Privacy Policy
Last updated: September 1, 2026
1. Who Is Responsible
Fleep Flap, operated from the Province of Québec, Canada, is responsible for the personal information processed on www.fleepflap.com and in the Fleep! Flap! mobile apps. This policy explains what we collect, why, with whom it is shared, and the rights you have under Québec's Act respecting the protection of personal information (Law 25) and Canada's PIPEDA. Questions: support@fleepflap.com.
2. Data We Collect
Account data: your email address and your verified phone number, plus the one-time sign-in codes we send you. Order data: the products you buy, amounts, the recipient phone number or email you provide, and your order history. Payment data: handled entirely by Whop, our payment processor — we receive payment confirmations and billing metadata (such as the billing name and a card fingerprint) but never see or store your card number. Communications data: if you rent a virtual number, the SMS messages and call logs (numbers, times, durations) of that number are stored so the app can display them to you — calls are not recorded.
3. Data Collected Automatically
When you make a purchase we record your IP address, an anonymous device identifier, and your browser or app version. We look up the IP address against a network-intelligence service to detect VPN, proxy and Tor connections, and we may verify the line type of a phone number. These signals exist for one purpose: keeping card fraud off the platform.
4. How We Use Your Data
We use your data to process and deliver orders, operate your virtual number, verify your phone, prevent and investigate fraud, provide customer support, send transactional emails (order confirmations, refunds, security notices), and meet our accounting obligations. With your consent, we may also send service updates and offers — every marketing email includes an unsubscribe link.
5. Fraud Prevention
To protect customers and payment partners, we maintain internal records of identities associated with confirmed fraud (email addresses, device identifiers, destination numbers) and apply automated purchase limits. Some orders are reviewed by a human before delivery. These records are used strictly for fraud prevention and are not shared with third parties except where the law requires it.
6. Cookies & Analytics
Essential cookies keep you signed in, remember your language and currency, and carry the anonymous device identifier used for fraud prevention — the platform cannot work without them. Google Analytics is loaded only if you explicitly accept it in the cookie banner; declining it never limits your use of the platform.
7. Who We Share Data With
We share only what each provider needs to do its job: Zendit (recipient number or email, to deliver top-ups, eSIMs and gift cards), Telnyx (virtual numbers, SMS and calls), Whop (payments), Twilio (phone verification codes and line-type checks), Supabase (database and authentication hosting), Vercel and Railway (application hosting), Resend (transactional email), and Google (push notifications on Android; analytics only with your consent). We never sell personal data, and no partner may use it for its own marketing.
8. International Transfers
Our providers process data in Canada and the United States. Wherever data leaves Québec, it remains protected by contractual safeguards with providers that meet industry security standards.
9. Retention
Order and payment records are kept as long as required for accounting and fraud prevention. Network-intelligence lookups are cached for 30 days. SMS and call logs of a virtual number are kept while your subscription is active. When you request deletion of your account, we erase or anonymize your personal data except what we are legally required to keep.
10. Security
All traffic is encrypted in transit (TLS). Card numbers never touch our systems. Access to production data is restricted to the operator of the platform, and payment webhooks are cryptographically verified before being trusted.
11. Your Rights
You may request access to, correction of, or deletion of your personal data, withdraw consent to optional processing, and ask for your data in a portable format, at any time, by writing to support@fleepflap.com. We respond within 30 days. If you are unsatisfied with our response, you may lodge a complaint with the Commission d'accès à l'information du Québec or the Office of the Privacy Commissioner of Canada.
12. Changes
We may update this policy as the platform evolves; the date at the top of the page reflects the latest revision, and material changes are announced on the platform.