Privacy Policy.

1. Information we collect

Information you give us

• Contact information: the email address or mobile phone number you enter to get updates.
• Communications: the content of emails or messages you send us, and your contact details in them.

Signup and consent records

When you sign up, we record whether you chose email or text, the date and time, the exact consent language displayed to you, the page where you signed up, and how you reached us. That last item comes from campaign codes in the link you used (for example, a QR code or social media campaign) and the address of the referring website, with its query details removed. If you unsubscribe, we record that too.

Information collected automatically

When you visit the website, our hosting and security provider automatically processes technical information such as your IP address, browser and device type, the pages you request, the referring page, and the date and time of your visit. It uses this information to deliver the website, keep it secure, and screen out automated abuse. When you submit a signup form, our bot-protection service evaluates browser and device signals to confirm that you are not an automated program. We do not store your IP address in our subscriber records. If we use website analytics, it is privacy-focused, measures visits in aggregate, and does not use cookies to identify you.

Information from others

If you interact with our social media accounts, we receive information that the platform makes available to us under your settings on that platform. Messaging providers and wireless carriers may report whether our messages were delivered.

Please do not send us payment card numbers, government ID numbers, health information, or other sensitive personal information through our website, email, or text messages.

2. How we use information

• To send the updates you asked for, including opening news, offers, and other marketing, by email or text where you have agreed or where the law otherwise permits;
• To respond to your questions and requests;
• To operate, secure, maintain, and improve the website and our business, including understanding which campaigns and channels bring people to us;
• To detect, prevent, and respond to fraud, spam, abuse, security incidents, and other harmful activity;
• To keep records of your consent and opt-out choices, honor those choices, and demonstrate compliance with the law;
• To comply with legal obligations and lawful requests, and to establish, exercise, or defend legal claims;
• To enforce our terms and protect the rights, property, and safety of our company, our customers, and others; and
• For any other purpose we describe to you when we collect the information, or with your consent.

We may create aggregated or de-identified information that does not reasonably identify you and use it for any lawful business purpose. We will not try to re-identify it except as permitted by law.

3. How we disclose information

We disclose personal information only as follows:

• Service providers that process information for us under contractual confidentiality and use limits. These include website hosting, security, bot protection, and database services (currently Cloudflare); email delivery and forwarding (including Google); and, when we use them, email and text messaging platforms, message aggregators, and wireless carriers.
• Professional advisers, such as lawyers, accountants, and insurers, as needed for their services to us.
• Legal and safety: to comply with law, legal process, or government requests; to enforce our terms; and to protect the rights, property, or safety of our company, our customers, or others.
• Business transfers: to a buyer, successor, or other party in a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business or assets, subject to this Policy. A transfer does not expand any consent you gave to receive text messages.
• With your direction or consent.

Text messaging: We do not sell, rent, or share mobile numbers or text message opt-in and consent information with third parties or affiliates for their marketing or promotional purposes. Text message originator opt-in data and consent will not be shared with any third parties, except service providers that help us deliver our messages, and except when required by law.

California “Shine the Light”: We do not disclose personal information to third parties for their own direct marketing purposes.

4. Cookies, tracking, and advertising

We do not use advertising cookies, cross-site tracking pixels, or third-party advertising networks on our website. We do not knowingly allow third parties to collect personal information about your online activities across different websites over time through our website. Our security provider may set cookies or use similar technologies that are strictly necessary to protect the website and screen out automated abuse. You can block cookies in your browser, but some security features may then not work.

Do Not Track and Global Privacy Control. Because we do not track visitors across third-party websites, we do not change our practices when we receive a browser “Do Not Track” signal. We do not sell personal information or share it for cross-context behavioral advertising. If that ever changes, we will update this Policy beforehand, provide any opt-out the law requires, and treat a Global Privacy Control signal as a valid opt-out request where the law requires.

Our website links to our Instagram and TikTok accounts. Those platforms are independent, and their privacy policies govern information you give them.

5. Your choices and rights

• Email: use the unsubscribe link in any marketing email.
• Text messages: reply STOP to any message, or see our SMS Terms.
• Access, correction, and deletion: email hello@flakenroll.com with the subject line “Privacy Request.” Tell us what you are asking for and the email address or mobile number involved.

Depending on where you live and whether a law applies to us, you may have additional rights, such as the right to know what personal information we have collected about you, to receive a copy of it, to correct or delete it, and to opt out of the sale or sharing of personal information or targeted advertising. We will respond to requests as required by applicable law. We will not discriminate against you for exercising a right the law gives you.

We may need to verify your identity before responding, for example by confirming control of the email address or phone number in question. You may use an authorized agent if the law allows it, and we may require proof of the agent's authority. We may decline a request, or part of one, where the law permits. For example, we keep a minimal record of an opt-out so that we do not contact you again, and we keep records we need for legal compliance, security, or legal claims. If we deny your request and the law gives you a right to appeal, reply with the subject line “Privacy Appeal” and we will review the decision.

6. How long we keep information

We keep personal information only as long as reasonably necessary for the purposes described in this Policy. Signup, consent, and opt-out records are generally kept while you remain subscribed and for up to five years after you unsubscribe. This lets us honor your choices and respond to legal claims within applicable limitation periods. Where a longer period is required or permitted by law, or where information is relevant to an ongoing dispute or investigation, we keep it for that period. Hosting and security logs are kept by our providers for the limited periods their services require. When we no longer need information, we delete or de-identify it.

7. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information. These include encrypted connections to our website, access limited to authorized personnel, and bot protection on our forms. No website, internet transmission, or storage system is completely secure, and we cannot guarantee absolute security. To the extent permitted by law, you share information at your own risk. If a data breach affects your personal information, we will notify you as required by law.

8. Children

Our Services are intended for a general audience and are not directed to children under 13. We do not knowingly collect personal information from children under 13. Our text message program is limited to people 18 and older. If you believe a child has provided us personal information, contact us and we will delete it as required by law.

9. Where information is processed

We are based in the United States. Our service providers may process information in the United States and other countries where they operate. By using the Services, you understand that your information may be processed outside your state or country, where data protection laws may differ.

10. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on this page and change the effective date. If we make material changes, we will provide any additional notice or obtain any consent that applicable law requires. We will update this Policy before we begin new practices, such as online ordering or a loyalty program, that involve additional personal information. This Policy is a notice of our practices. It is not a contract and does not create rights beyond those provided by law.

11. Contact us

For questions or requests about this Policy or your personal information: