Privacy Policy

1. Who we are

This Privacy Policy explains how Flexilay Pty Ltd (“Flexilay”, “we”, “us”, “our”) collects, uses and protects personal information.

Flexilay provides a lay-buy and payment-scheduling platform that connects merchants, their customers and third-party services such as e-commerce platforms and accounting tools.

Our services include:

• Lay-buy / payment-plan options for online checkouts (e.g. Shopify, WooCommerce, BigCommerce, Odoo);
• Payment scheduling linked to accounting and invoicing systems (e.g. Xero, MYOB – coming soon); and
• A standalone payment-scheduling portal for merchants and their customers.

We do not act as a lender or financial institution and we do not hold customer funds. Payments are processed through the merchant’s connected payment provider (for example Stripe) and other third-party services.

2. Personal information we collect

The personal information we collect depends on how you interact with Flexilay.

2.1 Information you provide directly

We may collect information that you provide directly, such as:

• Name, email address, phone number and business details when you sign up for a merchant account, use our contact forms, support channels or demos, or register interest in Flexilay.
• Login and authentication details (such as email and password or magic-link email) for merchant and customer portals.
• Information entered into Flexilay plans, including customer name, contact details and order or invoice references, plan terms (amounts, schedule, due dates) and any notes or internal references you add.

2.2 Information from connectors and third-party services

With your permission, we may obtain information from services you connect to Flexilay, such as:

• E-commerce platforms (e.g. Shopify, WooCommerce, BigCommerce, Odoo), including order details, cart contents, totals, taxes and shipping, customer contact details provided at checkout, and order and payment status.
• Accounting and invoicing platforms (e.g. Xero, and MYOB when available), including invoice numbers, amounts and due dates, customer contact details and payment / reconciliation information.
• Payment providers (such as Stripe), including non-card details relating to payment status (paid, pending, failed, refunded), transaction identifiers and limited card metadata (e.g. last four digits, card brand, expiry) when necessary for identifying a payment method.

We do not receive or store full payment card numbers or CVV codes. Those details are handled by the payment provider.

2.3 Automatically collected information

When you use our websites and portals we may collect:

• IP address, browser type and device information;
• Pages visited, time spent on pages, and basic usage analytics; and
• Events relating to the setup, confirmation and management of Flexilay plans (for example, when a plan is created, updated or completed).

We may use cookies and similar technologies to support these features (see our Cookie Policy for more information).

3. How we use personal information

We use personal information for the following purposes:

1. Providing our services
   Creating and managing merchant and customer accounts; setting up, displaying and managing lay-buy and payment schedules; and communicating with merchants and customers about their plans, including payment reminders and status updates.
2. Integration with connectors and payment providers
   Syncing data between Flexilay and connected platforms (e.g. Shopify, WooCommerce, BigCommerce, Odoo, Xero, MYOB, Stripe); and updating order, invoice and plan statuses using information from those platforms.
3. Support and communication
   Responding to questions, demo requests and support tickets; and sending important service messages (such as changes to terms, disruptions or security notices).
4. Improvement and analytics
   Monitoring usage patterns to improve our product, user experience and performance; and creating aggregated or de-identified statistics about usage of Flexilay (for example, overall plan completion rates).
5. Advertising and audiences
   Measuring the performance of our marketing; showing relevant ads to you and to people with similar characteristics on third-party platforms (such as Google); and creating, matching and analysing marketing audiences. Where we match audiences with advertising partners, identifiers such as your email address are shared only in a hashed (irreversible) form. Where required we rely on your consent, and you can opt out at any time (see “Marketing communications” below).
6. Legal, compliance and protection
   Meeting legal obligations; preventing fraud or misuse of our services; and enforcing our terms and protecting Flexilay, our users and third parties.

4. Legal bases (EU/UK/EEA)

Where applicable (for example under the GDPR or UK GDPR), we rely on the following legal bases:

• Performance of a contract (for providing Flexilay services to merchants and their customers);
• Legitimate interests (for analytics, product improvement, fraud prevention and protecting our rights);
• Consent (for certain marketing communications, advertising and audience matching, or optional cookies where required); and
• Compliance with legal obligations.

5. How we share personal information

We may share personal information with:

• Connected platforms and providers – to provide our services, we share and receive information with platforms you choose to connect, such as Shopify, WooCommerce, BigCommerce, Odoo, Xero, MYOB (when available) and payment providers like Stripe.
• Service providers – vendors who assist us in operating Flexilay, such as hosting and infrastructure providers, email and communication providers, analytics and monitoring tools, and professional advisers. These providers are only allowed to use personal information to perform services on our behalf and must protect it appropriately.
• Advertising and analytics partners – we use services such as Google Analytics and Google Ads to understand how Flexilay is used and to measure and improve our advertising. We may share hashed (irreversible) identifiers — for example, a hashed email address — with these partners to measure conversions and to build or match advertising audiences (such as Google Customer Match), including to reach people with similar characteristics. We do this only where permitted and, where required, with your consent. This is not a sale of personal information.
• Business transfers – if we are involved in a merger, acquisition or sale of assets, personal information may be transferred as part of that process, subject to confidentiality obligations and applicable law.
• Legal reasons – where required by law, or where we believe it is necessary to comply with legal processes or requests from authorities, protect the rights, property or safety of Flexilay, our users or others, or investigate and enforce legal claims.

We do not sell personal information.

6. International transfers

Flexilay and some of our service providers may operate in multiple countries. This means your personal information may be processed in countries other than the one where you live.

Where required, we take appropriate steps to protect personal information when it is transferred across borders, for example by using contractual safeguards or ensuring our providers are subject to suitable privacy frameworks.

7. Data retention

We keep personal information for as long as necessary to provide Flexilay services and maintain your account, comply with legal, accounting or reporting obligations, and resolve disputes and enforce our agreements.

When information is no longer needed for these purposes, we will take reasonable steps to delete or de-identify it.

8. Your rights

Depending on where you live, you may have rights regarding your personal information, such as:

• Accessing the personal information we hold about you;
• Requesting corrections if it is inaccurate or incomplete;
• Requesting deletion or anonymisation in certain circumstances;
• Objecting to or restricting certain types of processing; and
• Withdrawing consent, where we rely on consent.

To exercise these rights, please contact us using the details below. We may need to verify your identity before responding.

9. Marketing communications

If you opt-in to receive product updates or marketing communications, you can opt-out at any time by using the unsubscribe link in our emails or contacting us using the details below.

You can also opt out of personalised advertising and audience matching: contact us using the details below to have your information removed from our advertising audiences, and manage ad personalisation directly with the advertising platform (for example, Google Ads Settings at adssettings.google.com).

We may still send you important service-related messages about your account or plans, even if you opt-out of marketing.

10. Security

We use reasonable technical and organisational measures to help protect personal information from loss, misuse and unauthorised access, disclosure, alteration or destruction.

No system is completely secure, so we cannot guarantee absolute security. If you believe your account or information has been compromised, please contact us immediately.

11. Third-party websites

Our websites and portals may contain links to third-party sites or services. We are not responsible for the privacy practices of those sites. You should review their privacy policies before providing personal information.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of the policy will indicate when changes were made. If changes are material, we may notify you by email or via our services.

13. Contact us

If you have any questions or concerns about this Privacy Policy or how we handle personal information, please contact:

Flexilay Pty Ltd
52 Wellington Street, Launceston TAS 7250, Australia
Email: support@flexilay.com

If you are not satisfied with our response, you may have the right to lodge a complaint with your local privacy regulator. In Australia, this is the Office of the Australian Information Commissioner (OAIC).