A-04
Privacy Policy
Effective 10 October 2026
This policy explains what SpecFlint collects, why, who helps us run it, how long we keep it, and the choices and rights you have. We have tried to write it plainly.
01
Who we are
SpecFlint is a service that helps hospitality interior design studios draft, check and issue FF&E specifications. It is run by Flection LLC, 2000 NE 42nd Ave Ste D Unit 2500, Portland, OR 97213, USA. In this policy, we and us mean Flection LLC.
Studio content. For the content a studio puts into SpecFlint, such as its projects, files, specifications, library, standards and assistant conversations, we act as a processor (in US terms, a service provider) for that studio. The studio decides what goes in and who sees it, and is the controller of that content. If your question is about content a studio holds, you can also ask that studio.
Account and usage data. For the information we need to run SpecFlint itself, such as who signs in, team membership, credit use, how the service is used, and what Try It Free visitors send us, we are the controller.
02
What we collect
- Account details. SpecFlint sign-in is with Google. Google gives us your name, your email address and, if your Google account has one, your profile picture. We never see your Google password.
- Teams and access. The teams you belong to, your role and project access, the invitations you send or receive (including the invited email address), guest invitations, and the approval roles you hold.
- Studio content. What you and your team put into SpecFlint: projects, uploaded files (PDF, Word, Excel, CSV and images), photos, product links, specification items, rooms, rules and standards, library products, approvals and issued packages, and assistant conversations. We also keep what SpecFlint derives from them: the text read from files, the drafts it proposes, and the search data that lets your team search by meaning and by picture.
- Credits. Your team's credit balance, holds and charges, trial credits and any credits we grant. If online credit purchases are switched on, Stripe handles the payment; we receive the result and the pack bought, never your card number.
- Activity and technical data. A record of what was done in a team and by whom, which team owners can see as Activity; error and request logs; and the date and time of requests. Our hosting providers process IP addresses and browser details to deliver pages and keep the service secure.
- Try It Free. If you try SpecFlint without an account, we keep the photos, product links and draft you create, and a one-way hash of your IP address so we can apply the daily limits.
- Sponsored placements. When a sponsored product is shown to a team member, we record placement events: that it was shown, viewed, selected or specified, with the team, the person and the time. See Sponsored products below.
- Messages to us. What you write to us, and our replies.
We do not ask for sensitive personal information, such as health, religion or government identifiers, and we ask that you do not upload it.
03
How we use it, and our lawful bases
Where the GDPR or UK GDPR applies, each use rests on a lawful basis, named after it.
- To provide SpecFlint: sign-in, teams, projects, files, the AI features you use, approvals and packages. Basis: performing our contract with you or your studio.
- To hold, charge and record credits. Basis: our contract, and our legal duty to keep financial records.
- To send invitations and notices about your team's work. Basis: our contract.
- To keep SpecFlint secure, prevent abuse (including the Try It Free limits) and find and fix faults. Basis: our legitimate interest in a safe, working service.
- To answer your messages and support requests. Basis: our contract, or our legitimate interest in helping you.
- To show labelled sponsored products to team members and bill manufacturers for those placements. Basis: our legitimate interest in funding SpecFlint. Team owners can switch sponsored products off.
- To measure, in aggregate, how many people visit our pages and how fast the pages load. Basis: our legitimate interest in improving the site.
- To meet legal obligations and to protect our rights. Basis: legal obligation, or our legitimate interest.
We do not make decisions about you by automated means that have legal or similarly significant effects on you.
04
AI processing and our no-training commitment
SpecFlint uses AI models to read documents and photos, to draft values, rules, rooms and requirements, to run the assistant, and to turn text and images into search data. When you use one of these features, the content it needs is sent to the AI provider doing the work, and the result comes back to SpecFlint.
No training. Your studio's data is never used to train AI models, ours or our AI providers'.
No sharing between studios. Your studio's data is never shared with other studios. It improves only your own studio's results, inside your team: search across your library and past projects, Magic Pen suggestions and product matching.
People decide. What SpecFlint drafts stays a suggestion until a person in your team accepts it.
Staff access. Our staff see team names, members and credit use, to run the service. We look at project content only when we need to operate the service or to fix a problem you report to us.
05
Sub-processors
These providers help us run SpecFlint. Each processes data only to provide its service to us, under a contract that requires it to protect the data. We keep this list current.
- Anthropic (United States). Claude models read documents and photos, draft values and run the assistant. It receives the content each task needs.
- Google (United States). Gemini embedding models turn text and images into search data. Google Cloud hosts our database, file storage and background processing in the United States (us-central1, Iowa).
- Vercel (United States). Hosts the web app, and measures visits and page speed in aggregate.
- HasData and Bright Data (web page fetching). When SpecFlint reads a product page you link, it may fetch the page through one of these services. They receive only the link, never your studio's data.
- Resend (United States). Sends invitation and notification emails, when email is switched on. It receives the recipient's address and the message.
- Stripe (United States). Takes payment for credits, when online purchases are switched on. It receives a reference to your team and the pack bought; card details go straight to Stripe.
Studio data is processed only by the AI providers listed here. We can assign some AI tasks to other model providers, such as OpenAI, Google Gemini models or xAI. If we assign one a task that handles studio data, we will add it to this list first.
To build the shared catalogue from public manufacturer and vendor web pages, we also use other AI providers. They receive those public pages only, never studio data.
07
Sponsored products
SpecFlint may show product placements that a manufacturer paid for, in the assistant and the Magic Pen. Each one is labelled Sponsored. A placement never changes how other suggestions are ranked, is never placed into a guided build, and is never shown to guests. Team owners can switch sponsored products off in Team Settings.
We record placement events (shown, viewed, selected, specified) as billing evidence between us and the manufacturer. When a person or a team is deleted, the event keeps no link to them.
09
International transfers
SpecFlint stores and processes data in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your data is transferred to the United States. We protect those transfers with the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or another lawful safeguard, such as a provider's certification under the EU-US Data Privacy Framework.
10
How long we keep data, and deletion
- Account, team and studio content is kept while your team exists and your account is active.
- When you delete a file, a project or your team, SpecFlint removes the records, the text read from the files, the search data and the stored files themselves. If removing a stored file fails, SpecFlint keeps retrying until it is gone.
- Items in a specification are voided rather than deleted while their project exists, so an issued revision stays intact.
- Try It Free drafts and uploads that are not kept in a project are deleted 30 days after they were made.
- Credit and billing records are kept as long as the law requires, including after a team is deleted.
- Logs and our database provider's backups are kept for a limited period, and deleted data leaves them as they expire.
To delete your account, or for any other deletion request, write to support@flection.io.
11
Security
Data is encrypted in transit, and Google Cloud encrypts the database and stored files at rest. Files sit in private storage. SpecFlint checks a person's access every time a file is opened, then gives a link that lasts 15 minutes. Staff access is limited to the people who run the service.
No service is perfectly secure. If a breach affects your personal information, we will tell you and the authorities as the law requires.
12
Your rights
Depending on where you live, you can ask to access, correct, delete or receive a copy of your personal information, to restrict or object to how we use it, and to withdraw consent where we rely on it. Write to support@flection.io. We may need to confirm who you are first, and we answer within the time the law sets. If your request is about content a studio controls, we will pass it to that studio or help it answer.
European Economic Area and United Kingdom. You can also complain to your local data protection authority, or in the UK to the Information Commissioner's Office.
California and other US states. Under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and similar laws in other states, you can ask what personal information we collect, use and disclose, and ask us to delete or correct it. The categories we collect are identifiers (name, email address, a hashed IP address), professional information (your team and role), commercial information (credit records), internet activity (usage and activity records), and the studio content you provide. We do not sell or share personal information, as those laws define selling and sharing, and we have not done so in the last 12 months. We use sensitive personal information only as the service needs. We will not treat you differently for using your rights. You can use an authorized agent, and if we decline a request, you can appeal by replying to our answer.
13
Children
SpecFlint is a professional service for businesses. It is not meant for anyone under 16, and we do not knowingly collect their personal information. If you think we have, write to us and we will delete it.
14
Changes to this policy
We may update this policy. When we do, we change the effective date above. If a change is material, we will tell account holders in SpecFlint or by email before it takes effect.
15
Contact
For privacy questions, requests and support, write to support@flection.io.
Flection LLC, 2000 NE 42nd Ave Ste D Unit 2500, Portland, OR 97213, USA.