Privacy Policy

FlawlessGroup OÜ ("Flawless", "we", "us") is an Estonian software development and technology company. FlawlessMLM is a brand of FlawlessGroup OÜ. This Policy explains how we handle personal data when you visit flawless.group or flawlessmlm.com, contact us, request a consultation or demo, communicate with our team, apply for a role, subscribe to updates or act as a representative of a customer, supplier or business partner.

The public websites are primarily intended for business users. They are not designed as consumer financial services, investment platforms or direct selling opportunities operated by Flawless.

Our customers may use Flawless software to run their own websites, mobile applications, distributor or partner portals, e-commerce functions, compensation plans, analytics, training, communications and other business processes. When we process personal data in those customer environments on the customer's instructions, the customer is normally the controller and Flawless is normally the processor or service provider.

In that situation, the customer decides why the data is used, which data is collected, who can see it, how long it is kept and which notices or consents are required. Requests concerning an account or project operated by one of our customers should normally be sent to that customer first. We may assist the customer under the applicable contract and data processing agreement.

Separate customer agreements, data processing terms and project settings may apply to customer platform data. This Website Privacy Policy does not expand the purposes for which Flawless may use customer platform data.

• Contact and identity data, such as name, work email, telephone number, company, job title and preferred communication channel.
• Enquiry and project data, such as the message you send, project description, industry, expected functionality, budget range, requested integrations and meeting notes.
• Business relationship data, including correspondence, proposals, contract discussions, customer or supplier information and records of our interactions.
• Recruitment data, such as a CV, portfolio, work history, interview notes and information you choose to provide when applying for a role.
• Technical and usage data, such as IP address, browser, device type, operating system, language, referral source, pages viewed, log data and cookie or similar identifiers.
• Marketing data, such as newsletter preferences, consent records, campaign interactions and event participation.
• AI interaction data, if an AI-assisted feature is made available on our websites, including the prompt or message you submit, relevant context, the generated response and technical logs needed to operate and secure the feature.
• Other information you choose to send to us.

Most data comes directly from you. We may also receive business contact information from your employer or colleagues, event organisers, referrals, public company websites, professional networks or other sources that a business contact would reasonably expect to be used for professional communication. We do not treat public availability as permission to use personal data for any purpose.

If we receive personal data from another source and the law requires us to tell you about that source, we will do so at the first appropriate contact or within the period required by law.

We use personal data only for identified business purposes. For users in the EU or EEA, our main legal bases are contract or steps requested before a contract, legitimate interests, legal obligations and consent where consent is required. The same approach is adapted to the legal framework that applies in other regions.

• To answer enquiries, arrange calls, prepare proposals and discuss a possible project.
• To manage customer, supplier and partner relationships and perform agreements.
• To operate, secure, troubleshoot and improve our websites and business systems.
• To measure website use and campaign performance when the required cookie or tracking choice has been made.
• To send product news or business updates where permitted. You can opt out of marketing at any time.
• To recruit and evaluate candidates.
• To prevent fraud, misuse, security incidents and abuse of our systems.
• To keep records required for accounting, tax, legal claims, audits and compliance.
• To operate AI-assisted website features, if offered, and to provide the response requested by the user.

Flawless develops and integrates AI and machine learning functions for different projects. Some public website features may also use AI, for example a chatbot, a request summariser or an assistant that helps route an enquiry. If you interact directly with an AI system on our website, we identify that interaction as AI when the law requires it or when it would not otherwise be obvious.

AI systems can produce incomplete, outdated or incorrect results. Website AI output is provided as an aid, not as professional advice or a final decision. Do not place confidential information, payment credentials, identity documents, health data or other sensitive personal data into an AI prompt unless we specifically ask for it through an approved process.

We may use third-party AI service providers to process prompts and outputs where needed to provide an AI-assisted feature. Their role, location and data handling depend on the tool and configuration in use. We assess those providers before production use and apply contractual and technical safeguards appropriate to the data involved.

We do not use the public websites to make decisions about visitors based solely on automated processing where the decision produces legal or similarly significant effects. If that changes, we will provide the additional notice, safeguards and rights required by the law that applies to the person concerned.

We use strictly necessary technologies to operate and secure the websites. Other technologies, such as analytics, embedded media or advertising tags, are used according to the choices shown in our cookie banner or settings. Details are available in the Cookie Policy and the current cookie settings on the relevant website.

We disclose personal data only when there is a business or legal reason to do so. Recipients can include:

• hosting, website delivery, security, monitoring and infrastructure providers;
• email, calendar, communication, customer relationship management and support providers;
• analytics and tag management providers, subject to the applicable cookie choice;
• recruitment and business administration providers;
• AI service providers used for a specific AI-assisted feature;
• lawyers, accountants, auditors and other professional advisers who are subject to confidentiality duties;
• public authorities, courts or law enforcement where disclosure is required by law or necessary to protect legal rights;
• a buyer, investor or successor if our business is reorganised, financed, sold or transferred, subject to appropriate confidentiality and data protection measures.

We do not sell personal data in the ordinary meaning of selling data for money. If a US state privacy law treats certain advertising or cross-context data disclosures as a "sale" or "sharing", we provide the choices required by that law where it applies to us.

Because our websites and business tools use international technology providers, personal data may be processed outside Estonia or outside the country where you are located. When EU or EEA personal data is transferred to a country that does not benefit from an adequacy decision, we use an available lawful transfer mechanism, such as the European Commission Standard Contractual Clauses, together with additional measures where needed. UK transfers are handled using a mechanism recognised under UK law where required.

For Brazil, Canada, Australia and other countries that regulate cross-border transfers, we apply the transfer, contractual and transparency requirements that are applicable to the relevant processing. Information about a specific transfer mechanism can be requested at [email protected].

We do not keep personal data indefinitely. The period depends on why the data was collected, whether a relationship continues and whether a law requires a longer record. As a working rule:

• general enquiries that do not become a customer relationship are normally kept for up to 24 months after the last meaningful contact;
• customer, supplier and contract records are kept for the contract period and afterwards for the time needed for accounting, tax, audit and legal claims;
• marketing records are kept until you unsubscribe or until the record is no longer useful for the stated marketing purpose;
• unsuccessful recruitment records are normally kept for up to 12 months after the recruitment process, unless a longer period is agreed or required;
• security and technical logs are kept for periods appropriate to security, troubleshooting and incident investigation;
• AI interaction logs, if used, are kept only for the period needed to provide, secure and review the feature, subject to the configuration and provider terms.

When data is no longer needed, we delete it, anonymise it or place it beyond ordinary use until secure deletion is completed, including through normal backup cycles.

We use technical and organisational measures appropriate to the type of data and the risks involved. Measures can include access controls, role separation, secure authentication, encryption in transit, logging, monitoring, backups, confidentiality obligations, supplier review and incident response procedures. No internet service can promise absolute security, so we avoid describing any system as risk-free or 100% secure.

Depending on your location and the law that applies, you may be able to ask us to access, correct, delete or restrict the use of your personal data, obtain a portable copy, object to certain processing, withdraw consent, opt out of direct marketing or challenge certain automated decisions. We may need to verify your identity before acting on a request.

To exercise a privacy right concerning Flawless as controller, write to [email protected]. If your request concerns a platform operated by a Flawless customer, contact that customer first unless the applicable law allows or requires a different route.

If the GDPR applies, you have the rights provided by Articles 15 to 22, subject to the conditions and exceptions in the Regulation. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or to the supervisory authority in the EU or EEA country where you live or work. When processing is based on consent, withdrawal does not affect processing that was lawful before withdrawal.

If an AI system directly interacts with you, we provide the transparency required by applicable EU AI rules. If AI is used in a way that triggers additional transparency or human oversight duties, those duties are handled in the relevant product or customer process rather than hidden in general website wording.

If UK data protection law applies, you have the rights available under the UK GDPR and the Data Protection Act framework as amended by the Data (Use and Access) Act 2025. You may complain to the Information Commissioner's Office. Where significant automated decision-making is used, we apply the safeguards and information duties required by UK law. Our cookie settings may be more conservative than the minimum UK rules so that visitors receive a consistent choice across our European websites.

US privacy rights differ by state. If a state privacy law applies to Flawless and to your information, you may have rights such as access, correction, deletion, portability, and the right to opt out of certain targeted advertising, sale, sharing or profiling activities. We honour legally recognised opt-out preference signals, such as Global Privacy Control, when required and technically applicable.

For California residents, if the CCPA applies to Flawless, the categories described in this Policy also describe the categories of personal information we collect and disclose for business purposes. We do not discriminate against a person for exercising a CCPA right. If we ever use automated decision-making technology for a significant decision in a manner covered by California law, we will provide the specific notice and rights required by the applicable compliance date.

If Canadian private-sector privacy law applies, we use personal information for purposes that a reasonable person would consider appropriate in the circumstances and obtain meaningful consent where consent is required. You may request access or correction, withdraw consent where legally available and raise a privacy concern with us. If AI is used to make or support a decision about an identifiable person, we aim to explain the role of the AI and maintain appropriate human accountability for the decision.

If the Brazilian LGPD applies, data subjects may have rights including confirmation of processing, access, correction, anonymisation, blocking or deletion where the legal conditions are met, portability, information about sharing, withdrawal of consent and review or information concerning certain decisions based solely on automated processing. International transfers are handled using a mechanism permitted under the LGPD and applicable ANPD rules.

If Australian privacy law applies, we handle personal information in line with the Australian Privacy Principles, including transparency about AI use, reasonable data minimisation and care with sensitive information. Visitors in other countries may have additional rights under local law. Mandatory local rights remain available even if they are not listed separately in this Policy.

Our public websites are intended for business users and are not directed to children. We do not knowingly use the public websites to solicit personal data from children. A customer that uses Flawless technology for a service accessible to minors is responsible for setting the appropriate age rules, notices, permissions and safeguards for its own service, with Flawless providing agreed technical support where applicable.

We update this Policy when our websites, suppliers, legal requirements or data practices change. The current version is posted on the website with the effective date shown at the top. Material changes may also be highlighted through the website or another appropriate channel.

Privacy questions and requests can be sent to [email protected]. Postal correspondence can be sent to FlawlessGroup OÜ, Vesivärava tn 50-201, 10152 Tallinn, Estonia.