Privacy policy

Who is responsible for your data

Flinza Works is the data controller for the personal information described on this page. That means we decide what is collected and why, and we are the ones you ask if you want it changed or deleted. Write to hello@flinzaworks.com and it reaches the people who can act on it, not a ticket queue.

What we collect

• Contact messages — the name, email address and message you submit through the contact form.
• Job applications — the name, email address, optional portfolio link, optional note, and any CV you attach, plus the role you applied for or the talent pool you joined.
• Booking details — if you book a call, Cal.com collects your name, email and chosen time under its own privacy policy.
• Basic technical data — aggregate page views and the standard request logs our host keeps for security and reliability. We do not run third-party advertising trackers on this site.

Why we are allowed to hold it

Where the GDPR applies, we rely on three lawful bases. Enquiries and applications are processed on the basis of your consent and our legitimate interests in responding to you and assessing candidates. Records we are required to keep are processed to comply with a legal obligation. You can withdraw consent at any time by asking us to delete what we hold.

What we do not do with it

We do not sell personal data, we do not rent it, we do not add you to a marketing list you did not ask for, and we do not use your CV to train anything. Your message or application is read by the people who need to read it and nobody else.

Who else processes it

We keep this short and specific, because a vague sub-processor list is not a useful one:

• Vercel — hosting, request logs and the serverless functions that receive form submissions.
• Vercel Postgres and Vercel Blob — the database that stores messages and applications, and the object storage that holds uploaded CVs.
• Cal.com — the booking widget embedded on the contact page, which processes booking details under its own policy.

These providers process data on our instructions. Some of them operate infrastructure in the United States, so your information may be transferred outside your country; those transfers are covered by the providers' standard contractual clauses.

How long we keep it

Applications and talent-pool submissions are kept for twelve months so we can consider you for future roles, then deleted. If you ask us to remove your application sooner, we do it within 30 days and it does not affect how we consider you. Contact messages are kept while the conversation is live and for a reasonable period afterwards for our own records. Uploaded CVs are deleted with the application they belong to.

How it is protected

Form submissions are transmitted over HTTPS, stored in a managed Postgres database and object storage that are not publicly readable, and reachable only by the team that needs them. We keep access limited rather than logging everything: the fewer copies of a CV that exist, the smaller the problem if anything ever goes wrong.

Your rights

Depending on where you live, you can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to how we are using it, or ask us to restrict what we do with it. If you are in California, you can ask what categories of information we collect and who we share it with, and you can ask us not to sell it — which we do not, because we do not sell it.

Email hello@flinzaworks.com and we will action your request within 30 days. We will not charge you for it, and asking will never count against an application.

Cookies

This site sets no advertising or analytics cookies and no tracking pixels. The booking widget on the contact page is embedded from Cal.com and may set its own cookies when you use it; that is the only third-party embed on the site that does.

Children

This site is aimed at businesses and is not intended for anyone under 16. We do not knowingly collect information from children, and if you believe we have, tell us and we will delete it.

Changes to this policy

If this policy changes in a way that matters, we will update this page and the date below. Continuing to use the site after a change means you accept the updated policy. Previous versions are available on request.

Last updated: September 2026