Privacy Policy

Who we are: FLYP LTD, Flat 4, 88 Kensington Park Road, London, W11 2PL, United Kingdom (“FLYP”, “we”, “our”).

Contact: info@flyp.space

This Policy explains how we collect, use, share and protect personal data when you use our website and app (the “Platform”). It covers creators and buyers using FLYP to create and sell fashion, including our integrations with YouTube and Google Merchant Center.

We do not sell personal data. We do not use Google-retrieved data to build profiles for unrelated advertising.

Use of YouTube API Services

FLYP uses YouTube API Services to connect your channel, read channel/video metadata, and enable YouTube Shopping. When you interact with Google services through FLYP, your use is also subject to the Google Privacy Policy.

1) Data we collect and why

1.1 Account & service data (Contract)

What: name, email, profile photo, username, phone (if provided); creator storefront/catalog data.
Why: create/manage your account, provide support, power selling features.
Legal basis: Contract (perform the service).

1.2 Transactions & fulfillment (Contract / Legal obligation)

What: buyer/seller name and city/country, order details, payment status, delivery info.
Why: process orders, prevent fraud, provide customer service, keep tax/accounting records.
Legal basis: Contract; Legal obligation (records/tax).

1.3 Google account data (YouTube / OAuth)

We request the minimum necessary permissions and do not use Google user data for purposes unrelated to the features you enable.

Scopes requested (exact strings) & purpose:

• https://www.googleapis.com/auth/youtube.third-party-link.creator — read/write: link your Merchant Center to your YouTube channel so products can be published to YouTube Shopping.
• openid and https://www.googleapis.com/auth/userinfo.email — read: identify your Google account and email to associate your channel with your FLYP account.
• https://www.googleapis.com/auth/youtube.readonly — read: read channel/video metadata to support storefront setup and reporting.
• https://www.googleapis.com/auth/youtube.force-ssl — read/write: manage channel resources required to identify account type and link your channel to our backend.
• https://www.googleapis.com/auth/youtubepartner — read/write: use channel/video metadata (title, description, channel name, subtitles) to generate garment listings from videos where partner features are required.
• https://www.googleapis.com/auth/content — read/write: sync products with Google Merchant Center (Shopping Content API).

Offline access (refresh tokens). We request offline access so key features continue to work when you’re not online.

• YouTube tokens: streamline product creation from videos.
• Merchant Center tokens: keep products in sync via the Content API.
• Storage & security: tokens are stored in separate projects for YouTube and Merchant Center and encrypted at rest using Google Cloud KMS (google.cloud.kms).
• Retention: tokens are kept until you unlink the integration (see User controls).
• Legal basis: Contract (to provide the features you enable).

1.4 Analytics & measurement (Consent in EEA/UK)

Tools: on our website, Google Analytics 4 (GA4) and PostHog for usage analytics, Google Ads, the LinkedIn Insight Tag and the Meta Pixel for ad measurement, and Sentry for error monitoring (which can record a sample of sessions so we can fix bugs). Our app also uses Mixpanel for product analytics.
What: device/usage events and conversions as described below.
Legal basis (EEA/UK): Consent for non-essential analytics/measurement, which you give or refuse in our cookie banner. See Cookies & similar technologies.
Without cookies: if you decline analytics or haven’t chosen yet, PostHog still counts your visit, the pages you view and the steps you take in our forms, without setting cookies or storing anything on your device. Visits are told apart only by a hash that PostHog computes on its servers and changes every day, so you can’t be recognised across days. We use this for aggregate statistics about our website, on the basis of our legitimate interest in understanding how it is used. When you send us a form, we record which ad or link brought you to that page, so we know where our enquiries come from.

2) YouTube Shopping & Google Merchant Center

If you connect your YouTube channel and Merchant Center to sell on YouTube:

• Linking: during onboarding, we link your Merchant Center account with your YouTube channel to enable YouTube Shopping.
• Syncs (server-to-server): our backend keeps product changes in sync with Merchant Center using the Shopping Content API (https://www.googleapis.com/auth/content) — e.g., product creation/updates, prices, and availability.
• Data shared with Google: product details (title, price, images, identifiers), account/channel and merchant IDs, and program status information needed to publish products on YouTube.
• Legal basis: Contract (to make your products available on YouTube as you requested).

Data handling & refresh

• Catalog & inventory: product changes are pushed to Google Merchant Center via the Shopping Content API; inventory updates are applied promptly as items change.
• Channel/video metadata: refreshed periodically or on sign-in to support creator features.
• Deletion windows: upon disconnect/revocation, OAuth tokens are deleted immediately; YouTube-derived data is purged from active systems within 7 days and from backups within 30 days.

3) Conversion measurement (sharing with analytics/Google)

To attribute sales and improve reporting we record purchase/conversion events:

• Fields sent: orderId, productId, quantity, price, timestamp, and a user identifier:
  • Logged-in: Firebase UID
  • Logged-out: anonymous UID
• Destinations: GA4 and Mixpanel. (If you enable YouTube/Google conversion measurement on the web, the conversion events described above may also be used to attribute purchases resulting from YouTube.)
• No hashed email/phone: we do not currently send hashed contact data with conversions.
• Legal basis (EEA/UK): Consent for ads/measurement. If you turn off Analytics or Advertising in our cookie banner, we don’t load those tools, except Google’s tags, which then run without cookies and pass your choice on through Consent Mode v2, and PostHog, which still counts visits without cookies as described in 1.4.
• No selling & limited use: we do not sell personal data. We do not use conversion data to build profiles for unrelated advertising.

4) Cookies & similar technologies

We use strictly necessary cookies to run the Platform and, with your consent, analytics and advertising cookies. If you’re in the EEA, the UK or Switzerland, or we can’t tell where you are, our cookie banner asks first, and analytics and advertising stay off until you accept, though we still count visits without cookies as described in 1.4. Elsewhere they’re on by default, and a Global Privacy Control signal turns advertising off. You can change your choice at any time in Cookie settings, at the foot of every page.

Your choices: Use Cookie settings to change what you’ve allowed on our website. You can also block cookies, or delete the ones already set, at any time in your browser settings. You can also opt out of individual tools: Google Analytics with Google’s opt-out browser add-on, Google ad personalization in My Ad Center, LinkedIn ad measurement in your LinkedIn advertising settings, and RB2B as described in 4.1. For help with any of these, email info@flyp.space.

4.1 B2B visitor identification (RB2B)

When you visit or log in to our website, cookies and similar technologies may be used by our online data partners or vendors to associate these activities with other personal information they or others have about you, including by association with your email. We (or service providers on our behalf) may then send communications and marketing to these email addresses. You may opt out of receiving this advertising by visiting https://app.retention.com/optout.

You also have the option to opt out of the collection of your personal data in compliance with GDPR by visiting https://www.rb2b.com/rb2b-gdpr-opt-out.

5) Sharing your data

• Other users during a transaction: we share buyer/seller name and city/country to facilitate communication and fulfillment.
• Service providers (processors): we use third parties to operate the Platform (hosting, analytics, error monitoring, email, scheduling, payments, support, CDN). See Sub-processors.
• Legal, safety, and corporate events: we may share data to comply with law, protect rights, or as part of a merger/acquisition.

We do not disclose full addresses or direct contact details to other users unless required for fulfillment with appropriate safeguards.

6) International transfers

We may transfer data outside the UK/EEA. Where we do, we use appropriate safeguards such as EU Standard Contractual Clauses and the UK Addendum, and conduct transfer impact assessments where required.

• Primary hosting region: europe-west2 (London).
• Key vendors & countries: see Sub-processors.

7) Retention

We retain personal data only as long as necessary for the purposes below or as required by law:

• Account data: we will retain your personal information for the period necessary to fulfill the purposes outlined in this privacy policy, according to our data retention schedule, unless a longer retention period is required or permitted by applicable law. You can request deletion of your personal information at any time.
• Orders/transactions: retained to meet legal/accounting obligations.
• Products: may remain by reference to your UID for catalog integrity.
• OAuth tokens: kept until you unlink your YouTube or Merchant Center connection; deleted immediately upon unlink.
• Logs: 30 days for security/troubleshooting.
• Analytics: retained according to each tool’s configuration (e.g., up to 14 months for GA4).

8) Security (summary)

• Hosting & region: cloud hosting in europe-west2 (London).
• Encryption: TLS for data in transit; encryption at rest. OAuth refresh tokens are encrypted using Google Cloud KMS.
• Access controls & logging: access to production is restricted by role; administrative and data-access events are logged.

9) Sub-processors

The following vendors act as our processors to provide the Platform. Where data is transferred outside the UK/EEA, we use EU Standard Contractual Clauses and the UK Addendum as applicable.

(A current list is available on request.)

10) Your rights & controls

• Disconnect & revoke access: You can disconnect your Google/YouTube account from FLYP at any time via Settings → YouTube Channels → Disconnect (this revokes our OAuth tokens and stops future sharing). You can also revoke FLYP’s access in your Google Account at https://myaccount.google.com/permissions.
• Deletion of YouTube-derived data: When you disconnect or revoke access, we delete YouTube-derived data and OAuth tokens stored for your account. Operational logs are retained for 30 days for security/troubleshooting and then deleted. Order records and products by UID reference required for legal/accounting may be retained but are not used to interact with YouTube.
• Export or delete your data / account: email info@flyp.space.
• Other rights: access, rectification, restriction/object, and portability. Contact info@flyp.space.

If you’re in the UK/EEA, you can also complain to your local authority. In the UK, that’s the ICO (ico.org.uk).

11) Children

The Platform is not intended for users under the age of 16. If you believe a minor has provided personal data, contact us and we will take appropriate action.

12) Changes

We’ll post any changes to this Policy here and update the “Last updated” date. For material changes, we may notify you by email or in-app.

13) Accessibility

FLYP is committed to ensuring digital accessibility for people with disabilities. We are continually improving the user experience for everyone and applying relevant accessibility standards.

Contact: info@flyp.space