Clear privacy terms for a service built around private access.
This policy explains what Flashlink collects, why it is needed, how long it is kept, and which GDPR rights apply to customers and account users.
Account privacy
Storage, recipients and retention
Last updated October 28, 2026. Flashlink AB, org. no. 559581-7494. Contact support@flashlink.tech for data protection questions.
Data Flashlink may process
Account email address and authentication credentials stored as protected hashes or provider identifiers
VPN address, peer, installer, activation, and configuration metadata needed to deliver the service
IP addresses, timestamps, device and request metadata used for security, abuse prevention, and operational diagnostics
Local network telemetry from Flashlink devices: IP addresses, MAC addresses, and hostnames of devices on your own network, required to make remote access to those machines work
Billing status and payment references when a customer adds paid VPN addresses through a payment provider
Per-peer traffic-volume counters and technical diagnostics used for service operation; these can be linked to account and device identifiers
Security audit history
Flashlink records security metadata to protect accounts, administer authorised access and support incident investigation. This includes account or authenticated device identifiers, UTC timestamps, source IP addresses, affected devices, authorisations, outcomes and security-setting changes. Supported updated clients also report remote-session and control events; those reports are labelled as device reports rather than verified individual human identities. Screen contents, keystrokes, passwords, private keys and credential values are not included in this audit history. Security history is available to the account holder and any read-only integration they explicitly authorise. Live events are retained for 90 days by default, with account settings of 30, 90, 180 or 365 days. Protected backups follow their separate lifecycle, so shortening live retention or deleting an account does not instantly erase backup copies. Pending device reports may remain in a bounded local queue until delivered. Processing for service security and incident investigation relies on legitimate interests, and on applicable legal duties where established.
Website statistics
We use our existing server access logs to understand overall use of our public website and improve its pages, relying on our legitimate interest in this limited measurement. IP addresses are processed temporarily to estimate daily visitor counts. The statistics retain only daily totals and public page paths for up to 90 days, without IP addresses, visitor IDs, query strings or account identifiers. This feature adds no analytics cookies, browser fingerprinting or cross-site tracking. Recognised automated traffic and account/API pages are excluded. The existing access logs have their separate retention period described below. You may contact us to object to this processing.
Controller and contact
Flashlink AB, Swedish company registration number 559581-7494, Champinjonvägen 24, 141 60 Huddinge, Sweden, is the data controller for its own account, customer relationship and service security processing. For privacy, account, or legal questions, contact support@flashlink.tech.
Purpose and lawful basis
Necessary processing for an individual customer's service relies on performance of contract under GDPR Article 6(1)(b). Administration of business contacts, necessary security, abuse prevention, and service integrity may rely on legitimate interests under Article 6(1)(f), subject to balancing individuals' rights. Applicable accounting and tax duties rely on Article 6(1)(c). Required account and configuration data is necessary to provide the requested functionality.
Retention
Successful account deletion removes core account and peer configuration records after access revocation and payment closure steps complete. It does not immediately erase every usage snapshot, log, supplier record or backup. Those categories have separate retention rules. Necessary accounting records and data needed for a documented legal claim may remain under the applicable requirements.
Local network telemetry
When a Flashlink device (stick or router) is connected to your local network, it reports a list of the devices it discovers there: IP addresses, MAC addresses, and hostnames. This is used to help you reach specific machines remotely. Flashlink does not intentionally inspect or store the content of remote-access traffic. WireGuard encrypts traffic in transit; when a connection is relayed, Flashlink infrastructure remains part of the connection's trust boundary.
Processors and third parties
Flashlink uses OVHcloud for core infrastructure and external backups, Stripe for payments, Resend for service email, Sentry for diagnostics, Cloudflare Turnstile for website abuse prevention, and Google or Microsoft for optional sign-in. Fortnox is used for bookkeeping and Nordea for banking; relevant accounting and payment data is processed through those functions. Providers can have different processor or independent controller roles. European core hosting does not mean every provider, support activity or account record remains within the EU/EEA. Contact support@flashlink.tech for information about relevant recipients and transfer safeguards.
Customer organisations and remote access
An organisation using Flashlink to access other people's devices or data must establish its own authority, lawful basis and notices. Where Flashlink processes personal data on the organisation's instructions, that processing requires an applicable data processing agreement. This privacy notice does not authorise employee surveillance or replace the organisation's obligations.
Cookies and browser storage
The website does not enable advertising analytics or session replay. Sign-in uses HttpOnly access and refresh cookies, with a separate anti-forgery cookie; login credentials are not stored persistently in localStorage. Optional provider sign-in uses session state. A local preference remembers dismissal of the privacy notice until browser site data is cleared. Dismissal is not consent to optional tracking. Turnstile processes browser security signals during protected form use, and payment or identity-provider pages may use their own storage.
Retention schedule
Current retention targets for Flashlink data.
Core account deletion, operational records and backup expiry are separate processes. The schedule below describes the current configuration; a request for erasure is assessed against applicable legal duties and justified retention needs.
Account profile and password/OAuth identifiers
While the account is active; core account records are removed when the account deletion process completes. Separate retained categories are listed below.
VPN addresses, peer metadata, activation and configuration data
While needed for the allocated peer; successful peer or account deletion removes core configuration after the access-revocation steps complete.
Authentication cookies and browser storage
Access cookies: 30 minutes. Refresh and anti-forgery cookies: 7 days, renewable. Logout clears authentication cookies in the relevant browser. Optional OAuth session state has a framework maximum of 14 days. The privacy-notice preference has no automatic expiry and can be removed in browser settings.
Local network telemetry (device lists from sticks/routers)
The VPN API default is automatic deletion 30 days after the device last reported. Reconnection credentials are separate from discovery lists and are revoked through peer or account closure.
Usage snapshots and technical logs
Identifiable per-peer byte counters: up to 90 days under the current setting; they do not automatically cascade-delete with the account. Web access logs rotate daily with 14 rotated files. Other diagnostics and incident records have separate limits; there is no universal 30-day maximum for all logs.
Restricted backup copies
Local database backup rotation keeps 7 daily and 4 weekly copies. Encrypted external objects expire after 365 days, with an additional 30-day expiry rule for noncurrent versions. Storage lifecycle processing is asynchronous; account deletion does not immediately erase historical backups.
Support emails and legal correspondence
Normally up to 24 months after the last contact, unless a shorter deletion request can be fulfilled or a longer legal need applies.
Payment and accounting records
Required Swedish accounting records are normally kept for 7 years after the calendar year in which the financial year ended. Other payment, tax and dispute records follow their applicable justified requirements, independently of account closure.
Cookies and storage
What your browser stores.
The authentication and security items below support the requested account functions. The notice preference stores only your dismissal choice. You can remove site data in your browser; removing authentication data signs you out. A dismissed notice does not authorise optional tracking.
access_token
HttpOnly account authentication
30 minutes; renewable through sign-in or refresh
refresh_token
HttpOnly session renewal
7 days; a replacement starts its own lifetime
csrf_token
Protect account actions against forged requests
7 days; replaced during authentication
session
State for optional Google or Microsoft sign-in
Up to 14 days under the current session configuration; the sign-in flow may clear or update it
flashlink_admin_unlock
Additional authentication for restricted administration
Up to 30 minutes in the current configuration
flashlink_privacy_notice_dismissed
Remember dismissal of this privacy notice using localStorage
No automatic expiry; clear through browser site-data settings
Cloudflare Turnstile processes technical security signals in protected forms; see its Turnstile Privacy Addendum. Stripe and optional identity-provider pages may use their own storage. Contact support@flashlink.tech for questions about these providers and their processing.
GDPR rights
Your rights under EU data protection law.
Access the personal data connected to your account
Correct inaccurate account data
Request deletion when data is no longer required for the service or legal duties
Receive eligible data in a portable format where GDPR conditions apply, and request direct transfer where technically feasible
Object to or restrict processing where GDPR gives you that right
Complain to Integritetsskyddsmyndigheten, the Swedish Authority for Privacy Protection
Receive a response without undue delay, normally within one month; a permitted extension must be explained within that first month