Legal

Privacy policy

Last updated: May 2026  ·  Flex Embedded, Inc. d/b/a FlexProtect

1. Who We Are

FlexProtect is operated by Flex Embedded, Inc. ("FlexProtect", "we", "us", or "our"), a company that provides product protection plans backed by AIG. Our services are available through our Shopify application and the website at flexprotect.ai.

For questions about this policy, contact us at:

2. Information We Collect

From Customers (warranty purchasers)

  • Name, email address, and shipping address — provided at checkout via the merchant's Shopify store
  • Order details, including the product purchased and its price
  • Plan details — plan number, coverage term, effective date
  • Customer portal activity — plan lookups, cancellation requests

From Merchants (Shopify store owners)

  • Shopify store URL, shop name, and contact email
  • Product catalog data — titles, prices, categories (used to classify products for warranty eligibility)
  • Order and fulfillment data — required to issue and track warranty contracts
  • Bank account information — collected via Stripe/Plaid for ACH settlement of plan payments (not stored by FlexProtect directly)

Automatically collected

  • Server logs including IP addresses, browser type, and pages visited on flexprotect.ai
  • Shopify webhook events related to orders, refunds, and app lifecycle

3. How We Use Your Information

  • Issuing warranty contracts — We share your name, email, product details, and purchase information with AIG to create and administer the service contract.
  • Customer portal access — We use your email address to send magic-link login tokens so you can manage your plans at flexprotect.ai/portal.
  • Merchant settlement — We use merchant bank account information, collected via Stripe, solely for ACH settlement of plan payments. We do not store full bank account details.
  • Product classification — We analyze merchant product catalog data using automated classification to determine warranty eligibility and pricing. No product data is sold or shared with third parties.
  • Service communications — We send transactional emails related to your warranty (confirmation, cancellation notices). We do not send marketing emails without your consent.

4. How We Share Your Information

We share personal information only as necessary to provide our services:

  • AIG — As the plan obligor, AIG WarrantyGuard, Inc. receives plan holder information (name, email, product, purchase details) necessary to issue and administer your service contract.
  • Stripe — Payment processing and ACH bank debit for merchant settlements. Stripe's privacy policy governs their use of data: stripe.com/privacy.
  • Shopify — As a Shopify app, we operate within Shopify's platform and are subject to Shopify's API terms. Shopify's privacy policy: shopify.com/legal/privacy.
  • Resend — Transactional email delivery. Only your email address and the content of transactional messages are shared.

We do not sell personal information. We do not share personal information with third parties for advertising purposes.

5. Data Retention

We keep personal data only as long as it is needed to provide our services and to meet our legal obligations.

6. Your Privacy Rights

Customers (warranty purchasers)

Depending on where you live, you may have rights under applicable privacy law (including GDPR, CCPA/CPRA, and similar state laws) to access, correct, or request deletion of your personal data. To exercise these rights, contact us at .

Merchants (Shopify store owners)

Shopify provides mandatory data request and deletion webhooks. When FlexProtect receives a data request from Shopify on your behalf, we log and acknowledge it. Merchant data requests can also be addressed by contacting us directly.

7. Data Security

We use industry-standard security practices including TLS encryption for all data in transit, encrypted secrets management via fly.io, and no storage of full payment credentials. Bank account information is handled exclusively by Stripe and Plaid, who are PCI-compliant.

Despite these measures, no system is completely secure. If you believe your information has been compromised, contact us immediately at .

8. Cookies and Tracking

The FlexProtect customer portal uses a session cookie solely to maintain your authenticated session. We do not use tracking cookies, advertising pixels, or third-party analytics on our portal. The main marketing website (flexprotect.ai) does not set any tracking cookies.

9. Children's Privacy

Our services are not directed to children under 13. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, contact us at and we will delete it promptly.

10. Changes to This Policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated via email to active merchants.

11. Contact Us

For any privacy-related questions, requests, or concerns:
Flex Embedded, Inc. d/b/a FlexProtect