Privacy Policy

Last updated: 13/10/2026

1. Introduction

This Privacy Policy explains how Flexilay Pty Ltd (“FlexiLay”, “we”, “us”) collects, uses, stores and discloses personal information in connection with the Services.

We aim to comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Where you connect third-party services (including ecommerce and accounting integrations), those services also have their own privacy terms.

2. Services Covered

FlexiLay may integrate with platforms including (without limitation) Shopify, WooCommerce, BigCommerce, Odoo, and accounting platforms such as Xero, MYOB, QuickBooks and Odoo. We also integrate with Stripe for payment processing.

3. What Information We Collect

Merchant Information

• Business and contact details (e.g., business name, contact name, contact email).
• Store identifiers and configuration (e.g., shop domain / store ID depending on platform).
• Stripe account identifiers and connection status.
• Integration connection information (OAuth tokens and/or API credentials you provide).
• Usage information relating to dashboards, settings, and configuration changes.

Customer Information

• Customer contact details (typically email address) for portal access and notifications.
• Plan details (deposit, instalments, amounts, due dates, status).
• Order details necessary to operate the Services, including order line items.
• We do not intend to store shipping addresses as part of the FlexiLay Services; shipping information is typically managed by your ecommerce platform.

Authentication (Magic Link)

• We use magic-link authentication for Customer portal access. This involves generating a secure link or token sent to the Customer’s email address.
• We store information required to generate, validate, and expire those links/tokens.

Payment Information

• FlexiLay does not collect or store full card numbers.
• Card details are handled by Stripe, which maintains PCI DSS compliance.
• FlexiLay may receive and store limited payment metadata from Stripe (e.g. last 4 digits, card brand, expiry month/year, payment status, timestamps, Stripe identifiers) for display and troubleshooting.

Technical and Usage Data

• IP addresses, browser type, device information, and basic logs relating to API calls, errors, and performance.
• Events within the Services (e.g., plan created, payment success/failure, portal login).

Cookies and Similar Technologies

• We use cookies, tags and similar technologies for essential functionality (such as signing in and security), analytics, and advertising — including Google Analytics and the Google Ads tag.
• Strictly-necessary cookies are required for the Services to work. Analytics and advertising technologies are used where permitted and, where required, with consent.
• You can manage cookies in your browser, manage ad personalisation at adssettings.google.com, and opt out of Google Analytics with Google's browser add-on.

4. How We Use Personal Information

We use personal information to:

• Provide the Services, including creation and management of Plans and dashboards.
• Schedule and orchestrate payments through Stripe, including retries and notifications.
• Send portal access links, payment notifications, and service messages.
• Provide reporting and reconciliation tools, including accounting exports and integration syncing where enabled.
• Monitor, maintain, improve, and secure the Services.
• Measure and improve our marketing and advertising, show relevant ads (including to people with similar characteristics) on third-party platforms such as Google, and create or match advertising audiences. Where we match audiences with advertising partners, identifiers such as an email address are shared only in hashed (irreversible) form.
• Comply with legal obligations (including recordkeeping) and enforce our Terms.

5. Disclosure of Personal Information

We may disclose personal information to:

• Merchants – to administer Plans, manage orders/services, and provide customer support.
• Stripe – to process payments, retries, refunds, and related payment metadata.
• Connected Integrations – such as ecommerce platforms (Shopify, WooCommerce, BigCommerce, Odoo) and accounting platforms (Xero, MYOB, QuickBooks, Odoo) when you enable those integrations.
• Service providers – such as hosting, logging, monitoring, analytics, and email delivery providers, under confidentiality obligations.
• Advertising and analytics partners – such as Google Analytics and Google Ads, to understand usage and to measure and improve our advertising. We may share hashed (irreversible) identifiers (for example, a hashed email address) to measure conversions and to build or match advertising audiences (such as Google Customer Match), including to reach people with similar characteristics. This is not a sale of personal information.
• Regulators or law enforcement – where required or authorised by law.

6. Security

• We use reasonable technical and organisational measures to protect personal information, including encryption in transit, access controls, and secure development practices.
• Integration credentials/tokens that we store are stored encrypted at rest (where supported by our architecture).
• Stripe is responsible for securing cardholder data and maintaining PCI compliance for payment details.
• Access to personal information is limited to authorised personnel and systems that require access to operate the Services.

7. Data Retention

• We retain plan and payment metadata for as long as necessary to provide the Services and satisfy legal/accounting needs (often up to 7 years, depending on context).
• Logs and technical telemetry may be retained for shorter periods consistent with security and operational needs.
• Where appropriate, data may be anonymised or aggregated so it no longer identifies individuals.

8. Access and Correction

• Individuals may request access to or correction of personal information we hold, subject to legal limitations.
• Requests can be made by contacting support@flexilay.com.

9. International Data Transfers

Our service providers (including Stripe and cloud infrastructure providers) may store or process data in data centres outside Australia. We take reasonable steps to ensure overseas recipients handle personal information consistently with the APPs.

10. Changes to this Policy

We may update this Privacy Policy from time to time. The updated version will be made available through the Services. Material changes may be communicated more directly where appropriate.

11. Contact

If you have any questions about this Privacy Policy, please contact:

Flexilay Pty Ltd – support@flexilay.com