Last updated: August 26, 2026
Flits Software Inc. ("we", "us", or "our") operates Biscuit (biscuit.so), an AI-powered application builder platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our service.
By using Biscuit, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our service.
When you sign up for Biscuit using a supported sign-in method, we collect:
When you use Biscuit to build applications, we store:
We automatically collect certain information when you use our service:
To improve product quality and diagnose issues, we record session replays of your interactions with the Biscuit editor. These replays capture visual content on screen, clicks, scrolls, form inputs, and page navigation. This processing is carried out under our legitimate interest in maintaining and improving the service (GDPR Article 6(1)(f)).
You can prevent session replay recording by enabling Do Not Track (DNT) or Global Privacy Control (GPC) in your browser settings. When either signal is detected, no replay data is collected.
When end users visit applications built and deployed on Biscuit, we collect basic usage data on behalf of the application's creator and to operate the platform:
We honor the Do Not Track (DNT) and Global Privacy Control (Sec-GPC) browser signals: when either is sent, we still record that a page was served, but we skip computing the visitor hash so the event does not contribute to unique-visitor counts.
If you make purchases or set up payouts on Biscuit, we store transaction records such as purchase history, payout history, and wallet balances. We do not store your credit card numbers, bank account details, or other payment instrument data — this information is collected and stored directly by our payment processor, Stripe, in accordance with their privacy policy and PCI compliance standards.
We use the information we collect to:
We share your information with the following categories of third parties:
We may disclose your information if required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
We retain your personal data for as long as your account is active or as needed to provide you with our services. If you delete your account, we will delete or anonymize your personal data within 30 days, except where we are required to retain it for legal purposes.
Project data and content you create may be retained for backup and disaster recovery purposes for a limited period after deletion.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, please contact us at privacy@biscuit.so.
We implement appropriate technical and organizational measures to protect your personal data, including:
However, no method of transmission over the Internet is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security.
Biscuit is not intended for users under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@biscuit.so and we will delete such information.
Your information may be transferred to and processed in countries other than your country of residence. These countries may have different data protection laws.
When we transfer data internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses approved by the European Commission, to protect your information.
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.
If you have questions about this Privacy Policy or wish to exercise your rights, please contact us: