Privacy Policy

1. Who we are

The Service is provided by FlashTower, operated by Boostlete LLC, a Wyoming limited liability company (“FlashTower”, “we”, “us”, or “our”), with its principal mailing address at 1620 N Carpenter Rd, Suite D46, Modesto, CA 95351, United States. Privacy questions and requests: privacy@flashtower.com.

2. Scope and our role

2.1 Controller / business. For personal information about website visitors, prospective customers, account holders, and billing contacts, FlashTower determines how the information is processed and acts as a “controller” or “business”.

2.2 Processor / service provider. For personal information contained in data that customer organizations enter into or connect to the Service about their organization, systems, and people (“Customer Data”), FlashTower processes it on the customer's behalf as a “processor” or “service provider” under our Terms of Service and Data Processing Addendum. The customer's own privacy notice governs that information, and requests about it should be directed to the customer.

3. Personal information we collect

Information you provide

• Account information: name, work email address, job title, and authentication credentials (passwords are handled by our authentication provider and stored only as salted hashes).
• Organization information: organization name, industry, size, country, website, and settings.
• Assessment and inventory data: answers to the FlashTower Scan, AI systems and permissions you record, findings, remediation notes, policies, and evidence you upload.
• Monitoring and Guard records: changes detected in your recorded inventory, alerts, recommended actions, approvals and denials (with the approving user and time), automation policies, and action outcomes.
• Communications: support tickets, contact-form submissions, and email correspondence.
• Billing information: billing contact and plan details. Payment card details are collected and stored by Stripe, not by FlashTower.

Information collected automatically

• Usage and device data: pages visited, allow-listed product events, browser type, and approximate (city- or region-level) location derived from IP address.
• Attribution data: campaign parameters (such as UTM tags), referring website, and landing page, stored in a first-party cookie.
• Security logs: sign-in events and security-relevant actions, with IP addresses stored in pseudonymized (hashed) form in our audit log.

Anonymous free scans and tools

If you run the free scan without an account, your answers are evaluated to produce your results. We retain only aggregate results (for example, industry, organization size band, score, and finding counts) without your answers or any personal information. Some free tools run entirely in your browser and send nothing to us.

4. How we use personal information

• Provide, operate, maintain, secure, and support the Service.
• Evaluate assessments and classify changes with our deterministic rules, and generate reports and alerts.
• Record and carry out Guard actions your organization approves or pre-authorizes, and keep an audit trail of them.
• Send transactional, security, and notification emails, and, where permitted, marketing emails you can opt out of.
• Process payments and manage subscriptions.
• Understand product usage in aggregate and improve the Service.
• Detect, investigate, and prevent fraud, abuse, and security incidents.
• Comply with legal obligations, and establish, exercise, or defend legal claims.

5. AI processing and model training

Risk scores, findings, and alert severities are produced by deterministic rules, not AI models. Optional AI features (such as narrative summaries) are disabled by default, subject to usage budgets, and run only if an organization administrator enables them. When enabled, we send only the redacted content the feature needs to our AI subprocessor, under commercial terms that prohibit the provider from training models on that content. We do not use Customer Data or your personal information to train AI models without explicit authorization.

6. Aggregated and de-identified information

FlashTower may combine de-identified metadata from many organizations into aggregate statistics, such as peer benchmarks. A statistic is published or shown only when it is derived from at least 10 organizations, each organization contributes at most one value, and cells that are too small or dominated by a single organization are suppressed. Aggregates never include assessment answers, evidence, documents, prompts, credentials, personal information, organization names, or any organization-specific weakness. Organizations can opt out in Settings → Privacy. FlashTower does not sell customer data and does not use customer data to train AI models. Examples of metadata used include risk scores, finding categories, AI vendor names, remediation times, and types of AI changes detected. We maintain de-identified information in de-identified form, do not attempt to re-identify it, and contractually prohibit recipients from re-identifying it.

7. How we disclose personal information

• Subprocessors and service providers that provide infrastructure and services on our behalf, listed on our Subprocessors page, under written confidentiality, security, and use-limitation obligations.
• Within your organization, according to the roles your administrators assign.
• Integrations you connect, to the extent needed to carry out what your organization asks.
• Legal and safety: when required by law or legal process, or to protect the rights, safety, and security of our users, the public, or FlashTower.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or transfer of the FlashTower business, subject to this Privacy Policy.

We do not sell or share personal information for cross-context behavioral advertising, and we do not sell personal information for any other purpose. We have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for purposes that would give rise to a right to limit its use under California law.

8. Analytics, cookies, and tracking signals

We use PostHog for product analytics through a first-party proxy. Autocapture and session recording are turned off, and analytics captures only allow-listed events and properties — never assessment contents, finding text, names, or email addresses. Analytics and first-party attribution do not run when your browser sends a Do Not Track or Global Privacy Control signal. Our error monitoring (Sentry) has session replay turned off and scrubs request bodies, cookies, and personal data. We do not use advertising cookies or third-party advertising pixels. See our Cookie Policy.

9. Retention

We keep personal information only as long as needed for the purposes described in this policy, then delete or de-identify it. Our standard retention periods are:

We may retain information longer where required by law, to resolve disputes, or to preserve evidence of a security incident or legal claim. See Data Retention, Export, and Deletion.

10. Security

We protect information with encryption in transit and at rest (provided by our infrastructure providers), organization-level isolation enforced in the database, role-based access controls, multi-factor authentication, audit logging, and scrubbing of personal data from error reports. No system is perfectly secure. FlashTower does not currently hold SOC 2, ISO 27001, HITRUST, or any other security certification or third-party attestation. FlashTower enters into a Business Associate Agreement only by a separate written agreement signed by both parties; current availability is described on the healthcare security page. See our Security page.

11. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, or receive a portable copy of your personal information, to object to or restrict certain processing, to withdraw consent, and not to be discriminated against for exercising these rights. To exercise a right, email privacy@flashtower.com. We will verify your request by confirming control of the email address associated with your account, and respond within the time required by applicable law. You may use an authorized agent where the law allows; we may ask the agent for proof of authorization and ask you to verify your identity. If we process your information on behalf of a customer, we will refer your request to that customer. You may also have the right to lodge a complaint with a data protection authority.

Export and deletion. Organization Owners can request an export or deletion of their organization's data from organization settings. We confirm deletion requests by email before deleting anything, and complete deletion within 30 days of confirmation, subject to the retention exceptions in Section 9.

Marketing emails. You can opt out at any time using the unsubscribe link or by emailing us. Transactional and security emails cannot be disabled while you have an account.

12. California privacy disclosures

This Section provides the disclosures required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), for personal information we process as a business. In the preceding 12 months we have collected the following categories of personal information, from the sources and for the purposes described in Sections 3 and 4:

Your California rights. California residents may request to know the categories and specific pieces of personal information we have collected, its sources, purposes, and the categories of recipients; to delete it; to correct inaccurate information; and not to receive discriminatory treatment for exercising these rights. Because we do not sell or share personal information and do not use sensitive personal information for purposes beyond those permitted by law, rights to opt out of sale or sharing and to limit use of sensitive personal information do not apply. We respond to verifiable requests within 45 days, which may be extended by a further 45 days where reasonably necessary with notice. We do not offer financial incentives in exchange for personal information.

13. International transfers

FlashTower is operated from the United States, and our subprocessors process data in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. Where the law of the European Economic Area, the United Kingdom, or Switzerland applies, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum and Swiss amendments, as applicable), incorporated in our Data Processing Addendum, or another lawful transfer mechanism.

14. Children

The Service is a business service for users aged 18 and over. It is not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact privacy@flashtower.com and we will delete it.

15. Changes to this policy

We will post updates on this page with a new “Last updated” date. For material changes, we will notify account holders by email and in the application at least 30 days before the changes take effect.

Contact

FlashTower is operated by Boostlete LLC, 1620 N Carpenter Rd, Suite D46, Modesto, CA 95351. Privacy and legal notices: privacy@flashtower.com. Security: security@flashtower.com. Privacy officer: Founder (acting Privacy Officer). Support: support@flashtower.com. Billing: billing@flashtower.com. General inquiries: hello@flashtower.com.