Privacy Policy

Last updated: 22 October 2026

This Privacy Policy explains how byte2bit B.V. collects, uses, shares and protects personal data when you use flashtimer: our websites (including flashtimer.com and app.flashtimer.com), the flashtimer application, our API and MCP server, and the countdown timers we serve (together, the "Service"). It also explains your rights and how to use them.

We have written this policy to be complete and specific. If anything in it is unclear, email us at info@byte2bit.com and we will explain.

1. Who we are

The Service is provided by byte2bit B.V. ("byte2bit", "we", "us", "our"), a private limited company registered in the Netherlands.

Address: Korte Lijnbaanssteeg 1 - 4387, 1012 SL Amsterdam, the Netherlands
Chamber of Commerce (KvK) number: 94626251
VAT number: NL866841179B01
Email: info@byte2bit.com

We have not appointed a data protection officer, because the law does not require us to. For any question about privacy, contact us at info@byte2bit.com.

2. Our role: controller and processor

Data protection law (the EU General Data Protection Regulation, "GDPR", and the Dutch GDPR Implementation Act) distinguishes between a "controller", who decides why and how personal data is processed, and a "processor", who processes personal data on behalf of a controller.

We are the controller for personal data about our customers and the members of their organizations, people who visit our websites, and people who contact us. This policy describes that processing.
We are a processor for personal data about the people who receive our customers' emails and see their timers ("Recipients"). Our customer, the sender of the email, is the controller of that data and decides why it is collected. We process it only on our customer's instructions, under our Data Processing Agreement. Section 6 summarises what we process about Recipients. If you are a Recipient and want to exercise your rights, please contact the business that sent you the email; if you contact us, we will forward your request to them.

3. Personal data we collect, why, and our legal basis

We only collect the personal data we need for the purposes below. For each purpose we state the legal basis under Article 6(1) GDPR on which we rely.

What we collect	Why we use it	Legal basis
Account data: your name, email address, password (stored only in hashed form by our authentication provider), profile picture if you add one, and the details of any third-party login you use (such as Google).	To create and secure your account, let you sign in, and contact you about your account.	Performance of our contract with you (Art. 6(1)(b)).
Organization data: the organization's name and logo, the names, email addresses and roles of its members, invitations, and an audit log of significant actions taken in the organization (who did what, and when).	To provide organizations, access for the people you invite, roles and permissions, and the audit log you can review.	Performance of contract (Art. 6(1)(b)); for members other than the organization's owner, our customer's and our legitimate interest in running a shared organization (Art. 6(1)(f)).
Billing data: company name, billing address, VAT or tax ID, plan, subscription and payment history, invoices, and the last four digits, brand and expiry date of your card. Full card details are collected and stored by Stripe, never by us.	To charge for paid plans and top-ups, calculate and report taxes, issue invoices, prevent payment fraud, and handle refunds and payment disputes.	Performance of contract (Art. 6(1)(b)); legal obligation to keep tax and accounting records (Art. 6(1)(c)); legitimate interest in preventing fraud (Art. 6(1)(f)).
Content: the timers, designs, texts, images, logos, fonts, brand kits and settings you create or upload, and the custom domain you connect.	To store and display your content and serve your timers.	Performance of contract (Art. 6(1)(b)).
Integration data: the API keys, access tokens and account identifiers you give us to connect email, e-commerce and automation platforms (for example Klaviyo, Mailchimp or Shopify), and the data we read through those connections (such as campaign names and content, discount codes, products and stock levels).	To provide the integrations you switch on, such as placing timers in campaigns or syncing a timer with a promotion. Credentials are encrypted at rest.	Performance of contract (Art. 6(1)(b)).
Connected AI assistants: when you connect an AI assistant (such as Claude) to your organization through our MCP server, a record of that connection: your user ID, the organization, the assistant's name and the permissions you approved. Its access tokens are stored only in hashed form.	To let the assistant act on your instructions with the permissions you approved, and to show and disconnect it in Settings → Connected Apps.	Performance of contract (Art. 6(1)(b)).
AI feature inputs: the instructions you type into our AI features, or that an AI assistant you connect sends to them on your behalf, your current timer settings, a logo image if you attach one, and aggregated statistics about your timers' views.	To generate timer designs and analytics insights when you ask for them. We do not use your inputs to train AI models, and our AI providers do not use them to train theirs. We do not store logo images you attach to an AI request.	Performance of contract (Art. 6(1)(b)).
Communications: what you send us through the contact sales or support forms or by email, such as your name, work email, company, company size, phone number (if you give it), expected monthly views and your message.	To answer your question, prepare a quote, and provide support.	Steps taken at your request before entering into a contract (Art. 6(1)(b)); legitimate interest in answering enquiries (Art. 6(1)(f)).
Service emails: your email address and the events that trigger an email (for example that you are over your plan limit, a payment failed, or an automatic top-up could not be charged).	To send emails that are necessary to operate your account and subscription. We do not send marketing newsletters. If we ever want to, we will ask for your consent first.	Performance of contract (Art. 6(1)(b)).
Technical and security data: IP address, browser and device information, pages and API endpoints requested, timestamps, error reports, and for sign-ups a one-way hash of the network you sign up from.	To keep the Service secure and available, prevent abuse (such as mass sign-ups, disposable email addresses, automated purchases and fraud), enforce rate limits, and find and fix errors.	Legitimate interest in a secure, reliable and abuse-free Service (Art. 6(1)(f)).
Website analytics: pages visited, how you got to our website, approximate location, device and browser information, and interactions such as clicks on calls to action, collected with Google Analytics.	To understand how our websites are used and improve them.	Your consent (Art. 6(1)(a)), given in our cookie banner. Without your consent, Google Analytics is not loaded.
Referral and promotion data: the referral or promotion code you arrived with, and, if you take part in a referral programme, who referred whom and the rewards earned.	To apply discounts and referral rewards you are entitled to.	Performance of contract (Art. 6(1)(b)).

Where we rely on legitimate interest, we have balanced our interest against your rights and freedoms. You may object to this processing at any time (see section 10).

Where we rely on consent, you may withdraw it at any time, as easily as you gave it, by clicking "Cookie settings" in the website footer or in the account menu of the application. Withdrawing consent does not affect processing that took place before you withdrew it.

Do you have to give us your data? Providing account and billing data is necessary to enter into and perform our contract. Without it we cannot provide the Service. Everything else is optional.

Where we get data from. Most data comes from you. We also receive data from our authentication provider when you sign in with a third-party account, from Stripe about payments, from platforms you connect through an integration, and from members of an organization who invite you to it.

4. Automated decisions

We do not make decisions about you based solely on automated processing that produce legal effects for you or similarly significantly affect you.

We do use automated checks to protect the Service, for example to block sign-ups from disposable email addresses, to limit the number of sign-ups from the same network, to rate-limit requests, and to hold an automatic top-up for manual review when it looks unusual. If such a check affects you and you think it is wrong, contact us at info@byte2bit.com and a person will review it.

5. Cookies and similar technologies

Cookies are small text files that a website stores in your browser. We also use your browser's local storage, which works in a similar way.

We use strictly necessary cookies and storage without asking, because the Service cannot work without them. We use analytics cookies only if you accept them in our cookie banner. You can change your choice at any time with "Cookie settings" in the website footer or in the account menu of the application. If you withdraw consent, we delete the analytics cookies.

Name	Provider	Purpose	Type and duration
`__session`, `__client_uat`, `__refresh`, `__client` and related cookies starting with `__clerk`	Clerk (our authentication provider)	Keep you signed in, refresh your session and protect it against misuse.	Strictly necessary. From the end of your browser session up to 1 year.
`__cf_bm` and cookies set by Cloudflare Turnstile	Cloudflare, on our sign-in pages and our contact sales and support forms	Tell people apart from bots, to protect sign-up, sign-in and those forms from abuse.	Strictly necessary. Up to 30 minutes.
`ft_consent`	byte2bit	Remember your cookie choices, on flashtimer.com and app.flashtimer.com.	Strictly necessary. 12 months.
`ft_ref`	byte2bit	Remember the referral code you arrived with, so the referral can be credited when you sign up.	Strictly necessary for the referral you requested. Set only when you follow a referral link. 30 days.
`ft_promo`	byte2bit	Remember the promotion code you arrived with, so the discount can be applied at checkout.	Strictly necessary for the offer you requested. Set only when you follow a link with a promotion code. Deleted once the code is used, otherwise 30 days.
`ft_tz`	byte2bit	Remember your time zone, so the analytics in the application show times in it. Set only when you open Analytics while signed in.	Strictly necessary for the analytics you asked to see. 12 months.
Local storage entries starting with `flashtimer`	byte2bit	Remember interface choices, such as a banner or dialog you have dismissed or a collapsed sidebar, and keep a pending upgrade in progress.	Strictly necessary. Kept until you clear your browser storage.
`_ga`, `ga<ID>`	Google (Google Analytics, loaded through Google Tag Manager)	Distinguish visitors and sessions to produce website usage statistics.	Analytics, only with your consent. Up to 2 years.

Stripe sets its own cookies on its payment pages and in the payment form, to process payments and prevent fraud. These are strictly necessary for a payment and are described in Stripe's cookie policy.

The countdown timers we serve in emails do not set cookies.

6. Data about email Recipients (as a processor)

When a Recipient opens an email that contains one of our customers' timers, the Recipient's email program requests the timer image from our servers. To serve the timer and give our customer view statistics, we process, on our customer's behalf:

the Recipient's IP address, which we use to serve the image and to determine the approximate country, and which we store only as a one-way hash;
browser, operating system, device type and network (ASN) information derived from the request;
the time of the view, and whether the timer was running or had expired;
clicks on tracked timer links; and
a subscriber identifier, if our customer adds one to the timer link (for example to show every Recipient their own countdown). Depending on the email platform this identifier may be the Recipient's email address. We store it only as a keyed one-way hash, together with the time the Recipient first opened a timer that counts down from first open and, in an A/B test, the variant the Recipient was assigned. Records stored before we began keying the hash use a plain one-way hash; they are deleted automatically within the periods in section 9.

Subscriber identifiers, and the end dates of timers that count down to each Recipient's own date, travel in the query string of the timer's image and link URLs. Our Cloudflare logs and traces of these requests are set to leave the query string out. They record other details of the request, such as the timer's address without the query string, the email program or browser, the approximate location and the network, and are kept for up to 7 days. The Recipient's email program or its image proxy, and our customer's email platform, may log the full URL under their own policies.

We do not use this data for our own purposes, do not build profiles of Recipients, and do not combine it across customers, except to protect the Service from abuse (for example to filter bot traffic and enforce rate limits).

7. Who we share personal data with

We do not sell or rent personal data, and we do not share it for advertising.

We share personal data only with the service providers below, who process it on our behalf under a data processing agreement and only for the purposes described, and with the other recipients listed after the table.

Provider	What they do for us	Location and transfer safeguard
Cloudflare, Inc.	Hosting, databases and file storage, content delivery and security, sending of service emails, timer view statistics, logging, and AI processing (Cloudflare Workers AI).	Global network, United States company. EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
Clerk, Inc.	Sign-up, sign-in, account, organization and member management.	United States. EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.
Stripe Payments Europe, Ltd. and Stripe, Inc.	Payment processing, subscriptions, invoicing and tax calculation. For some purposes, such as fraud prevention and meeting its own legal obligations, Stripe acts as an independent controller under its own privacy policy.	Ireland and United States. EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
Functional Software, Inc. (Sentry)	Error and performance monitoring for the application.	United States. EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses.
Google Ireland Ltd. and Google LLC	Website analytics (Google Analytics and Google Tag Manager), only if you consent.	Ireland and United States. EU-U.S. Data Privacy Framework and Standard Contractual Clauses.

We also share personal data:

with platforms you connect: when you switch on an integration, we send data to that platform on your instruction (for example, we place a timer into a campaign in your email platform). That platform's own privacy policy applies to what it does with the data;
with AI assistants you connect: when you connect an AI assistant to your organization, we send it what it asks for on your behalf, within the permissions you approved: your timers with their settings, embed codes and previews; their analytics (totals, views over time, the busiest hour, the top timers, top lists by country, email app, device and operating system, and how many views came through email privacy proxies, never individual viewers); your A/B tests and their results; your brand kit, fonts and usage; the discounts, products and stock levels of the stores you connected to flashtimer; and the names, status and layout of the campaigns and templates in the email platforms you connected, never their recipients. Its provider's own privacy policy applies to what it does with that data. You can disconnect it at any time in Settings → Connected Apps. A connection stops working as soon as you delete your account or leave the organization, and its record is removed within 30 days;
within your organization: other members of an organization can see your name, email address, role and the actions you take in that organization. When you ask its owner or admins to do something you can't do yourself, we email them your name, email address and the message you write; we don't keep the message;
with professional advisers, such as our accountant, auditors and lawyers, who are bound by confidentiality;
with authorities, when the law requires us to, for example in response to a valid court order, or when needed to establish, exercise or defend legal claims; and
in a business transfer: if byte2bit, or part of its business, is sold or merged, personal data may be transferred to the buyer, who must continue to respect this Privacy Policy. We will tell you before that happens.

8. International transfers

We are based in the Netherlands, but some of our providers are located in, or can access data from, countries outside the European Economic Area ("EEA"), mainly the United States. When personal data is transferred outside the EEA, we make sure it is protected as the GDPR requires, by relying on:

an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for recipients certified under it; or
the European Commission's Standard Contractual Clauses, together with additional measures where needed.

You can ask us for a copy of the safeguards that apply by emailing info@byte2bit.com.

9. How long we keep personal data

We keep personal data only as long as we need it for the purpose we collected it for, or as long as the law requires.

Data	How long we keep it
Account, organization, content and integration data	As long as your account exists. When you delete your account, we delete this data, including the organization you own, from our live systems straight away, and it disappears from our backups within 30 days.
Connected AI assistants	Until you disconnect the assistant, or 30 days after it was last used. A connection stops working as soon as you delete your account or leave the organization, and its record is removed within 30 days.
Timers after a paid subscription ends	Timers above the limits of the Free plan are archived, not deleted, so you can restore them if you upgrade again. They are deleted when you delete them or your account.
Invoices, payments and other accounting records	7 years after the end of the financial year they relate to, as Dutch tax law requires (also after you delete your account).
Organization audit log	As long as the organization exists. After it is deleted, we keep only a bare record of which actions took place and when, without names, user identifiers or other details, to handle disputes and legal claims.
Referral records (a masked email address and a card fingerprint)	For as long as the referral programme runs, and no longer than 2 years after the referral, to prevent the same person or card from earning a referral reward twice. This is kept even if the account is deleted.
Contact, sales and support communications	Up to 2 years after our last contact with you, unless they become part of a contract.
Timer view statistics (including Recipient data)	About 3 months, after which they are deleted automatically.
Per-Recipient countdown start times (for timers that count down from first open)	Until one year after that Recipient's countdown ends, so that a Recipient who opens an old email again sees the offer as ended rather than a new countdown, or until the customer deletes the timer or its organization, if sooner.
Per-Recipient A/B test assignments (which variant a Recipient was shown)	90 days after the Recipient is first assigned a variant, or until the customer deletes the test or its organization, if sooner.
Sign-up security records (hashed network identifier)	24 hours.
Logs and traces of timer image and link requests	Up to 7 days.
Other server logs and error reports	Up to 90 days.
Website analytics (Google Analytics)	Up to 14 months.
Data we need for a legal claim, dispute or investigation	Until the matter is fully resolved.

10. Your rights

Under the GDPR you have the following rights:

Access: ask for a copy of the personal data we hold about you.
Rectification: ask us to correct inaccurate or incomplete data. You can correct most data yourself in your account settings.
Erasure: ask us to delete your data. You can delete your account yourself in your account settings at any time.
Restriction: ask us to limit how we use your data, for example while we check a complaint.
Data portability: receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another organisation.
Objection: object to processing based on our legitimate interest. We will stop unless we have compelling legitimate grounds that override your interests, or need the data for a legal claim.
Withdraw consent: where we rely on your consent, withdraw it at any time, for cookies with "Cookie settings" in the website footer or in the account menu of the application.

To use any of these rights, email info@byte2bit.com from the email address linked to your account. We may ask you to confirm your identity. We will respond within one month. If your request is complex, or we receive many requests, we may extend this by two more months, and we will tell you why. Using your rights is free of charge.

Right to complain. If you are unhappy with how we handle your personal data, please contact us first so we can try to fix it. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU country where you live or work, or where the alleged infringement took place. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

11. Security

We protect personal data with technical and organisational measures appropriate to the risk, including encryption of data in transit (HTTPS) and at rest, encryption of integration credentials with a separate key, hashing of the IP addresses and Recipient identifiers we store, role-based access within organizations, access controls and multi-factor authentication for our own staff accounts, signed and verified webhooks, rate limiting, and monitoring for abuse.

No system is completely secure. If a personal data breach occurs that is likely to put your rights and freedoms at risk, we will notify the Autoriteit Persoonsgegevens and, where required, you, within the time limits the law sets.

You can help by using a strong, unique password, enabling two-step verification if it is available to you, and keeping your API tokens secret.

12. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

13. Links to other websites

Our websites contain links to websites and services of other companies, such as the platforms we integrate with. This Privacy Policy does not apply to them. Please read their privacy policies.

14. Changes to this Privacy Policy

We may update this Privacy Policy, for example when we add a feature or a service provider. The date at the top shows when it was last changed. If we make a material change, we will notify account holders by email, or with a notice in the application, before the change takes effect.

15. Contact

For any question about this Privacy Policy or our handling of personal data, contact byte2bit B.V., Korte Lijnbaanssteeg 1 - 4387, 1012 SL Amsterdam, the Netherlands, or email info@byte2bit.com.