makes no request to an outside font service.

Everyone else who handles it

We run on other companies' infrastructure, which means naming them. Each one does a specific job, and none of them is paid in data.

Cloudflare

Serves this website, receives email sent to our addresses, stores files, and keeps request logs. Everything travels over HTTPS.

Fly.io

Runs the client portal and its database, in the United States.

Resend

Delivers our email: the notice when you send the form, project updates, invoices and receipts. They handle the address and the message in order to deliver it.

Twilio

Carries calls and text messages to and from our phone number. Twilio and the mobile carriers handle your number and your messages only to deliver them.

Deepgram

Turns voicemail and recorded calls into text.

Anthropic

When a client reports an issue, the report and the relevant parts of that client's code are sent to Anthropic's commercial API so the report can be analyzed against the actual system. It is a business API, not a consumer chatbot.

GitHub

Holds the code we write for clients, in repositories each client can own.

Nobody else

That is the complete list. If it grows, this page grows with it.

We don't use your business records to train models of our own.

Text messages and your phone number

How we collect a mobile number, what we use it for, and the promise that comes with it. The program itself is described in our SMS Terms.

What we collect. Your mobile number, the messages we exchange with you, the time of each message, whether it was delivered, and a record of when and how you agreed to receive texts from us.

How you agree. We text you only if you have agreed to it: by checking the optional, unchecked text-message box on the contact form on this site, by telling us yes when we ask on the phone, or by texting us first, in which case we reply to that conversation. Agreeing is never a condition of buying anything from us.

What we use it for. Only to text you about your inquiry, your project and your account with us: replies to your questions, project and support updates, meeting reminders, and notices about invoices and payments. We do not send marketing or promotional texts, and we do not text on behalf of anyone else.

Who processes it. Our text messaging provider (Twilio) and the mobile carriers process your number and messages only to deliver them, on our behalf, and may not use them for anything else. We never sell, rent or trade phone numbers, and we never buy lists of them.

How long we keep it. Messages stay with the inquiry or project they belong to, for as long as we keep that record (see how long each record lives). If you reply STOP, we stop texting you and keep a record that you asked, so we do not text you again by mistake.

Stopping texts. Reply STOP to any message to stop all texts from us, or HELP for help. You can also ask by emailing hello@flexvivid.com or calling (848) 285-5243. Message frequency varies. Message and data rates may apply.

Your system, your data, our access

We operate software that runs real businesses. That deserves a plainer statement than most privacy pages manage.

You own the code and the data. From the first phase, not at the end of some earn-out. We hold your data as the operator of your system, on your instructions, and you can have a full export of it whenever you ask.

We access it to build, run and fix it, and for nothing else. We don't mine it for our own purposes, bundle it into a product, or show it to another client. When a fix needs real data to reproduce, we work with the smallest amount that will do the job.

Attachments are not public. Screenshots, recordings and voice notes attached to an issue are stored privately and shown only to a signed-in user with access to that project. There is no shareable public link.

Passwords are hashed, traffic is encrypted. Portal passwords are stored as one-way hashes, so nobody here, including us, can read them. Everything runs over HTTPS.

If something ever goes wrong, you will hear it from us. No system is beyond reach and we won't pretend otherwise. If data we hold is ever exposed, we will tell you what happened, what was affected and what we did about it, in plain language, as soon as we know.

How long each record lives

A schedule rather than a sentence, because "as long as necessary" tells you nothing.

Ask, and we will deal with it

One email. No form, no fee, and you don't have to explain yourself.

See it, correct it, take it, or delete it. Write to hello@flexvivid.com and we will tell you what we hold about you, fix it if it is wrong, send you a copy, or delete it. We aim to answer within a few working days. If a request needs longer, we will say so and tell you why.

Stopping our email. Reply to any message and say so, or write to the address above. We remove you and record that you asked, which is what stops it happening twice. You never have to prove you asked.

Where the law gives you more. Depending on where you live you may have rights under laws such as the GDPR or the CCPA. We won't claim a certification we don't hold. What we will do is honor the substance of those requests (access, correction, deletion, a copy of your data, and no worse treatment for having asked), whoever you are and wherever you are writing from.

Requests about a client's system. If your request is about data held inside software we operate for one of our clients, the client decides. We will pass it straight to them and help them answer it properly.

Children. This is business software. The site isn't aimed at children and we don't knowingly collect anything about them.

This page is dated on purpose.

If it changes in a way that matters, the date at the side changes with it, and clients hear about it directly rather than through a quiet edit.

• No advertising trackers and no sale of personal data
• Sign-in cookies in the portal only
• Your code and your data are yours, and exportable on request
• If something here is wrong or unclear, tell us and we will fix the page