Privacy Policy

1. Introduction

Flass (“Flass”, the “Service”) is a digital event photo-sharing platform that enables users to collect, preserve, and share photos and videos from events.

Norrstone Limited (“Norrstone”, “we”, “us”, or “our”) is committed to protecting your privacy and processing personal data in accordance with applicable data protection laws, including Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”).

This Privacy Policy explains what personal data we collect, how we use it, the legal bases on which we process it, and the rights available to you.

2. Data Controller

Norrstone Limited

27 Old Gloucester Street, London WC1N 3AX, United Kingdom

Company Number: 16646040

Privacy Contact: flass@flass.app

3. Information We Collect

Account Information

When you create an account, we may collect:

• Email address
• User account identifier
• Authentication and login information

Event Content

We may collect and process:

• Photos
• Videos
• Event names and descriptions
• Guest information provided by users
• User-generated content uploaded to the Service

Technical Information

To operate and secure the Service, we may collect:

• IP address
• Device information
• Browser information
• System logs
• Security and diagnostic information

4. Photos and Videos

Flass does not use facial recognition technology or biometric identification systems to identify individuals.

Photos and videos are generally processed as personal data under applicable law.

In circumstances where uploaded content may reveal information falling within special categories of personal data under Article 9 GDPR, processing will be based on an appropriate legal basis as required by law.

Users are responsible for ensuring that they have the necessary rights and permissions to upload and share content through the Service.

5. Purposes of Processing

We process personal data to:

• Provide and operate the Service
• Create and manage user accounts
• Host and deliver photos and videos
• Send notifications and communications
• Process payments
• Provide customer support
• Maintain security and prevent abuse
• Comply with legal obligations
• Improve and maintain the Service

6. Legal Bases for Processing

We process personal data on the following legal bases:

Performance of a Contract

Where processing is necessary to provide the Service requested by the user.

Legitimate Interests

Where processing is necessary to:

• Maintain platform security
• Prevent fraud and abuse
• Ensure service reliability
• Improve our products and services

Consent

Where consent is required by law, including:

• Marketing communications
• Marketing use of user content
• Other activities requiring explicit consent

7. Sharing of Personal Data

We may share personal data with trusted service providers acting on our behalf, including:

• Supabase
• Vercel
• Resend
• Stripe
• RevenueCat
• Expo
• Apple
• Google
• Sentry

Where required, these providers process personal data under written data processing agreements.

We do not sell personal data.

8. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA), we implement appropriate safeguards, including:

• European Commission Standard Contractual Clauses (SCCs)
• EU–US Data Privacy Framework certifications where applicable
• Other lawful transfer mechanisms recognized under GDPR

9. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce agreements.

When an account or event is deleted, associated data will be deleted or anonymized within a reasonable period unless retention is required by law.

10. Your Rights

Subject to applicable law, you may have the right to:

• Access your personal data
• Correct inaccurate information
• Request deletion of your data
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent at any time

Requests may be submitted to flass@flass.app.

11. Complaints

If you believe that our processing of your personal data violates applicable law, you have the right to lodge a complaint with a competent data protection authority.

12. Changes to This Policy

We may update this Privacy Policy from time to time.

The latest version will always be available through the Service or on our website.