Privacy for every person whose data reaches FSS ONE

1. Who we are and which role we have

FSS ONE is operated by SIA FLEXLAB, registration number 40203617609, Katlakalna iela 9A, Riga, LV-1073, Latvia (“FSS ONE”, “we”, “us”).

We are the controller for data used to operate our website, manage customer and business relationships, provide support, secure the service and meet our own legal obligations.

For mailbox content, campaigns, customer contact lists and recipient data placed in a customer workspace, the customer normally decides why and how that data is used and is the controller. FSS ONE acts as the customer's processor or service provider, using the data only to provide, secure and support the service and to follow documented customer instructions. Connected platform providers may also act under their own terms and privacy policies.

If your data appears in a customer's campaign or mailbox, that customer is usually the best first contact for questions about why it has your data. You may also contact us; we will respond where we control the data and route processor-side requests to the relevant customer when required.

2. Personal data we process

3. Why we use data and our legal bases

• Provide the service and perform a contract: authenticate users, connect accounts, prepare and send authorised messages—including customer-directed business outreach—synchronise replies, process bounces and unsubscribes, display history and maintain workspace settings.
• Follow customer instructions: process customer content as a processor for the features the customer activates.
• Legitimate interests: secure accounts, prevent abuse, troubleshoot, maintain auditability, improve reliability and communicate about a business service, balanced against the rights of affected people.
• Consent: where an optional feature, provider authorisation, cookie or local law requires consent. Consent may be withdrawn without affecting earlier lawful processing.
• Legal obligations and claims: respond to lawful requests, keep records required by law, and establish, exercise or defend legal claims.

Customers are responsible for selecting an appropriate lawful basis for their campaigns, imports and recipient communications. FSS ONE does not turn an unlawful list or message into a lawful one.

4. Connected provider data

5. AI, embeddings and automated decisions

The current mailbox connection, sending, reply-synchronisation, bounce and suppression paths do not submit mailbox or recipient content to an external generative-AI model. FSS ONE does not use connected mailbox data or recipient data to train a general-purpose AI model.

A separate, approved development process has used the OpenAI API to create numerical embeddings from a sanitised semantic corpus. That process was separate from Google and Microsoft mailbox operations; it did not send messages or take account actions, and automated retrieval from those embeddings is not currently active. OpenAI states that data submitted through its business and API services is not used to train its models by default.

If an AI feature for personalisation, classification, drafting or automation is activated in the future, its input, purpose, provider, output and human-control model will be disclosed before first use. FSS ONE does not currently make solely automated decisions that produce legal or similarly significant effects about recipients.

6. Recipients, prospects, replies and unsubscribe data

Direct marketing and customer-directed business outreach are intended uses of FSS ONE. A customer may upload or enter recipient data, select and personalise a campaign, send a message, and receive replies or delivery events through a connected account.

The customer is responsible for the lawful source and legal basis of its recipient data, targeting criteria, sender identity, message content and timing, notices required when data was obtained from another source, and compliance with electronic-marketing and provider rules. FSS ONE cannot create a lawful basis for a customer or guarantee that a campaign is lawful in every jurisdiction.

We process reply, bounce, complaint and unsubscribe signals so the customer can stop or adapt communication. An unsubscribe creates a suppression record so that the same workspace does not immediately contact the address again. We do not sell recipient lists, operate as a data broker, or make decisions that produce legal or similarly significant effects about recipients.

A recipient may use the unsubscribe mechanism in a message, contact the sender named in that message, or contact us. An objection to direct marketing must be honoured and processing for that purpose must stop. Where the customer is the controller, we will relay and assist with the request. A minimal suppression record may remain so that the objection continues to be honoured.

7. When data is disclosed

We disclose personal data only as needed to:

• make it available to authorised members of the relevant customer workspace;
• deliver a customer-directed message to its intended recipient;
• interact with a provider the customer chose to connect, such as Google, Microsoft or another SMTP/IMAP mailbox provider;
• use infrastructure, security, storage and support providers bound to protect data and act only for the contracted purpose;
• comply with a valid legal obligation or protect people, accounts, the service and legal rights; or
• support a merger, financing or sale, subject to confidentiality and continued privacy protections.

We do not sell personal data and do not share it for cross-context behavioural advertising. Our current provider register and the function of each provider are published on the Service Providers & Subprocessors page.

8. Security measures

FSS ONE applies technical and organisational measures proportionate to the data and risk. Measures include encrypted network transport, protected credential storage, OAuth rather than mailbox passwords where supported, workspace-scoped authorisation, role and access controls, private application storage, operational logging, connection-health checks, abuse and unsubscribe controls, backups, and incident investigation procedures.

Access by personnel is restricted to people with an operational, security or support need and is subject to confidentiality. No system can guarantee absolute security. If a personal-data incident requires notice, we will notify the responsible customer and/or competent authority and affected people as applicable law requires.

9. International data transfers

We are established in Latvia. Connected providers and service providers may process data in the European Economic Area and other countries; we do not claim that every data item stays in Latvia or the EEA. Where applicable law requires a transfer mechanism, the relevant transfer may proceed only under a mechanism available for that transfer. Enterprise customers should obtain deployment-specific provider, location and transfer information, and agree any required contractual terms, before production use. This policy does not by itself claim that a separate customer DPA, transfer assessment or set of standard contractual clauses has been executed.

10. Retention, disconnection and deletion

We keep data only while it is needed for the purpose described here, the customer's documented instructions and contract, security and audit requirements, dispute resolution, or a legal obligation. The period depends on the category and workspace configuration:

• OAuth grants and credential references are kept while the account remains connected and are disabled or removed when it is revoked, disconnected or permanently deleted;
• workspace, mailbox, campaign, message and reply data is kept while needed to provide the customer service and for the period agreed with the customer;
• minimal suppression data may be kept after other content is removed so that an unsubscribe or objection continues to be honoured;
• security, audit, billing and legal records are kept only as long as necessary for those purposes; and
• deleted data may remain for a limited time in protected backups until the relevant backup cycle expires, unless preservation is legally required.

Revoking a provider connection stops new API access but does not by itself erase data already lawfully stored in a workspace. A user or customer should also use the deletion controls or contact us when erasure of stored data is required. Deleting data from FSS ONE does not delete copies that remain in the customer's Google, Microsoft or other provider mailbox, or in a recipient's mailbox; those copies must be managed with the relevant provider or recipient.

11. Privacy rights

Depending on your location and the processing, you may have rights to access, obtain a copy, correct, delete or restrict personal data; receive portable data; object to processing, including direct marketing; withdraw consent; and complain to a supervisory authority. You may also have rights to know the categories and sources of personal data, opt out of a sale or sharing, limit certain uses of sensitive personal information, and receive equal service after exercising a right. FSS ONE does not sell personal data or share it for cross-context behavioural advertising.

Send a request to vladimir@fevralov.com. Describe your relationship with FSS ONE and, if relevant, the sender or customer workspace. We may verify identity and authority before acting. If we process the data only for a customer, we will forward the request to that controller and assist it. An authorised agent may submit a request where local law permits.

In the EEA, you may complain to the supervisory authority where you live or work, or to Latvia's Datu valsts inspekcija.

12. Cookies and public pages

The public FSS ONE legal and email-preference pages do not use advertising cookies or third-party advertising pixels. Essential network and security information may be processed by the hosting service to deliver the page and prevent abuse. An unsubscribe link may contain a random token used only to identify and record the requested preference; opening the page alone does not unsubscribe the recipient.

13. Children and sensitive data

FSS ONE is a business service and is not directed to children under 16. Customers must not knowingly use it to target children or upload special-category or highly sensitive personal data unless the use is necessary, lawful, expressly agreed and protected by appropriate safeguards.

14. Enterprise customer controls

Enterprise customers can define authorised users, workspace roles, connected providers, message approval and sending rules, suppression controls and retention requirements supported by their deployment. An enterprise customer may request deployment-specific information for a vendor, security and transfer assessment and may request appropriate data-processing terms. Availability and execution of those materials must be confirmed for that customer; this public policy does not replace a negotiated data processing agreement and does not claim a certification, audit or contract that has not actually been completed.

An enterprise administrator must communicate this policy and any customer-specific notice to its users and recipients, limit access to authorised people, respond to data-subject requests for data it controls, and tell us promptly about compromised credentials or unlawful use.