Privacy Policy

The data controller is HouseFlax, Via Aristotele 15, 20128 Milano, Italia, VAT 12786200969. Questions about this policy or about your data go to hello@houseflax.com, and we answer within 30 days.

Account data. Your email address, a password stored only as a salted hash, and an optional studio name. If you sign in with Google or X instead, we receive your email address and display name from that provider, never your password.

Desk content. Everything you put on the desk: client names and contacts, statements of work, the messages you paste, the classifications and prices the engine produces, and the change orders it drafts. This is stored against your account so it is there when you sign in again.

Technical data. Our hosting provider records standard server logs — IP address, timestamp, requested URL, user agent — for security and troubleshooting.

What we do not collect. No card numbers or payment details ever reach this site; checkout runs on Stripe's own pages. There is no advertising network, no behavioural tracking, and no analytics profiling on this product.

• To run the service — creating your account, storing your desk, classifying what you paste. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To take payment — passing you to Stripe and recording which plan your account is on. Legal basis: performance of a contract (Art. 6(1)(b)).
• To keep the service secure — server logs, rate limiting, abuse investigation. Legal basis: legitimate interest (Art. 6(1)(f)).
• To meet accounting obligations — retaining invoices as Italian tax law requires. Legal basis: legal obligation (Art. 6(1)(c)).

The messages you paste often contain other people's names and words — your client's project manager, for instance. You decide what to paste, which makes you the controller of that content and HouseFlax its processor. Please do not paste special categories of data (health, beliefs, biometrics) or anything you are not entitled to share. Classifying happens on our server with a deterministic rules engine: your text is not sent to any third-party AI service and is not used to train anything.

• Cloudflare, Inc. — application hosting on Cloudflare Workers, the CDN, server logs, and the Cloudflare D1 database that holds your account and your desk.
• Stripe Payments Europe Ltd. — checkout and subscription billing. Stripe is the controller of your payment data under its own privacy policy.
• Google LLC — the web fonts on these pages are served from Google Fonts, which receives the requesting IP address. If you sign in with Google or X, that provider also processes your sign-in.

We do not sell personal data and we do not share it for advertising. Where a provider is outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses.

ExtraIssue sets one cookie: the session cookie that keeps you signed in. It is strictly necessary to deliver a service you asked for, so under the ePrivacy Directive it needs no consent banner. There are no analytics, advertising or profiling cookies on this site. If we ever add one, we will ask you first.

Your account and desk are kept for as long as your account exists. Delete a client, project or item and it is removed from the database immediately — there is no soft-delete holding area. Ask us to close your account and we erase it and everything on it within 30 days. Invoices are kept for 10 years, as Italian law requires. Server logs are kept for up to 90 days.

Under the GDPR you may request access to your data, correction, erasure, restriction of processing, portability in a machine-readable form, and you may object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time. Write to hello@houseflax.com.

If you believe we have handled your data badly, you may complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the authority where you live.

Traffic runs over HTTPS. Passwords are stored only as salted hashes. Every query against your desk is scoped server-side to your authenticated account, so one customer's data cannot be read by another. No system is perfect: if a breach ever affects your rights, we will notify the Garante within 72 hours and tell you directly where the law requires it.

If this policy changes materially we will say so in the product before the change takes effect. The date at the top always reflects the current version. The Terms of Service sit alongside this policy.