Privacy Notice

Introduction

Flappie Technologies AG (“Flappie,” “we,” “us,” “our”) respects your privacy and is committed to protecting your personal data. This privacy notice (the “Notice”) explains how we as a data controller process personal data of the following data subjects:

• customers who purchase our cat flap (the “Product”) via our online store (the “Online Store”);
• users of the Product and our mobile application Flappie App (the “App”);
• visitors of our website https://flappiedoors.com/ (the “Website”);
• individuals who interact with us via our social media channels;
• individuals who contact us or otherwise communicate with us in the course of our business activities;
• individuals appearing in camera-recorded video content processed through our Products and services, where applicable; and
• any other individuals whose personal data we process in connection with our Products, services or business operations.

We process your personal data as described in this Notice and in accordance with applicable data protection laws, including the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”), the UK General Data Protection Regulation and Data Protection Act 2018 (“UK GDPR”), the Swiss Federal Act on Data Protection (“nDSG”), and other relevant data protection legislation.

1. Who We Are – Data Controller

Item	Information
Data Controller	Flappie Technologies AG Leutschenstrasse 43, 8807 Freienbach, Switzerland
Privacy Contact	info@flappie.ch

2. What Data We Collect

Personal data means any information that allows us to directly or indirectly identify you as a natural person. We process, including collect, use, store and disclose, the following categories of personal data:

Category	Corresponding types of personal data
Main Data	Basic information that allows us to identify and communicate with you, such as your name and surname. We collect this data directly from you when you register as a user, create an account, or use the App or our Online Store.
Contact Data	Contact details used to communicate with you, including your email address, telephone number and postal address. We collect this data directly from you when you create an account, place an order, contact us, or communicate with us via the App, Online Store, or email.
Order Data	Information relating to orders and transactions, including ordered Products, order numbers, payment status, delivery details and billing information. We collect this data directly from you when you place an order via Online Store.
Communication Data	This includes FCM push tokens, marketing opt-in with timestamps, as well as information you provide when contacting customer support, including inquiries, correspondence, feedback, complaint details and support history. We collect this data directly from you when you contact customer support, submit inquiries, opt in for marketing, or communicate with us regarding issues related to the Product, App or Online Store.
Contract Data	This includes information such as the date and time of acceptance of the Terms of Service, version of the applicable terms, subscription status and transaction records. We collect this data when you accept the Terms of Service, register as a user, purchase Products, or otherwise enter into a contractual relationship with us via the App or Online Store.
Account Data	Your email address, password hash, username, avatar. We collect this data directly from you when you register as a user or use the App.
Device Data	Serial number, firmware, Wi-Fi SSID (hashed), IP address, logs. We collect this data automatically when you access or use the App or the Website.
Media Data	Video/photo bundles, thumbnails, timestamps. We collect this data directly from you when you use our Product and the related service to record, upload, view, or manage media content via App. For the avoidance of doubt, we do not collect audio recordings via our Product.
Cat Profile Data	Cat name, breed, profile photo, and associated preferences. We collect this data directly from you when you create or edit a cat profile in the App. Profile photos are uploaded by you from your device.
Detection Event Data	Structured records of detection events, including timestamps, identified cat, detection type (e.g. prey detected, no prey), confidence scores, and classification metadata. We collect this data automatically when the Product processes a detection event. These records are stored as structured database entries linked to the corresponding Media Data.
Analytics / Telemetry Data	Crash logs, feature usage, in-app clicks. We collect this data automatically through analytics tools when you use the App.
Location Data	Timezone, geohash (encrypted), country code, region labels. We collect this data directly from you when you use our Product.
Website Usage Data	Your IP address, browser type and version, device type and operating system, date and time of access, pages visited and navigation on the Website, referring URL, identifiers collected through cookies or similar technologies (such as Google Analytics ID, Meta Pixel ID, and TikTok Pixel ID), banner interaction logs, as well as usage statistics and preferences. We collect this data automatically when you visit the Website, including through server logs, browser technical information, cookies, and analytics services.
Social Media Data	Information that may include your first and last name, social media user ID, profile picture, gender, username, age, country, list of friends or followers, and other information that you have made publicly available on your social media profile or have consented to share. We obtain personal data from you when you visit, follow, interact with, or otherwise engage with our social media channels. We may also collect your personal data from social media platforms (e.g. via Facebook or LinkedIn Page Insights), where we act as joint controllers in respect of such processing. Additional information on this processing is available for Facebook here and for LinkedIn here.

3. Why We Use Data & Legal Bases

We process your personal data for the following purposes and on the following legal bases:

3.1 Consent

For the processing of personal data for the purposes listed below, we rely on your consent. You have the right to withdraw your consent at any time by sending us a corresponding email using the contact details provided in Section 1 of this Notice. With regard to cookies, you may withdraw your consent at any time by changing your preferences on the Website.

The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal.

Purpose	Categories of personal data
When you choose to share video content via FlappieTV, we process your Media Data (shared videos and thumbnails) and Account Data (username and avatar) to display your content on the FlappieTV community platform within the App. Shared content becomes visible to other Flappie users. You control which content to share through an explicit sharing action in the App. You may remove shared content from FlappieTV at any time, and upon removal, the content will no longer be displayed on the FlappieTV platform.	Media Data Account Data Analytics Telemetry Data
Advertising and promotion of our products and services using user-submitted video content	Media Data
Direct marketing (communication of special offers and informational content)	Contact data (email address)
Website development and improvement, including collecting information about your recent visits to the Website for analytical purposes.	Website Visit Data
Marketing purposes where we collect and process Website visit data using cookies to provide you with personalized offers based on your browsing history.	Website Usage Data

3.2 Performance of a contract

We process your personal data because such processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract.

Purpose	Categories of personal data
Processing of orders placed through the Online Store, concluding and performing sales contracts, processing of payments, delivering Products and App services, and handling returns or complaints.	Main Data Contact Data Order Data Contract Data Communication Data
Providing and operating the App and related services, including FlappieTV, managing user accounts, enabling the use of App functionalities, sending system notifications, and providing customer support.	Account Data Main Data Contact Data Device Data Contract Data Communication Data Media Data Cat Profile Data Detection Event Data

3.3 Legal obligation

We process your personal data where such processing is necessary to comply with a legal obligation to which we are subject under applicable laws or other legal acts.

Purpose	Categories of personal data
Organisation of accounting, including the retention of accounting records.	Main Data Contact Data Contract Data
Compliance with requirements and obligations arising from applicable laws, and responding to requests from public authorities and other law enforcement bodies.	All categories of personal data processed by us, as applicable

3.4 Legitimate interests

For the purposes described above, we process your personal data on the basis of legitimate interests. You have the right to request further information about processing based on legitimate interests by submitting a request to the contact details set out in Section 1 of this Notice. You also have the right to object to such processing if you believe that it affects your rights or interests.

Purpose	Categories of personal data
AI Training & Model Improvement. We use Media Data, Detection Event Data, and Cat Profile Data to train, test, and improve our AI models for prey detection, cat identification, health monitoring, and future product features. Rather than retaining full video recordings, we operate structured extraction pipelines that select specific training data based on defined criteria for each feature area: extracted frames for prey detection, daily face and body crops per cat for Cat ID and health monitoring, and a bounded number of curated short video clips per device per month for health features requiring motion context (e.g., gait analysis). User-facing video recordings that are not selected by these pipelines are automatically deleted after 30 days. Curated video samples retained for health model development are subject to a maximum 12-month retention period. Our system is designed to primarily capture cat-related footage; however, incidental captures of persons may occur due to false positives. You may opt out of AI training at any time via the App settings. Upon opt-out, your future recordings will no longer be selected for training and your existing training data will be restricted (excluded from active training use) but retained, so that your full history remains available if you choose to re-enable training. If you wish your training data to be permanently deleted, you may submit a separate erasure request. AI models that have already been trained using your data cannot be individually reversed or retrained to exclude specific data points, as this is a technical limitation inherent to machine learning systems. Third parties who believe they have been incidentally captured by the Product’s camera may contact us at info@flappie.ch to request a review and, where appropriate, deletion or anonymisation of the relevant footage.	Media Data Detection Event Data Cat Profile Data
Marketing Use of User-Shared Content. Where you have voluntarily shared content via FlappieTV, we may use such content for marketing, advertising, and promotional purposes, including on social media, our Website, and in other communications. This processing is based on our legitimate interest in promoting our products and services using authentic user content that has been voluntarily made available. By sharing content to FlappieTV, you grant Flappie a perpetual, irrevocable marketing licence under the Terms of Service (B 4(b)). This licence is granted at the moment of sharing, is separate from your data protection rights, and survives removal of the content from FlappieTV, account deletion, or termination of the Terms of Service. Flappie may retain copies of shared content for the purpose of exercising this licence. For the avoidance of doubt: the marketing licence is a contractual intellectual property right and is not revocable by withdrawing consent or exercising data protection rights under applicable law. However, Flappie will not use your content in new marketing materials if you request this by contacting us at info@flappie.ch.	Media Data Account Data
Handling enquiries, including receiving and responding to feedback.	Main Data Contact Data Communication Data
Ensuring the functioning and accessibility of the Website and implementing security measures to protect data.	Website Usage Data
Diagnosing and resolving Website errors and technical issues.	Website Usage Data
Analytics & Crash Reporting of the App and the Product.	Device Data Location Data Analytics / Telemetry Data
Managing our social media presence and communicating through social media channels, including responding to users’ comments or messages and ensuring platform-specific visibility.	Social Media Data
Backup of documents and data, including the storage of information containing personal data in backup systems.	All categories of personal data processed by us, as applicable
Disclosure of data to service providers and professional advisers.	All categories of personal data processed by us, as applicable
Disclosure of data to legal successors and/or potential acquirers.	All categories of personal data processed by us, as applicable
Disclosure of data to public authorities, law enforcement bodies, and supervisory authorities.	All categories of personal data processed by us, as applicable
Analysis of data where necessary for the establishment, exercise, or defence of legal claims, whether in judicial, administrative, or out-of-court proceedings.	All categories of personal data processed by us, as applicable
Preparation, submission, and/or defence of legal claims.	All categories of personal data processed by us, as applicable
Organisation of a sale, merger, or other corporate transaction, and disclosure of information for the purposes of legal, financial, or other due diligence, including disclosure of data to our legal successors and/or potential acquirers.	All categories of personal data processed by us, as applicable

4. Retention Periods

We retain your personal data for as long as is reasonably necessary to achieve the purposes set out in this Notice or for as long as retention is required by applicable law. When determining the appropriate retention period, we take into account the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which the personal data is processed and whether those purposes can be achieved by other means, as well as our legal obligations under applicable laws.

Below is a list of the main data retention periods. For a complete overview, please contact us using the contact details provided in Section 1.

Data Type	Rule
Unsaved Raw Videos	30 days – automatic deletion
Saved Bundles	Until deleted by you / account closure
Account & Analytics Logs	36 months (rolling)
Encrypted Backups	90 days
Marketing Opt-In Records	10 years (proof requirement)
Videos Linked to Detection Reports	Up to 90 days after internal processing, then deleted
AI Training Data (structured frame extractions, biometric crops, annotations, and curated video samples)	Structured extractions (frames, biometric crops, annotations): retained for the duration of active R&D, reviewed annually. Curated full video samples (health features only): maximum 12 months per sample. All training data restricted (not deleted) upon opt-out; deleted upon formal erasure request. Data no longer relevant to active model development will be anonymised or deleted. See our Legitimate Interests Assessment for full justification.
FlappieTV Shared Content (community display)	Until removed by you or account closure. Upon removal or account deletion, the content is no longer displayed on the FlappieTV platform.
FlappieTV Shared Content (marketing copies)	Retained under the perpetual, irrevocable Marketing Licence granted in the Terms of Service (B 4(b)). Copies of content shared to FlappieTV may be retained by Flappie for marketing, advertising, and promotional purposes even after the content is removed from FlappieTV or the user’s Account is closed.
Transaction Records	10 years (Swiss legal requirement)

After the applicable retention period has expired, or where we no longer need the relevant personal data for the stated purposes, we will delete the personal data or anonymise it, unless further retention is required to comply with a legal obligation or to establish, exercise, or defend legal claims.

5. Recipients of personal data

In certain cases, in order to comply with obligations arising from applicable laws or contracts, or to safeguard our legitimate interests, we may need to disclose your personal data to the following categories of recipients, who process your personal data as independent data controllers:

Category of recipient	Purpose of disclosure
Public authorities and law enforcement bodies	Where necessary, we disclose personal data to public authorities and law enforcement bodies in order to comply with legal obligations, court orders, or other binding requests, or to prevent, detect, or investigate unlawful activities.
Service providers and business partners	Where necessary, we disclose personal data to service providers and business partners to ensure the performance of contractual obligations and effective cooperation and communication.
Professional advisers	Where necessary, we disclose personal data to professional advisers to ensure the lawful and proper conduct of our business activities. Such advisers may include auditors and legal advisers.
Legal successors and/or potential acquirers	In the event of a transfer of business, merger, acquisition, or similar corporate transaction, personal data may be disclosed to potential acquirers or legal successors, as well as their representatives and financial or legal advisers, to the extent necessary for such transactions.

We may engage data processors to process personal data on our behalf. Such processors may access personal data solely for the purposes of performing their contractual obligations to us and are required to implement appropriate technical and organisational measures to ensure the protection of personal data. The processors we engage fall into the following categories:

Category of recipient	Purpose of disclosure
IT service providers	For the purposes of our day-to-day business operations, our IT service providers (such as data backup and storage service providers) may have access to your personal data, as they manage and enable the use of our technical infrastructure.
Accounting service providers	For the purposes of our day-to-day business operations, our accounting service providers may have access to your personal data.
Providers of work facilitation and productivity services	To facilitate our daily work processes, our work-enabling service providers may have access to your personal data.
Social media platform providers	Where necessary, we disclose your personal data to social media platform providers in order to promote and sustain our business activities through active marketing.
Marketing service providers	For the purpose of sending newsletters and notifications, we disclose your personal data to marketing platform service providers.
Other service providers and cooperation partners	Where necessary, we disclose your personal data to service providers and cooperation partners for the purpose of conducting surveys and tests aimed at assessing service quality and customer satisfaction.

Some of the recipients involved in our processing of personal data, including processors, may be located outside the European Economic Area (“EEA”). Accordingly, when disclosing personal data to such recipients, we may transfer your personal data outside the EEA. In such cases, we ensure that appropriate safeguards are in place to protect your personal data. Such safeguards include, where applicable, the European Commission’s Standard Contractual Clauses (SCCs) for transfers to countries without an adequacy decision, and reliance on the EU–US and Swiss–US Data Privacy Framework for transfers to certified US recipients. You have the right to obtain further information about the safeguards applied by contacting us using the contact details set out in Section 1 of this Notice.

6. Your Privacy Rights

You have the right to contact us in order to exercise the following rights in relation to our processing of your personal data:

• The right to access your personal data, including the right to obtain a copy of your personal data and information about how your personal data is processed;
• The right to rectification of your personal data where we process inaccurate or incomplete personal data relating to you;
• The right to erasure of your personal data, for example where the personal data is no longer necessary for the purposes for which it was collected, you withdraw your consent and no other legal basis for processing applies, or the personal data has been processed unlawfully;
• The right to restriction of processing, for example where you contest the accuracy of the personal data, the processing is unlawful, or we no longer need the personal data for the purposes of processing but you require it for the establishment, exercise, or defence of legal claims;
• The right to data portability, i.e. to receive your personal data or have it transmitted to another controller, where technically feasible, provided that the processing is carried out by automated means and is based on your consent or on the performance of a contract;
• The right to object to the processing of your personal data, for example where the processing is based on our legitimate interests or carried out for direct marketing purposes;
• The right to withdraw your consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal;
• The right to lodge a complaint with a supervisory authority. For residents of Switzerland: the Federal Data Protection and Information Commissioner (FDPIC/EDÖB), Feldeggweg 1, CH-3003 Bern (https://www.edoeb.admin.ch/en/fdpic). For residents of EEA member states: the data protection authority in your country of residence. For residents of the United Kingdom: the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, SK9 5AF, United Kingdom (https://ico.org.uk).

Residents of Switzerland may have additional or equivalent rights under the Swiss Federal Act on Data Protection (nDSG), including the right to data portability under Art. 28 nDSG. Where the nDSG provides additional protections, these apply in addition to the rights listed above.

You may exercise your rights as follows:

• Send an email to info@flappie.ch with the subject line “Data Request.”
• Provide the email address associated with your account.
• We will acknowledge receipt within 7 days and fulfill your request within 30 days.

What we mean by “deletion” and “erasure.” When we delete your personal data, we remove it from our active systems so it is no longer used to deliver our services, train our AI models, or otherwise process your information. Some data, once used to develop our AI models, cannot be individually reversed out of the resulting training datasets or trained models because machine learning systems do not support cell-level unlearning. In these cases: (a) no new training data is extracted from your recordings; (b) your existing training data is restricted (excluded from active training use) upon opt-out and deleted upon formal erasure request where technically feasible; (c) AI models already trained on your data cannot be individually reversed or retrained to exclude specific data points; and (d) backup copies may persist for a limited period until they are overwritten in the ordinary course of backup rotation. We are actively developing additional traceability capabilities to make training-data erasure more granular over time. If you have questions about how deletion applies to your data, please contact info@flappie.ch.

7. Children’s Privacy

Flappie is designed for adult cat owners. Our App, Online Store, and related services are not directed at children under the applicable age of digital consent in your jurisdiction (16 in most EEA member states unless a lower age has been set, 13 in the United Kingdom and Switzerland). We do not knowingly collect personal data from children below the applicable age. If you are under the applicable age, please do not create an account or submit personal data to us.

Where the Product is installed in a household with children, incidental captures of children by the Product’s camera may occur. These recordings are processed under the same technical and organisational measures described in this Notice, including motion-triggered recording, restricted access controls, and (where opted in) our three-tier AI training architecture. Parents and guardians may submit a request under Section 7 to review, delete, or restrict such recordings, or to opt out of AI training on behalf of their household.

We apply the principles of the UK Age Appropriate Design Code (Children’s Code) to the design of our App: data minimisation, default privacy-friendly settings, and no behavioural profiling of minors. If you become aware that a child has provided us with personal data in a way not intended by this Notice, please contact info@flappie.ch and we will take reasonable steps to delete that data.

8. Cookies and other tracking technologies

We use all cookies, except for strictly necessary technical cookies, on the basis of your prior consent. You always have the right to withdraw your consent by changing your preferences via the Website.

We use both first-party cookies (cookies set by our own domain) and third-party cookies (cookies set by the domains of third-party service providers, such as Google services).

The cookies we use are divided into session cookies and persistent cookies. Session cookies are valid only for the duration of your visit to the Website and are automatically deleted when you close your web browser. Persistent cookies are stored on your device for a specified period determined by us or by a third party and expire either on a specific date or after a defined period of time.

For convenience, we have categorized the cookies used on the Website according to their purpose as follows:

Category	Explanation
Necessary	These cookies are necessary to ensure the basic functionality of the Website, such as remembering your language preferences or enabling login. Necessary cookies cannot be disabled, as the Website would not function properly without them. In accordance with applicable laws, the use of these cookies does not require your consent.
Analytics	These cookies help us collect statistics about how the Website is used. For example, they allow us to see which pages are visited and how long users spend on them on average. We use such cookies only with your prior consent.
Marketing	These cookies are used to display personalised advertisements and to measure the effectiveness of marketing campaigns. We use such cookies only with your prior consent.
Preferences	These cookies enable the Website to remember choices you make (such as your language or region) and provide enhanced, more personalised features. We use such cookies only with your prior consent.

Representative Cookies by Category

Category	Examples	Provider(s)
Necessary	Shopping cart, session, checkout, consent status, localisation	Shopify, Consentmo
Analytics	Page views, session duration, site performance, heatmaps	Shopify Analytics, Google Analytics (GA4), Microsoft Clarity, Datadog
Marketing	Ad retargeting, conversion tracking, campaign measurement	Google DoubleClick, Pinterest
Preferences	Language, region, personalisation settings	Google Analytics, Cloudflare

The table above provides a representative overview. A complete, automatically updated list of all cookies used on the Website — including cookie names, providers, purposes, and durations — is available through the cookie declaration maintained by our consent management platform (Consentmo). You may access this declaration at any time via the cookie preferences icon displayed on the Website.

You may exercise your data subject rights (including access, correction, and deletion of your personal data) by submitting a request through our dedicated data request portal, accessible via the Website, or by contacting us at info@flappie.ch.

9. Automated Decisions

No legally significant automated decisions are carried out; users can manually control the lock.

10. Changes to this Notice

We may amend or update this Notice from time to time to ensure that it accurately reflects how we process your personal data. The most recent version of the Notice will be published on the Website.

11. Version History

Version	Date	Changes
1.0	20 May 2025	Initial release
2.0	25 February 2026	Added UK GDPR and nDSG references; updated cookie section with Consentmo cookie declaration reference and Preferences category; added third-party complaint mechanism; added annual review for AI training data retention; updated supervisory authority details (FDPIC, ICO).
3.0	10 March 2026	Revised AI training data architecture to three-tier structured extraction model (replacing blanket full video retention); updated retention table with tier-specific retention periods; updated AI Training purpose description to reflect structured extraction pipelines; aligned with revised Legitimate Interests Assessment.
4.0	24 March 2026	Updated FlappieTV marketing use section to reflect irrevocable Marketing Licence (Terms of Service, Part B 4(b)); split FlappieTV retention into community display (removed on account closure) and marketing copies (retained under perpetual licence); clarified that marketing use of user-shared content is based on contractual IP licence, not consent.

---

— End of Privacy Notice —