Privacy Policy

For access requests submitted before August 2, 2026, we collected your work email address, company name, and role. These are stored in our access database and used to manage design partner follow-up.

Historical access forms also collected a device identifier to help detect duplicate submissions. Current browser collection and retention are described under When FLINT fingerprints below.

When an agent connects over MCP or the API to issue a passport or run a verification, we collect the data submitted for that purpose: agent name, optional controller, optional wallet address, and transaction context at verification time. Passports are signed and publicly resolvable by design. Verification records and the behavioral signals derived from them are retained as evidence and used to operate and improve FLINT's fraud-detection models.

We count selections of designated public calls to action in aggregate so we can understand which product paths are useful. These counters store the action name, public page path, and selected homepage persona when present. They do not store an IP address, user identifier, referrer, browser signature, or destination query string.

We collect standard server-side logs through our hosting provider (Vercel). These include IP addresses, browser type, and page request data, retained per Vercel's standard data practices.

FLINT requests browser and device signals when you open the Passport creation page or a public Passport, start a demo run, select sign-in, or submit a library resource request. A browser verification can also include these signals in its Environment Identity check. Collection depends on the browser loading our configured Fingerprint integration.

The signals can include a device identifier, request identifier, observation time, IP address, approximate location, browser and operating-system details, identification confidence, and available automation, VPN, and private-browsing signals. Some signals may be unavailable. A device identifier is pseudonymous, but can still relate to a person.

When collection succeeds, server-side Passport minting, account creation, and sign-in can associate a device with the relevant Passport or account in FLINT's internal trust graph. Public Passport views and demo runs retain device events without adding the browser's claimed Passport or session relationship to that graph. A library request can associate the submitted contact details with a device identifier.

Raw provider identifiers and device events stay in internal systems. Public verification records use scoped derived references instead of raw provider identifiers. Resolving a Passport or exporting a verification record shows its public or signed evidence; it does not export all internal device history. Contact us to request access to that history.

An API or MCP request does not itself run browser fingerprinting. Agent-native integrations can submit workload identity evidence without a browser device signal. Passport creation, sign-in, and the demo continue when the browser signal is unavailable; verification may have less Environment Identity evidence. FLINT does not currently provide a separate fingerprint opt-out switch in the website.

Historical access-request data (email, company, role) is used to evaluate design partner fit and communicate about FLINT product availability. We do not send marketing emails unrelated to FLINT. We do not sell or share this data with third parties for advertising purposes.

Device signals support abuse prevention, fraud investigation, and internal links between devices, accounts, Passports, and observed interactions. These links are not sold or exposed as cross-partner identity joins.

Aggregate call-to-action counts are used to evaluate site navigation and product interest. They are not used for advertising or individual profiling.

We use the verification and behavioral data submitted to FLINT to train and improve our own fraud-detection and trust models. This is protective intelligence: it helps defend agents against takeover, diversion, and impersonation by bad actors. We do not sell this data, do not share raw identifiers, and do not use it to train third-party or general-purpose models.

FLINT uses necessary cookies and local storage for authentication, security, abuse prevention, consent memory, and core product workflows. These controls are required for the site to operate and for FLINT to protect demo flows and signed verification records.

The cookie notice stores a local consent record so the site can remember that you have seen the necessary-controls notice. FLINT does not currently use third-party advertising cookies.

Brevo handles email delivery and historical access-request contact management. Data sent to Brevo includes your email address, company, and role. Brevo's privacy policy governs how they process this data.

Notion is used as a lightweight database for historical access-request records. Entries include email, company, role, submission timestamp, and device fingerprint. Notion's privacy policy governs their data handling.

Fingerprint provides the browser and device intelligence described above, including available IP and location signals. Its processing is governed by its privacy policy and data processing agreement. FLINT does not send your account email to Fingerprint as part of these browser captures.

Vercel hosts the FLINT application and retains standard infrastructure logs per their data retention policies.

Historical access-request records are retained until you request deletion or until the design partner process concludes, whichever comes first. Device fingerprints in our systems are retained alongside those records and deleted on the same schedule.

The default retention period for captured device-event records in FLINT's event store is 390 days, approximately 13 months. Closing a browser session does not delete these records. Related internal trust-graph device links have no automatic expiry and may remain after the underlying event expires. Fingerprint and infrastructure providers apply their own retention policies to their copies.

To request deletion of your data, email us at the address below. We will confirm deletion within 30 days.

If you are located in the European Economic Area, the United Kingdom, or California, you have the right to access, correct, or delete the personal data we hold about you. You may also object to or restrict certain processing, and in some cases request portability of your data.

To exercise any of these rights, contact us at contact@flint.network. We do not require you to create an account or pay a fee to make a data request.

FLINT is a fraud intelligence company. We take data security seriously as a matter of professional principle, not just compliance. Access-request data is stored in access-controlled systems. We do not store payment information. We do not log sensitive credentials.

No system is perfectly secure. If you believe your data has been involved in a security incident, contact us immediately at contact@flint.network.

We may update this policy as the product evolves. Material changes will be communicated to affected users by email. The effective date at the top of this page reflects the most recent revision.

FLINT is operated by KillChain, Inc. For privacy questions or data requests, email contact@flint.network.