Flable

What Flable is

Flable, marketed as Flable AI, is a profit intelligence platform for direct to consumer brands and the agencies that run their advertising. Instead of judging campaigns on return on ad spend alone, it brings together advertising, commerce, cost and logistics data to calculate contribution margin and profit on ad spend per channel, campaign and product, and suggests budget changes that the user approves. It also offers a conversational assistant for analysis and multi client dashboards for agencies.

Flable is published by Keinsa Pvt Ltd, a company registered in Pune, India, which also lists an office in Munich, Germany. Supported integrations include Meta Ads, Google Ads, Shopify, HubSpot, Zoho and Shiprocket, connected through their APIs. People searching for flable or flable ai usually want to know what the tool does with their store and customer data, which is what this page covers.

Data and cookies involved

Most of the processing happens server side. Through the API connections, Flable receives advertising metrics and configuration, Shopify orders, product costs and shipping data, and for some setups CRM records from HubSpot or Zoho. Order data can include customer names, email addresses, postal addresses and purchase history, which makes Flable a processor of your customers'' personal data, not only of aggregated statistics.

Flable states that onboarding includes setting up tracking for attribution, but it does not publicly document a storefront script, the cookies such a script would set or the domains it would load from. If your configuration adds a tracking snippet or a Shopify web pixel to link visits and purchases to ad clicks, expect first party identifiers, click identifiers and UTM data to be stored in the visitor''s browser; ask the vendor for the exact list before going live.

GDPR and ePrivacy implications

Under the GDPR, your brand is the controller and Flable acts as processor for the data it imports, which requires an Article 28 data processing agreement covering purposes, security measures, subprocessors and deletion. Flable claims SOC 2 Type II compliance, AES 256 encryption at rest and TLS 1.3 in transit, and its privacy policy names Fivetran and Airbyte as data pipeline providers.

Any attribution tracking on the storefront falls under Article 5(3) of the ePrivacy Directive 2002/58/EC. Marketing attribution is not strictly necessary for the service the visitor requested, so the French CNIL guidelines, the German TDDDG § 25 and the Spanish LSSI CE art. 22.2 require prior consent before reading or writing such identifiers.

Consent requirements

If Flable only reads your ad accounts and your Shopify back office through APIs, no cookie consent is needed for Flable itself, because nothing is stored on the visitor''s device. Processing your own order data for profitability analysis can rest on legitimate interest under Article 6(1)(f) GDPR, provided your privacy notice mentions it and the data is limited to what the analysis requires.

As soon as tracking runs in the browser to attribute visits and orders to campaigns, it must be blocked until the visitor accepts the marketing or measurement purpose in your consent banner. Respect refusals server side as well: orders from visitors who declined should not be enriched with click identifiers or sent for user level attribution.

Data transfers to India

The Flable API runs on Microsoft Azure in the South India region, and the operator is an Indian company. India has no adequacy decision from the European Commission, so transferring EU customers'' data requires appropriate safeguards under Chapter V GDPR, in practice the standard contractual clauses of Decision 2021/914, together with a transfer impact assessment as required by the Schrems II judgment.

Flable''s privacy policy refers to adequacy decisions or standard contractual clauses for transfers outside the EEA, but the wording is generic. Ask for signed clauses, the list of subprocessors and their locations, and check whether data pipeline providers such as Fivetran introduce additional transfers, for example to the United States under the EU US Data Privacy Framework.

Practical compliance steps

Sign a data processing agreement with Keinsa Pvt Ltd including the standard contractual clauses, and record a transfer impact assessment. Limit the Shopify and CRM scopes you grant to what the profit analysis needs, prefer aggregated or pseudonymised exports where possible, and check the retention period and the deletion process described on Flable''s data deletion page.

If any tracking is installed on your store, list its cookies or storage keys in your cookie policy, classify them as marketing or measurement and block them until consent in your consent management platform. Update your privacy notice to name Flable, the purpose of profitability analysis and attribution, and the transfer of data to India.