Privacy Policy

This Privacy Policy explains how ORGANIZING GROUP SRL, a Romanian limited liability company (societate cu răspundere limitată) established in Romania, European Union (“Organizing Group,” “we,” “us,” or “our”), handles personal information through Flipweight’s websites, applications, and related services (the “Service”).

Organizing Group operates the Service and is the controller of the personal data described here within the meaning of the EU General Data Protection Regulation (GDPR). This Policy should be read with our Terms & Conditions.

We collect the information needed to run a decision workspace:

• Account data: name, email address, a one-way password hash, account roles, and account creation time.
• Decision data: titles, context, options, sources, criteria, weights, comparisons, scores, notes, chosen outcomes, review notes, and publication settings.
• AI interactions: prompts, relevant decision context, AI replies, model identifiers, citations, and usage totals.
• Technical and safety data: request metadata needed to operate and secure the Service. For registration-abuse prevention, an IP address is processed and only an HMAC-hashed value, UTC date, and daily count are kept in the registration ledger.
• Billing data: Stripe customer, subscription, price, billing interval, renewal, cancellation, and payment-status identifiers needed to provide paid access. Card and bank details are entered on Stripe's hosted pages and are not stored by Flipweight.

Flipweight does not currently use advertising trackers or analytics cookies. Signed-in state is maintained by storing an authentication token in your browser’s localStorage.

We use personal information to:

• create and authenticate accounts;
• save, calculate, rank, and display your decisions;
• provide AI generation, coaching, scoring, and optional web research;
• publish or revoke decision receipts at your direction;
• apply trials, plan access, request limits, and abuse controls;
• start and manage subscriptions through Stripe and reconcile signed billing events;
• operate, debug, secure, and improve the Service; and
• comply with law and enforce our Terms.

Authorized operators can view account names and emails, roles, decision titles and status, option and criterion counts, and daily AI usage to administer the Service. The operator ledger does not display passwords, decision scores, notes, or AI discussion content.

Under the GDPR our legal bases are: performance of a contract for creating your account and running your decisions and AI features; legitimate interests for security, abuse prevention, debugging, and improving the Service; legal obligation where law requires us to keep or disclose something; and consent where we ask for it, which you may withdraw at any time. We do not make automated decisions about you that produce legal effects—Flipweight ranks your options, not people.

When you use an AI feature, Flipweight sends the prompt and the relevant parts of your decision to OpenRouter. OpenRouter routes the request to the selected model provider. When web research is enabled, the request may also be used to search current public web sources and return citations.

Do not include secrets, financial account numbers, health records, or other highly sensitive information in decision content or AI messages. By default, Flipweight routes every AI request with data collection denied and only to endpoints OpenRouter certifies as zero data retention and no training — model providers may not store your prompts or use them to train models. Third-party processing is otherwise governed by OpenRouter’s Privacy Policy and the applicable model provider’s practices.

AI only enters the room when you use an AI-powered action. The API key stays on Flipweight’s server and is never sent to your browser.

We share information only as needed for these purposes:

• Service providers (processors): Google Cloud hosts the Service, Stripe processes subscriptions and payment details, and OpenRouter and its selected model providers process AI requests. Some of them operate outside the European Economic Area—see transfers below.
• Your direction: when you publish a decision receipt or intentionally share its link.
• Safety and law: when reasonably necessary to comply with legal process, protect rights and safety, investigate abuse, or secure the Service.
• Business changes: as part of a merger, financing, acquisition, reorganization, or sale, subject to appropriate confidentiality protections.

We do not sell personal information or share it for cross-context behavioral advertising.

Your decisions are private by default. If you publish a receipt, anyone with its unguessable link can view that decision's current title, description, criteria, options, option notes, scores, percentages, winner, and selected stability analysis. The link reflects later edits, so revoke it if you no longer want the decision readable.

A receipt does not include your name, email, account details, billing data, or AI discussion. You can revoke its link, but copies made before revocation remain outside our control.

We retain account and decision data while your account is active and as reasonably necessary to provide the Service, resolve disputes, enforce agreements, maintain security, and meet legal obligations. Daily AI and registration counters roll to the current UTC date, although the database record may persist until deleted or replaced.

We use measures designed to protect information, including hashed passwords, authenticated access, scoped operator roles, server-side API secrets, and HTTPS in production. No online service can promise perfect security, so use a unique password and avoid entering unnecessary sensitive information.

My Profile provides self-service account deletion. It immediately cancels an attached Stripe subscription and removes Flipweight account data; Stripe or legally required financial records may be retained under their applicable obligations. We also honor verified privacy requests, subject to lawful exceptions and technical feasibility.

You can:

• edit or delete individual decisions inside the Service;
• clear an AI discussion;
• choose whether to use AI or web-research features;
• choose whether to publish and later revoke a receipt;
• view subscription status and permanently delete your account from My Profile; and
• sign out to remove the active session from the current browser.

Under the GDPR you may request access to your personal data, its correction or erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it without affecting what happened before. We may verify your identity before acting on a request, and we answer within the statutory one-month deadline unless a request is complex.

If you think we mishandled your data, you can complain to the Romanian supervisory authority, ANSPDCP, or to the data-protection authority of your EU country of residence. You will not be treated worse for exercising a privacy right.

The Service is operated from Romania, inside the European Union, but our hosting and AI providers may process data in the United States and other countries outside the European Economic Area. Where that happens, the transfer relies on a European Commission adequacy decision covering the provider—such as the EU–US Data Privacy Framework—or on the Commission’s Standard Contractual Clauses together with the provider’s own safeguards.

Flipweight is for adults and is not directed to children. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we will take appropriate steps to delete it.

We may update this Policy as the Service or law changes. The effective date above shows the latest revision. We will provide additional notice of material changes when required.

Privacy requests and questions may be directed to ORGANIZING GROUP SRL, Romania, European Union, using the registered-office details in the Romanian Trade Register (ONRC) entity record. A dedicated privacy-support mailbox is not currently published.