Version 2026-10-27
Felag privacy policy
Draft for review by an Australian lawyer; not yet in force. Version 2026-10-27. Placeholders in square brackets are for the operator to complete.
[Felag Pty Ltd / entity name] (ABN [ABN]), Felag, handles personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles. Felag applies the Principles whether or not the small-business exemption would otherwise apply. [Lawyer: confirm whether Felag is an APP entity on turnover or by holding health information through regulated-role listings; opt in under s 6EA if not.]
This policy explains what Felag collects, why, where it goes and for how long. It is written from the code: what the service stores is what is listed here.
What Felag collects
| Information | Where it comes from | Why |
|---|---|---|
| Email address, display name, organisation name | You, at sign-in and onboarding | Account, sign-in links, invoices, notices |
| Buyer profile: industry, roles, tools, interests, what takes your time, whether you use Claude Code | You, during onboarding | The store's recommendations and the company plan |
| Agreement acceptances: document, version, time, hashed IP, hashed device | Your browser when you accept | Proof of acceptance |
| Session metadata: hashed IP address, hashed browser signature | Your browser | Security and fraud detection; never the raw IP |
| Purchases, memberships, credits, invoices, a payment-method fingerprint from Stripe | Stripe and the app | Billing, refunds, and detecting one payer behind many accounts; Felag never holds card numbers |
| Connections: provider, status, the provider's account id, a keyed fingerprint of the token, when checked | The connections vault and you | Health, reuse across automations, farm detection; the token itself stays in the vault |
| Variables (keys): name, last four characters, a keyed fingerprint | You, through the secrets vault | Health, "which automations use this", farm detection; the value itself stays in the vault |
| Install state: sign-off settings and your setup answers | You, at install | To run the automation the way you configured it |
| Run records: time, licence, seat, version, job, outcome, duration, number of tool calls, a hash of the output, the runtime's run reference, and for hosted runs the job's input (JSON) | The runtime | Health, ranking, credits, sign-offs, support and farm detection |
| Sign-off requests: the job, its input, your decision and when | The runtime and you | To stop and ask before an action you asked to approve |
| Reviews, replies, votes, reports, support tickets and messages | You | The store and support |
| Maker listings, versions, declarations, gate reports, payout account id | Makers | The marketplace |
| Audit log: who did what, when, with a short detail record | The service | Security, disputes, your rights requests |
Felag never stores: passwords (there are none), OAuth tokens, API keys or other secrets (vault references and keyed fingerprints only), card numbers, or the output of a run (a hash only). In own-Claude mode Felag never receives your prompts or the model's output; it receives the run report the plugin sends (job, outcome, duration, tool-call count, output hash).
Hosted runs do keep the job's input so that a run can be shown, re-approved or debugged. Do not put personal information in an input you would not want kept for the retention period below; the automation reaches your connected systems directly for the data it needs.
Fingerprints
A fingerprint is a keyed hash (HMAC) of a secret or signal, computed with a key held only by Felag. It lets Felag tell that two accounts use the same key, the same Xero organisation, the same card or the same device, without storing the key, the card or the IP address. A fingerprint cannot be reversed into the original.
Why Felag uses it, and the lawful basis
Felag collects personal information to run the marketplace you asked for (account, purchases, installs, runs, support), to meet legal duties (tax, consumer law, fraud), to keep the service and payouts honest (farm detection), and to improve the store for you (recommendations). Felag does not sell personal information or use it for advertising outside the service. Sponsored placements are chosen by listing, not by profiling you.
Buyers' connected data
When an automation runs, it reads and writes in your connected systems (for example Xero, Square, Klaviyo) within its declared footprint. That data is processed during the run and is not copied into Felag's database, except for the run record above. For that processing Felag acts on your instructions as a processor in the sense of the data processing addendum. You are responsible for having the right to connect those systems and for the personal information in them.
Who else handles it
| Sub-processor | Where | What for | What they see |
|---|---|---|---|
| Vercel | USA, with edge regions | Hosting the app and API | All request data in transit, server logs |
| Neon | [region, e.g. Sydney (ap-southeast-2)] | The Postgres database | Everything in the table above |
| Stripe | USA, Australia | Payments, invoices, maker payouts and identity checks | Your payment details, name, email, payout identity |
| Anthropic | USA | Running hosted automations (inference and managed sandbox) | The job's input, your connected data as the run reads it, the credentials for the run's duration |
| Nango | USA/EU | OAuth connections to your tools | Your OAuth tokens and the provider account |
| Infisical | USA/EU | Your API keys and variables | The secret values |
| Resend | USA | Email (sign-in links, notices) | Your email address and message contents |
Felag discloses personal information to these providers only to perform the service, under contracts that bind them to confidentiality and security. Several are outside Australia; by using Felag you consent to that disclosure, and Felag takes reasonable steps to ensure they handle it consistently with the Principles. [Operator: confirm Neon region, and each vendor's data-processing terms and region options.]
Felag also discloses information where the law requires (a court order, a regulator), to enforce its terms, or to a buyer of the business, with notice.
How long Felag keeps it
| Record | Kept for |
|---|---|
| Account and profile | While the account exists, then 30 days |
| Connections and variables (the references) | Until you disconnect or delete, or 30 days after closure; the vaults delete the secret at the same time |
| Run records and sign-off requests, including hosted run inputs | 12 months, then the input is removed and the metadata kept 7 years for ranking history and disputes |
| Purchases, invoices, credits, payouts, ledger | 7 years (tax law) |
| Agreement acceptances, audit log | 7 years |
| Support tickets and reviews | While the listing exists; reviews are removed with your account unless you ask to keep them anonymised |
| Session metadata | 90 days |
| Farm-detection flags and their evidence | 2 years after decision |
Your rights
You may ask to see the personal information Felag holds about you, to correct it, or to delete your account. Most of it is visible and editable in the app. For anything else, write to [privacy@felag.ai]; Felag responds within 30 days and will explain any refusal and how to complain about it.
Security
Secrets live in specialist vaults, not in Felag. Credentials are resolved for a run and never logged. Hosted runs execute in a sandbox with egress limited to the providers the listing declares. Every listing is scanned before it is listed and watched for undeclared destinations during benchmark runs. Access to the database is restricted and audited.
Data breaches
If a breach is likely to cause serious harm, Felag notifies the Office of the Australian Information Commissioner and affected people as soon as practicable under the Notifiable Data Breaches scheme, and tells company customers within 72 hours of confirming a breach that touches their data, as the data processing addendum promises.
Cookies
Felag uses one strictly necessary cookie, felag_session, to keep you signed in. There are no analytics or advertising cookies. The sign-in page sets nothing until you sign in.
Complaints
Write to [privacy@felag.ai]. If you are not satisfied with the response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Changes
Material changes are announced in the app at least 30 days before they take effect, and you are asked to accept the new version at your next purchase, renewal or submission.