Fliq GmbHLegal

Privacy Notice

Contents
  1. 1. For whom is this Privacy Notice?
  2. 2. Who are we and how can you contact us?
  3. 3. Where do we collect your data and what categories are collected?
  4. 4. How is your data used (purposes and legal basis)?
  5. 5. Who has access to your information (recipients)?
  6. 6. Do we transfer your data internationally (third country transfers)?
  7. 7. How long do we store your data?
  8. 8. No automated decision-making
  9. 9. What rights do you have under GDPR?
  10. 10. Changes to this Notice
  11. 11. Definitions
  12. 12. Additional Information for Certain U.S. Residents

Fliq GmbH (“Fliq”, “we”, “us”, “our”) takes data protection very seriously. This Privacy Notice transparently informs users in the European Economic Area ("EEA"), United Kingdom ("UK") and United States ("U.S.") about how we collect, use, disclose and process personal data under applicable data protection laws, particularly (UK-) General Data Protection Regulation ("GDPR"), California Consumer Privacy Act ("CCPA") and other local or U.S. state privacy laws. This Notice applies to all mobile applications, web applications, and related services published by Fliq GmbH (each individually and collectively, the “Service”).

1. For whom is this Privacy Notice?

This Notice covers our processing of personal data under applicable data protection laws and regulations with respect to any natural person residing in the EEA, the UK and the US who use the Service in accordance with our Terms of Use available at https://fliqlab.com/terms.

The Service provides an interactive entertainment experience generated mostly by artificial intelligence (“AI”). It uses AI technologies to generate different content units (text, images, video, etc.) and enhance certain features, including but not limited to automated interactions with you, content generation, personalization, and image or text analysis. The Service may offer features that allow you to converse with the Service. Where we offer such features and you use them, the conversations you have with the Service are stored in a condensed version and retrieved as needed to personalize your future interactions. The Service is accessible via the internet through both an application for mobile devices and a browser-based application (together “App”). You can use the Service without an account. Registering an account (“Account”) is optional, for example to save your progress. You must be 18 years of age or older to use the Service.

By providing this Notice to you, we comply with our information obligations under applicable law and regulations. In certain cases, the information provided in this Notice is only applicable based on your location (e.g., within the U.S. or the UK); in such cases, we will expressly indicate in the Notice which information applies to you. Please note that this Notice shall not confer upon you any rights or obligations that are not conferred upon you by law and regulations.

2. Who are we and how can you contact us?

Controller: Fliq GmbH

Address: Lychener Straße 43, 10437 Berlin, Germany

Email: hello@fliqlab.com

Data Protection Officer:

DDA Digital Data Advice GmbH, Torben Mißy

Winkelsfelder Straße 35, 40477 Düsseldorf

Tel: +49 211-94403-64

3. Where do we collect your data and what categories are collected?

Data Collected Directly From You:

Special Categories: Depending on the way you use the Service and interact with our AI technology, the categories of personal data may include special categories of personal data such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, data concerning health (“special categories of personal data”).

You are generally not required to provide your personal data to us. However, if you do not provide your personal data, we might not be able to carry out certain processes (e.g., we will be unable to provide access to our Subscription Services if you do not provide payment details to us). In some cases, this may mean that we will be unable to grant access to the Service.

Data Collected From Third Parties:

4. How is your data used (purposes and legal basis)?

We may process your personal data for the purposes set forth in the table below. We do not sell your personal data to any other company, except as described in Section 12 below.

We rely on the legal bases listed in the table below. Where relevant, the legitimate interest we pursue is included in the table below as well. The relevant legal bases are:

The additional legal bases we rely on when we process special categories of personal data are:

We use cookies in our App. Cookies are small text files used to enable the Service or to make the user experience more efficient.

We can store cookies on your device without your consent if they are strictly necessary for the operation of our Service. This applies when the storage of information on your terminal equipment, or access to information already stored, is essential to provide a digital service that you have expressly requested. For all other types of cookies, we require your consent.

Necessary Cookies

Necessary cookies are required for the provision and proper functioning of our Service. Without these cookies, not all the features and functionalities you request may be fully available.

Advertising Cookies

With your consent, these technologies are also used by advertisers to serve ads relevant to your interests. In this context, usage profiles may be created to display personalized advertising to you.

Statistics Cookies

Statistics cookies help us understand how you interact with our Service by collecting and analyzing information about your visit and subsequent usage. This provides us with insights to optimize our Service and develop it according to user needs. We also obtain your consent for this, as described in more detail below. However, we only receive aggregated reports and information through which we cannot personally identify you.

Purpose of processingLegal basisLegitimate interest (where relevant)Categories of personal data
To provide the Service to you (in line with our terms of use, available at https://fliqlab.com/terms) Depending on your use and settings, this particularly includes
  • Creating and maintaining your user account;
  • Facilitating the use of the AI technology, particularly enabling the creation of content like design suggestions, recommendations and automatic style/design, interior designs personalized to you, based on your input (including, where offered, your conversations with the Service);
  • Facilitate your purchases and payments (in particular concerning Subscription Services and Credits);
  • Detecting and solving issues that occur in connection with your use of the Service;
  • Ensuring compliance with our terms of use, available at https://fliqlab.com/terms
(i) Performance of contract; (ii) Legitimate Interests (as far as the processing is not objectively indispensable to perform the contract); (iii) Explicit consent (as far as special categories of personal data are processed); (iv) Essential storage of information on your device, or access to information already stored, to provide a digital service that you have expressly requested.We have a legitimate interest in using your account data in order to render the Service
  • User account details;
  • Content data
  • Metadata
  • AI Interactions ;
  • Purchases/Transactions;
  • App activity data;
  • Preferences
  • Location information
  • Other information
  • Communication details
  • Special Categories of personal data
To contact you (e.g., via email, push notification and chat with the Service) and provide you with information which you have requested(i) Performance of contract; (ii) Legitimate Interests (as far as the processing is not objectively indispensable to perform the contract).We have a legitimate interest in communicating with you upon your request.
  • Communication details
To continuously improve and develop the Service and to develop new products and services This particularly includes
  • Analyzing the use of the Service;
  • Carrying out A/B tests (a method of comparing two versions of (features within) the Service to determine which one performs better based on a specific goal)
(i) Legitimate Interests; (ii) Consent (as far as we cannot rely on Legitimate Interests); (iii) Explicit consent (as far as special categories of personal data are processed).We have a legitimate interest in developing and improving the Service in order to preserve and grow our business. In particular, we have a legitimate interest in running checks in which we classify information that are inappropriate, demonstrate harmful behavior or require explicit consent and aggregate these information to improve the handling of the data.
  • User account details;
  • Content data
  • Metadata;
  • AI Interactions ;
  • Purchases/Transactions;
  • App activity data
  • Preferences;
  • Location information
  • Other information
  • Special Categories of personal data
Where this purpose can be pursued based on anonymized data, we anonymize your personal data before processing it.
To anonymize your information(i) Legitimate Interests; (ii) Explicit consent (as far as special categories of personal data are processed).We have a legitimate interest in anonymizing your personal data to comply with data protection requirements so that we can subsequently process the data in anonymous form (e.g. to improve the Service); this helps us to protect the rights and freedoms of individuals and to comply with data minimization and privacy by design requirements.Potentially all personal data we process about you
To collect statistical information about the use of the App (App analytics). We analyze how you use the App, such as which objects you combine, which layouts you choose, which features you use most frequently and where you quit the App. This analysis is conducted predominantly in a pseudonymized or aggregated form. The App analytics are used for:
  • Product Improvement: To identify obstacles and popular features, balance gameplay, fix bugs, develop new content and design suggestions, and to train and improve the used AI models.
  • Personalized Content and Recommendations: To provide you with tailored suggestions within the Service (e.g., for furniture, outfits, styles, or new rooms).
We use cookies or similar technologies for this purpose. For information on our use of cookies and similar technologies, please see our CMP (Google User Messaging Platform), which you can open at any time via the privacy settings in the App, and Google’s information on how it uses data from apps that use its services at policies.google.com/technologies/partner-sites		(i) Consent; (ii) Explicit consent (as far as special categories of personal data are processed); (iii) Consent for the storage of information in the device of an end-user, or the access to information already stored in the end-user’s device.
  • Content data
  • App activity data
  • Preferences;
  • Location information
  • Special Categories of personal data
To show personalized advertisement / content to you and measure the performance of the advertisement / content. To display relevant ads both inside and outside the Service. For this purpose, a profile of your preferences (e.g., preferred styles, color schemes, product categories) may be created, which we use to manage advertising or transfer to advertising partners. We use cookies or similar technologies for this purpose. For information on our use of cookies and similar technologies, please see our CMP (Google User Messaging Platform), which you can open at any time via the privacy settings in the App, and Google’s information on how it uses data from apps that use its services at policies.google.com/technologies/partner-sites(i) Consent; (ii) Explicit consent (as far as special categories of personal data are processed); (iii) Consent for the storage of information in the device of an end-user, or the access to information already stored in the end-user’s device.
  • Content data
  • App activity data
  • Preferences;
  • Location information
  • Special Categories of personal data
To determine disruptions and to ensure the security of the App and our systems, including the detection and tracing of (the attempt of) unauthorized access to our servers. We use cookies or similar technologies for this purpose. For information on our use of cookies and similar technologies, please see our CMP (Google User Messaging Platform), which you can open at any time via the privacy settings in the App, and Google’s information on how it uses data from apps that use its services at policies.google.com/technologies/partner-sites(i) Compliance with our legal obligations regarding data security; (ii) Legitimate Interests (as far as no such legal obligations exist); (iii) Essential storage of information on the device of an end-user, or access to information already stored, to provide a digital service that an end-user has expressly requested.We have a legitimate interest in resolving disruptions and ensuring the security of the App and our systems, which includes providing a safe and abuse-free gaming experience.
  • User account details
  • Metadata
  • AI Interactions
  • App activity data
  • Preferences;
  • Location information
  • Special Categories of personal data
To provide you with direct marketing communication regarding products and/or services we offer (including via email or push notifications), including to utilize information based on previous interactions in order to make the messages more relevant. We use cookies or similar technologies for this purpose. For information on our use of cookies and similar technologies, please see our CMP (Google User Messaging Platform), which you can open at any time via the privacy settings in the App, and Google’s information on how it uses data from apps that use its services at policies.google.com/technologies/partner-sites(i) Consent; (ii) Legitimate Interests (as far as the direct marketing communication is permitted without prior consent under applicable direct marketing rules); (iii) Consent for the storage of information in the device of an end-user, or the access to information already stored in the end-user’s device.We have a legitimate interest in marketing our products and/or services.
  • Name
  • Email address
  • Preferences
To carry out auditing, reporting, and other internal operations (including conducting financial, tax and accounting audits; audits and assessments of our operations, privacy, security and financial controls, risk, and compliance with legal obligations; our general business, accounting, record keeping, and legal functions, and maintain appropriate business records and enforce company policies and procedures).(i) Compliance with our legal obligations regarding auditing and reporting; (ii) Legitimate Interests (as far as no such legal obligations exist); (iii) Explicit consent (as far as special categories of personal data are processed).We have a legitimate interest in ensuring compliance with applicable laws and regulations.Potentially all personal data we process about you
To enable corporate transactions (including sale of all or part of our asset(s) and/or activity(ies))(i) Consent; (ii) Explicit consent (as far as special categories of personal data are processed); (iii) Legitimate interests.We may have a legitimate interest in disclosing information to (potential) buyers or acquirers and their external counsels in certain scenarios.
  • Potentially all personal data we process about you
To safeguard our rights(i) Legitimate interests; (iii) Establishment, exercise or defence of legal claims (as far as special categories of personal data are processed)We have a legitimate interest in the establishment, exercise and defence of legal claims, in those exceptional cases where this should become necessary.Potentially all personal data we process about you
To comply with legal obligations to which we are subject (e.g., deriving from tax law, to carry out compliance investigations)Compliance with our legal obligations.
  • Potentially all personal data we process about you

In some cases, your personal data may be processed based on your freely given consent. You will be informed about the purposes of such processing prior to being asked to give consent.

5. Who has access to your information (recipients)?

Service Providers (Processors):

Third Parties:

6. Do we transfer your data internationally (third country transfers)?

Some recipients of personal data may be located outside the EEA and/or the UK in countries that do not offer a level of protection equivalent to the one granted in the EEA/UK.

Where personal data is transferred to locations outside the EEA/UK, we will, as required by law, ensure that your privacy rights are adequately protected either because the European Commission (EEA) or the Information Commissioner’s Office (UK) has decided that the country or the recipient to which personal data are transferred ensures an adequate level of protection (Art. 45 GDPR) or the transfer is subject to appropriate safeguards provided by entering into standard data protection clauses of the European Commission or the UK Addendum (Art. 46 GDPR) with the recipient, along with additional appropriate safeguards to protect the transferred data, unless GDPR provides derogations for specific situations (Art. 49 GDPR).

If we transfer your personal data to such a jurisdiction outside the EEA/UK which has been recognized as providing an adequate level of data protection, we will rely on adequacy decisions. A list of the European Commission’s adequacy decisions can be found at commission.europa.eu. A list of the UK’s adequacy decisions can be found at ico.org.uk. When transferring personal data to recipients in the U.S. we may rely on the EU-U.S. Data Privacy Framework (EEA) and its UK Extension (“DPF”), which ensures an adequate level of protection for recipients certified under the DPF. A list of recipients certified under the DPF can be found at www.dataprivacyframework.gov.

Where we rely on standard data protection clauses of the European Commission or the UK Addendum, insofar as the transfer is made to a service provider processing personal data on our behalf, Module Two (transfer from controllers to processors) of the standard contractual clauses or the UK Addendum is relevant; insofar as the transfer is made to recipients which do not process personal data on our behalf but for their own purposes, Module One (transfer from controllers to controllers) is relevant.

Copies of appropriate safeguards (to the extent we rely on such) can be requested at legal@fliqlab.com. Please note that such a copy may be redacted to the extent necessary to protect business secrets or other confidential information.

7. How long do we store your data?

Your personal data will generally only be stored until the personal data are no longer necessary in relation to the purposes for which they were collected (or otherwise processed).

As an exception, personal data may be stored longer where their processing is necessary for compliance with a legal obligation -- including compliance with statutory retention periods (e.g. under tax laws) -- to which we are subject or for the establishment, exercise or defence of legal claims.

Data that we process based on your consent will, in principle, be deleted without undue delay after you withdraw your consent, unless statutory provisions pursuant to Art. 17 (3) GDPR preclude such deletion.

Inactive user accounts will be deleted or anonymized after 2 years of inactivity.

8. No automated decision-making

No automated decision-making takes place in the context of the Service.

9. What rights do you have under GDPR?

You have the following rights under GDPR provided that the legal requirements therein are met:

Your Rights:

We then will no longer process your personal data for the purpose to which you have objected unless we are able to demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defense of legal claims.

When we process your personal data for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such direct marketing. We then will no longer process your personal data for direct marketing purposes.

A list of the EEA supervisory authorities can be found at www.edpb.europa.eu.

The UK Data Protection Authority’s (Information Commissioner’s Office or “ICO”) can be contacted at: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (United Kingdom), telephone number +44 (0)303 123 1113 or at ico.org.uk.

Please address your requests to exercise your rights to legal@fliqlab.com (with the exception of the right to lodge a complaint with a supervisory authority).

10. Changes to this Notice

We reserve the right to amend this Notice at any time for compliance with applicable laws. Please check regularly for updates. We will notify you of substantial changes that affect you.

Last updated: October 2026

11. Definitions

12. Additional Information for Certain U.S. Residents

12.1 Privacy Rights for U.S. Residents

Residents of certain U.S. states (including Texas under TDPSA) may have additional rights, in addition to the rights described in Section 9 above, subject to certain limitations, which may include:

How to exercise rights: Email legal@fliqlab.com or call +493028618150

GPC Signal: We honor Global Privacy Control signals for opt-out preferences. In addition, our Platform responds to global privacy control--or “GPC”--signals, which means that if we detect that your browser is communicating a GPC signal, we will process that as a request to opt that particular browser and device out of “sale” and/or targeted advertising (i.e., via cookies and tracking tools) on our Platform.

We will respond to your request as required under applicable U.S. privacy laws. When you submit a request, we will take steps to verify your identity and your request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial. If we deny your request, you may appeal our decision in accordance with the instructions we provide in our response.

To the extent permitted under applicable law, you may also designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization, and we may also require the relevant consumer to directly verify the identity and authority of the authorized agent.

While we do not disclose personal data to third parties in exchange for monetary compensation, our use of third-party analytics and advertising cookies may be considered “selling” under applicable U.S. privacy laws. We may “sell” the following categories of personal data: identifiers, commercial information, location data, and Internet and network activity. We may disclose these categories to third-party advertising networks, data analytics and marketing providers, and social networks for purposes of marketing and advertising. You may opt out of the sale of your personal data as described above.

12.2 CCPA Notice for California Residents

Categories of Personal Information Collected:

CategoryExamples
IdentifiersName, alias, user ID, email, phone, address, IP address, online identifiers
Customer RecordsAccount information, demographics, contact info, financial/payment information
Commercial InformationPurchase history, products/services obtained, consuming tendencies
Internet ActivityBrowsing history, clickstream data, search history, interactions with site/ads
Location DataGeneral location information about individual or device
Audio/VisualCall recordings, videos, photographs, profile images
Professional InformationJob title, company name, business email/phone
Protected ClassificationsRace/ethnicity, gender, age, sex, veteran status, disability
Inferences/ProfilesPreferences, characteristics, behaviors, attitudes, abilities
Sensitive Personal InformationAccount log-in, racial/ethnic origin, health information

Sales and Sharing:

We may “sell” or “share” identifiers, commercial information, location data, and Internet activity to advertising networks, data analytics providers, and social networks for marketing purposes.

We do NOT sell or share:

California Privacy Rights:

Exercise Your Rights:

When you submit a request, we will take steps to verify your identity and request by matching the information provided by you with the information we have in our records. We will process your request based upon the personal information in our records that is linked or reasonably linkable to the information provided in your request. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial.

You may also designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization in their first communication with us, and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

In addition, if we detect that your browser or device is transmitting an opt-out preference signal, such as the “global privacy control” or (“GPC”) signal, we will opt that browser or device out of cookies that result in a “sale” or “sharing” of your personal information. If you come to our Site or use our Services from a different device or from a different browser on the same device, you will need to opt-out, or use an opt-out preference signal, for that browser and/or device as well. More information about GPC is available at: https://globalprivacycontrol.org/.