Updated: 2 November 2026Draft
1. Scope and data controller
This policy explains how Flash handles personal data from website visits, accounts, demo requests and related correspondence. The controller identified below is responsible for deciding why and how this data is processed.
- Data controller
- Adrián Vizcaíno Rodríguez
- Trading name
- Flash
- Address
- Calle Marqués de Viana 101, 10.º A, 28039 Madrid (Madrid), España
- Privacy contact
- adrian.vizcaino@flashembedded.com
2. Data, purposes, and legal bases
| Activity and data | Purpose | Legal basis |
|---|---|---|
| Demo enquiries and interest requestsName, email, company or project name, role, team size, use case, hardware, referral source, and the project information you submit. | Record and review your demo request, respond by email and coordinate any agreed demonstration. | Steps requested before a possible contract (GDPR Art. 6(1)(b)); legitimate interests in answering B2B enquiries where you act for an organisation (Art. 6(1)(f)). |
| Website accounts and authenticationAccount identifier, name, email, selected sign-in provider, identity claims and session state. | Record your interest in Flash, let you view your registration and secure sign-in. | Provision of the website account you request under the Terms of Use (Art. 6(1)(b)); legitimate interests in account security (Art. 6(1)(f)). |
| Security and abuse preventionNetwork address, request metadata, timestamps, authentication events, and keyed non-reversible rate-limit identifiers derived from address and email. | Deliver the service, diagnose failures, prevent automated submissions, investigate abuse, and protect accounts and infrastructure. | Legitimate interests in service and information security (Art. 6(1)(f)); legal obligations where applicable (Art. 6(1)(c)). |
| Recruitment contactsContact details, CV, work history, and information you choose to send. | Respond to unsolicited recruitment correspondence. There are currently no open roles or CV pool for future vacancies. | Legitimate interests in responding to correspondence addressed to Flash (Art. 6(1)(f)). Any future recruitment process will provide its own notice and legal basis. |
| Privacy requests and legal complianceRequest details, correspondence, verification evidence, and response records. | Verify and answer rights requests, establish an audit trail, and meet legal duties. | Legal obligations (Art. 6(1)(c)) and legal-claims interests (Art. 6(1)(f)). |
Enquiry details and related correspondence are kept as request records so we can review your needs, respond by email and follow up on the demonstration you requested. The demo form does not request payment-card or bank details.
Registering interest or requesting a demo does not sign you up for unrelated marketing. If direct marketing is introduced, it will use its own lawful basis, notice, and opt-out. Flash does not sell personal data or use your enquiry content for advertising. Current controls are described in Privacy Choices.
3. Where the data comes from
Data comes directly from you when you submit a form, register interest or contact Flash. Authentication claims, such as your name and email, come from the sign-in provider you choose. Technical request and security data is generated when you visit or sign in. The site does not collect engineering projects or product usage through your interest account.
4. Required and optional information
Required fields are needed to respond to your enquiry or create the interest account you request. Without them, that request cannot be completed. Optional fields can be left blank. Keep project descriptions general: do not submit credentials, confidential source code, sensitive personal data or other people's personal data. This form is for initial contact, not uploading a project.
5. Recipients and service providers
Access is limited to the operator, authorised personnel and service providers that need the data to deliver or secure the service. Provider details and safeguards:
- Website hosting
- Vercel Inc. — website hosting, request processing and content delivery. Flash uses the Pro service; the production deployment processes functions in the United States and uses Vercel's global delivery network. Vercel's published Pro agreement incorporates its Data Processing Addendum, including its subprocessors and transfer provisions
- API and database hosting
- To be confirmed before publication
- Authentication
- To be confirmed before publication
- Email delivery and receipt
- DonDominio (Soluciones Corporativas IP, S.L.) — delivery and storage of correspondence, including demo notifications. Its published hosting and email terms include a data-processing agreement and locate the service infrastructure in Spain. The operator accesses Flash mailboxes only through DonDominio, with no external forwarding or synchronisation service and no other people authorised to access them. Copies of correspondence are included when handling an erasure request
- Spam protection (when enabled)
- Cloudflare, Inc. — Turnstile bot protection. Its self-service agreement incorporates a Data Processing Addendum. Cloudflare acts as a processor for website protection and as a controller for improving its bot detection, as described in its Turnstile Privacy Addendum. Network and browser signals can be processed through its global infrastructure, including outside the EEA
- Database recovery storage
- Cloudflare, Inc. — private R2 object storage used for operator-created database recovery copies. Its self-service agreement incorporates a Data Processing Addendum. A Western Europe placement preference does not guarantee exclusive EU residency. International processing and support may involve other countries; applicable safeguards are described in the international-transfer section
Provider terms and processing information: Vercel DPA, Fly privacy and infrastructure information, Okta/Auth0 processing agreements, DonDominio hosting and email terms, and Cloudflare DPA. You can request information about the safeguards applicable to your data from the privacy contact.
When enabled, Cloudflare Turnstile loads at the final step of the demo form to check for automated submissions. Cloudflare receives network and browser signals needed for that check. Flash sends the resulting short-lived token to Cloudflare for validation; the token is not stored with your request or included in notification emails. Your form answers are not sent to Turnstile.
Cloudflare acts as a processor when protecting this website and as a controller when using signals to improve its bot detection. See the Cloudflare Turnstile Privacy Addendum for those purposes and how to exercise rights regarding Cloudflare's own processing.
Personal data may also be disclosed where required by law or where necessary to establish, exercise or defend legal claims.
6. International transfers and data locations
Hosting locations and the scope of international processing: Verified on 2 November 2026: the production API and Managed Postgres cluster are in Frankfurt, Germany; Vercel's production functions and the Auth0 tenant are in the United States. DonDominio publishes Spain as the location of its mail infrastructure. Vercel and Cloudflare use global networks. Fly's control plane, provider support and subprocessors may involve other countries. Hosting regions alone do not describe every processing location; provider terms and processing information are linked in the preceding section. Where data leaves the European Economic Area, Flash will use a valid GDPR transfer mechanism and assess any necessary supplementary measures. Current safeguards: To be confirmed before publication.
7. Retention
Data is kept only for the stated purpose, applicable limitation periods, and mandatory legal retention. The periods and criteria for each activity are listed below.
- Demo enquiries and interest requests
- Demo enquiries and related correspondence are kept only while needed to handle the request and its follow-up, for no longer than 12 months after the person's last substantive interaction (or the original request if there is no further interaction). Automated messages and unanswered follow-ups from Flash do not restart this period. We end follow-up and process deletion earlier when the person is no longer interested, requests erasure, or the data is no longer needed, subject to applicable legal obligations. Any records that must be retained for legal liabilities are blocked from ordinary use for the applicable period. If the person becomes a customer, only the data needed for that relationship is retained under the relevant customer retention rules
- Interest registrations
- Account identity, profile and registration records are kept while your website account remains open so that we can provide the account you requested. You can request closure through the privacy contact. Closure includes review and erasure of the account data held by Flash and its authentication provider; signing out or suspending access alone does not erase the account. Data no longer needed for the account is erased without undue delay, except for the minimum records that must be blocked to meet a legal obligation or address an identified liability. Those records are destroyed when the applicable limitation period and any proceedings requiring them have ended. Backup copies follow the separate rules below
- Security and infrastructure logs
- To be confirmed before publication
- Recruitment contacts
- Flash currently has no open recruitment process and does not maintain a pool of CVs for future vacancies. Unsolicited applications are used only to respond to the sender, then removed from active mailboxes within 30 days of that response, or within 30 days of receipt if no response is needed. A future recruitment process will provide its own notice before collecting applications. Only evidence necessary for an identified legal claim may be retained separately with restricted access for the applicable limitation period
- Privacy requests and legal claims
- Request correspondence is used while verifying and answering the request. After completion, only the evidence needed to demonstrate its receipt, scope, response and fulfilment is retained, blocked from ordinary use, until the applicable data-protection liability period has expired and any proceedings requiring it have ended. The case record identifies the legal ground, limitation period and destruction date. Additional identity documents are erased after verification unless retaining a specific part is legally necessary; the complete account or enquiry is not retained merely because a rights request was made
- Recovery copies
- To be confirmed before publication
8. Your data-protection rights and choices
Where applicable, you may request access, rectification, erasure, restriction, portability, or object to processing. You may withdraw consent at any time where consent is the basis, without affecting earlier lawful processing. Requests can be sent to our contact email. Flash may request proportionate information to verify identity.
Request verification and response times: Requests are normally free of charge. Flash must respond without undue delay and within one month of receipt. Where complexity or the number of requests requires up to two additional months, Flash must explain the extension within the first month. Additional identity information is requested only where there are reasonable doubts and only to the extent necessary; do not send identity documents unless requested. If a request is refused, Flash must explain why and how to complain or seek a judicial remedy. Direct marketing can be opposed at any time. A summary of every available control appears in Privacy Choices.
You may lodge a complaint with the supervisory authority where you live or work, or where the alleged infringement occurred. In Spain, this is the Spanish Data Protection Agency (AEPD).
9. Automated decisions and children
Flash does not use the website data described here to make decisions based solely on automated processing that produce legal or similarly significant effects. The interest registration and enquiry functions are intended for adults aged 18 or over, including professionals, hobbyists and students. They are not directed to children; eligibility is stated in the Terms of Use.
10. Security
Flash applies technical and organisational measures proportionate to the risk, including encrypted transport, server-side token handling, access control, request validation, rate limiting, and restricted processor access. Measures are reviewed against the nature of the data and current risk; no system is completely secure. Security reports can be sent to our support contact. Incident handling: Report suspected vulnerabilities or personal-data incidents to the published security contact with a concise description, affected URL and approximate time. Do not send passwords, access tokens, full identity documents or other people's data. The operator assesses and records the report, contains confirmed incidents, preserves only the necessary evidence and evaluates notification duties. Where required, Flash notifies the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a personal-data breach; affected people are informed without undue delay when the legal high-risk threshold is met. This is a reporting channel, not a promise of round-the-clock support.
11. Cookies, changes, and contact
The current site uses authentication cookies and stores the documentation interface you select in localStorage. Details are in the Cookie Policy. Material changes to this policy will be dated and communicated through an appropriate channel where required. Questions and privacy requests can be sent to our contact email.