Privacy Policy

Last updated: August 12, 2026

For our Terms of Service, please visit the linked page.

This Privacy Policy explains how FLYX Entertainment Inc., which does business under names including Bakstage.AI, Bakstage, STAGE.AI, and FLYX ("Bakstage," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with our websites, software-as-a-service platform, dashboards, embedded widgets, APIs, AI-powered agents and workflows, voice and video features, chat, scheduling, analytics, integrations, and related services (collectively, the "Services").

Bakstage.AI is primarily a business-to-business SaaS platform. In some situations, we collect information directly from our customers, prospective customers, website visitors, administrators, agents, and other authorized users. In other situations, we process information about an individual on behalf of a business customer that uses Bakstage.AI to communicate with its own prospects, patients, customers, members, employees, or other end users.

1. Our Role: When Bakstage Is a Controller and When It Is a Processor

When you interact directly with Bakstage—for example, by visiting our corporate website, creating or administering a Bakstage account, requesting a demo, purchasing Services, or contacting Bakstage—we generally determine why and how that information is processed and act as the applicable controller, business, or similar responsible entity under privacy law.

When you interact with a Bakstage-powered widget, AI agent, chat, voice experience, live-video experience, scheduling flow, or other implementation provided by one of our business customers, that customer generally determines the purposes and means of processing. In that context, Bakstage generally acts as a processor, service provider, or contractor on the customer's behalf and processes the information according to the customer's instructions, our agreement with that customer, and applicable law.

If you are an end user of a Bakstage customer, you should review that customer's privacy notice and direct privacy requests to that customer when appropriate. We assist our customers in responding to applicable privacy requests as required by contract and law.

2. Information We Collect

The information we collect depends on how the Services are configured and how you interact with them.

A. Account, Business, and Contact Information

We may collect information such as:

B. Customer Content and End-User Data

Our customers may submit, connect, or generate information through the Services. Depending on the customer's configuration, this may include:

C. AI Interaction and Derived Data

When AI-enabled features are used, we may process:

D. Voice, Video, Camera, and Microphone Information

Certain features require access to a device camera or microphone. Access occurs only when enabled by the user, browser, device, customer configuration, or applicable permission flow. Where recording or transcription is enabled, the Services may process and store audio, video, and transcripts in accordance with customer settings, applicable notices, contractual requirements, and law.

E. Device, Usage, Log, and Security Information

We may automatically collect technical and usage information, such as:

We do not need access to legacy social-network relationship or entertainment-preference data to provide the current Bakstage.AI SaaS Services.

F. Information from Integrations and Third Parties

If a customer or authorized user connects a third-party service, we may receive information and authorization tokens from that provider to provide the requested integration. Examples may include Google Workspace, YouTube, Microsoft 365, calendars, CRMs, communications providers, identity providers, and other business applications.

We may also receive information from service providers that support fraud prevention, security, analytics, payments, marketing attribution, or business operations, and from customers that provide information to us for processing through the Services.

G. Cookies and Similar Technologies

We may use cookies and similar technologies on our corporate websites and within the Services for authentication, security, preferences, analytics, performance, and marketing attribution. Bakstage does not operate the legacy consumer advertising or social-network ecosystem previously associated with FLYX. Where required by law, we provide choices regarding non-essential cookies or similar technologies.

3. How We Use Information

We may use personal information to:

4. AI and Machine Learning Processing

Bakstage uses artificial intelligence and machine learning to provide features such as conversational agents, voice interactions, transcription, summarization, classification, intent detection, routing, analytics, recommendations, and suggested next actions.

Customer Content and end-user data may be processed by Bakstage systems and by third-party AI or infrastructure providers acting as subprocessors when needed to provide an enabled feature. We contractually and technically seek to limit such processing to the purposes for which the data is provided, subject to the applicable provider terms and our customer agreements.

Bakstage does not use Customer Content or end-user personal information to train generalized AI or machine-learning models for unrelated customers unless the applicable customer has expressly opted in or separately agreed in writing. We may use aggregated or de-identified operational telemetry to improve the security, reliability, quality, and performance of the Services where the information cannot reasonably be used to identify an individual or customer.

AI outputs may be probabilistic, incomplete, or inaccurate. Bakstage's AI features are designed to assist users and customer workflows, not to replace appropriate human review or professional judgment in contexts where such review is required.

5. Google Workspace, Microsoft 365, and YouTube Data

When an authorized user connects Google Workspace, Microsoft 365, YouTube, or another supported third-party account, Bakstage requests only the permissions reasonably necessary to provide the selected functionality. Users can review requested permissions during authorization and can revoke access through the applicable provider.

For Google Workspace user data:

We apply similar purpose limitations to Microsoft 365 data and use it only for the authorized functionality and related security, support, and legal requirements.

If YouTube API Services are enabled, we may process authorized YouTube account or channel information, live-stream information, comments, viewer or broadcast metadata, and related API data necessary to provide the enabled feature. Use of YouTube API data is subject to the applicable YouTube API Services Terms and Developer Policies.

When an integration is disconnected, we stop accessing new data through that authorization and delete or de-identify retained integration data when it is no longer reasonably necessary for the authorized feature, contractual obligations, security, backups, or legal requirements.

6. How We Disclose Information

We may disclose information in the following circumstances:

A. To the Customer and Its Authorized Users

When Bakstage processes information on behalf of a customer, that information may be made available to the customer and its authorized administrators, agents, employees, contractors, or representatives according to the customer's configuration and permissions.

B. Service Providers and Subprocessors

We may use service providers and subprocessors for cloud hosting, data storage, communications, AI processing, transcription, analytics, security, authentication, support, payments, monitoring, and other operational functions. These providers may process information only as reasonably necessary to perform services for Bakstage and are subject to appropriate contractual restrictions.

A list of current subprocessors may be made available at our Data Sub-Processors page or another location we designate.

C. Customer-Directed Integrations and Recipients

We may disclose information to a third-party system, recipient, or integration when a customer or authorized user instructs us to do so or enables an integration that requires such disclosure.

D. Affiliates

We may disclose information within the FLYX Entertainment Inc. corporate group for internal business, security, support, and administrative purposes, subject to this Privacy Policy and applicable law.

E. Legal, Security, and Safety Reasons

We may disclose information when we reasonably believe disclosure is necessary to comply with applicable law or valid legal process; enforce agreements; investigate fraud, abuse, or security incidents; or protect the rights, property, or safety of Bakstage, our customers, users, or others.

F. Business Transactions

Information may be disclosed in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to appropriate confidentiality and legal protections.

G. Aggregated or De-Identified Information

We may use or disclose aggregated or de-identified information that does not reasonably identify an individual or customer.

Mobile Messaging Exception

We do not share, sell, rent, or provide your mobile phone number, SMS/MMS opt-in information, or messaging consent data to third parties or affiliates for marketing or promotional purposes. This restriction applies notwithstanding other provisions of this Privacy Policy concerning disclosure of personal information. Mobile messaging information may be processed by communications providers and other service providers solely as necessary to deliver, route, support, secure, or comply with the messaging service, or as required by law.

7. SMS/MMS Messaging Privacy

When you provide a mobile phone number and separately opt in to receive text messages from Bakstage, we may use that number for the categories of messages described at the point of consent, such as service notifications, support communications, reminders, account-related messages, or product and marketing communications where separately authorized.

Bakstage does not sell or transfer SMS/MMS opt-in information or messaging consent for third-party or affiliate marketing, lead generation, or promotional campaigns.

8. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, to provide the Services, comply with customer instructions and contractual commitments, maintain security and audit records, resolve disputes, enforce agreements, or satisfy legal requirements.

Retention periods vary based on the type of information and customer configuration. Customer Content, recordings, transcripts, messages, and other end-user information may be retained according to customer settings, the applicable subscription or agreement, and lawful customer instructions.

When an account, integration, or customer relationship ends, we delete, return, de-identify, or restrict retained information in accordance with applicable agreements, our retention practices, technical limitations such as backup cycles, and legal obligations.

9. Security

We maintain administrative, technical, and organizational safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure. These safeguards may include access controls, authentication protections, encryption in transit and where appropriate at rest, logging and monitoring, vulnerability management, backup and recovery practices, personnel controls, and incident-response procedures.

No system or transmission method can be guaranteed to be completely secure. Customers and users are responsible for protecting their credentials, configuring permissions appropriately, and promptly notifying us of suspected unauthorized access.

10. Healthcare and Other Regulated Data

Bakstage may support healthcare use cases. Protected Health Information (PHI) should be submitted to or processed through Bakstage only where the applicable customer and Bakstage have executed a Business Associate Agreement (BAA) and the relevant Services are configured for that permitted use. Where a BAA applies, PHI is handled in accordance with that BAA and applicable HIPAA requirements.

Unless otherwise agreed in writing, customers are responsible for determining whether their use of the Services is subject to sector-specific requirements, obtaining required notices and consents, and configuring the Services accordingly.

11. Your Privacy Rights

Depending on where you live, the nature of our relationship with you, and the law that applies, you may have the right to:

To exercise rights regarding information Bakstage controls directly, contact privacy@bakstage.ai or use any privacy-request mechanism we make available. We may need to verify your identity or authority before fulfilling certain requests. We will not require verification for an opt-out request where applicable law prohibits such verification, and we will collect only information reasonably necessary to process the request.

If Bakstage processes your information on behalf of one of our customers, Bakstage generally acts as that customer's processor, service provider, or contractor. In that situation, the customer is generally responsible for responding to your request, and we may direct you to that customer. We will assist the customer as required by applicable law and our contract.

Some rights are subject to exceptions and may not apply in every circumstance. We will respond within the period required by applicable law and will explain any material denial or limitation where required.

12. European Economic Area, United Kingdom, and Switzerland

This section applies when the EU General Data Protection Regulation (GDPR), the United Kingdom GDPR (UK GDPR), the Swiss Federal Act on Data Protection, or similar European data-protection law applies to Bakstage's processing.

Our Roles

When Bakstage determines the purposes and means of processing—for example, for our corporate website, direct sales relationships, account administration, billing, security, and our own business operations—we generally act as a controller.

When Bakstage processes personal data on behalf of a customer through that customer's implementation of the Services, the customer generally acts as the controller and Bakstage acts as a processor. The applicable customer agreement or Data Processing Addendum may contain additional terms required by Article 28 of the GDPR or corresponding law.

Legal Bases for Processing

Where Bakstage acts as a controller, our legal bases may include:

Where Bakstage acts as a processor, the relevant customer is responsible for establishing the lawful basis for processing its end users' personal data and for providing required notices.

European Privacy Rights

Subject to applicable conditions and exceptions, individuals may have rights of access, rectification, erasure, restriction, data portability, and objection, including the right to object to direct marketing. Where processing is based on consent, you may withdraw consent at any time.

You may also have the right to lodge a complaint with the data-protection authority in the country where you live, work, or believe an infringement occurred. We encourage you to contact us first so we can try to address your concern.

Automated Decision-Making

Bakstage's general-purpose AI and workflow features are designed to assist customer interactions and human decision-making and are not intended, by themselves, to make decisions for Bakstage that produce legal effects or similarly significant effects on individuals without appropriate safeguards.

If Bakstage, acting as a controller, engages in solely automated decision-making that is subject to Article 22 of the GDPR, UK GDPR, or a similar law, we will provide any required notice, lawful basis, safeguards, and rights. When a customer configures the Services for automated decision-making, profiling, or similar workflows, that customer is responsible for determining whether additional notice, consent, human review, impact assessments, or individual rights are required, and Bakstage will provide reasonable assistance as required by law and contract.

International Transfers

Bakstage and its subprocessors may process personal data in the United States and other countries. Where European data-protection law requires a transfer mechanism, we may rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum or other approved UK mechanism, adequacy decisions, or another lawful transfer safeguard, as applicable.

Nothing in this section expands the territorial scope of the GDPR, UK GDPR, or Swiss law where those laws would not otherwise apply.

13. U.S. State Privacy Rights, Including California

This section supplements the rest of this Privacy Policy for residents of states with comprehensive privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), and other applicable U.S. state privacy laws.

Categories of Personal Information

Depending on how you interact with Bakstage and how a customer configures the Services, during the preceding 12 months we may have collected or processed categories of personal information such as:

The specific information we collect, our sources, purposes for processing, and categories of recipients are described in Sections 2, 3, 4, and 6 of this Privacy Policy.

California and Similar State Rights

Where applicable, you may have the right to:

Residents of states that provide a right to appeal our decision on a privacy request may submit an appeal by replying to our decision or contacting privacy@bakstage.ai with the subject line "Privacy Request Appeal."

Sale, Sharing, Targeted Advertising, and Opt-Out Preference Signals

Bakstage does not sell personal information for monetary consideration as part of our core SaaS business.

Our corporate website may use analytics, attribution, or advertising technologies. Depending on the technology and applicable law, some disclosures through cookies or similar technologies may be considered a "sale," "sharing," or targeted advertising even where no money changes hands. Where Bakstage is subject to such requirements and engages in covered activity, we will provide the required privacy choices and will honor legally recognized opt-out preference signals, such as Global Privacy Control (GPC), as required by applicable law.

A legally valid opt-out preference signal generally applies to the browser or device from which the signal is received and, where required and technically feasible, may also be associated with a known account. If you use a different browser or device, you may need to communicate your preference again unless applicable law requires otherwise.

Sensitive Personal Information

Bakstage does not use sensitive personal information under its direct control to infer characteristics about individuals for unrelated advertising or profiling purposes. We use sensitive personal information only for purposes reasonably necessary to provide requested Services, secure and operate the Services, comply with law, or for other purposes permitted by applicable law. If our use of sensitive personal information triggers a statutory right to limit its use or disclosure, we will provide the required mechanism.

Customer Data

When Bakstage processes personal information solely on behalf of a business customer, Bakstage generally acts as a service provider, contractor, or processor, and the customer generally acts as the business or controller. Requests about that data should ordinarily be directed to the customer. Bakstage does not use mobile messaging consent data received on behalf of customers for Bakstage's own third-party marketing.

Financial Incentives

Bakstage does not currently offer a financial incentive or price/service difference in exchange for the collection, sale, or sharing of personal information unless a separate legally compliant notice states otherwise.

14. Children

Bakstage.AI is a business-oriented SaaS platform and is not directed to children for the creation of direct Bakstage accounts. Individuals must be at least 18 years old, or the age of legal majority in their jurisdiction, to create a direct Bakstage commercial account unless otherwise authorized by a customer agreement.

A Bakstage customer may use the Services to communicate with individuals of different ages in a lawful business or service context. In those situations, the customer is responsible for determining whether parental consent, age-specific notices, or other protections are required, and Bakstage processes information on the customer's behalf as configured and permitted by law.

15. International Data Transfers

Bakstage and its subprocessors may process information in countries other than the country where it was originally collected. Where required by applicable law, we use contractual, organizational, or other recognized safeguards for cross-border transfers.

16. Incident and Breach Notification

We maintain procedures designed to identify, investigate, and respond to security incidents. If a security incident involving personal information requires notice under applicable law or a customer agreement, we will provide notice as required by that law or agreement.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date when we do. If a change is material, we may provide additional notice through the Services, by email, or through another reasonable method as required by law.

18. Contact Us

For privacy questions or requests, contact:

FLYX Entertainment Inc. d/b/a Bakstage.AI, Bakstage, STAGE.AI, and FLYX 25 Hazelwood Ave Livingston, NJ 07039 United States Email: privacy@bakstage.ai