Privacy Policy

1. Who we are

Fluxary ("we", "us", or "our") is a SaaS platform that helps solo founders automate their social media content. Our service is operated by Fluxary and is accessible at fluxary.app. For any privacy-related questions, contact us at [email protected].

2. Information we collect

2.1 Information you provide directly

• Account data: email address, name, and password (or OAuth token if you sign in with Google).
• Brand data: website URLs, brand descriptions, product information, and content preferences you configure in your brand kit.
• Payment data: billing information is handled entirely by Stripe — we never see or store your card number.

2.2 Information collected automatically

• Usage data: pages visited, features used, and actions taken within the app (e.g., content generation, approvals).
• Device & log data: IP address, browser type, operating system, and timestamps.
• Cookies and analytics: essential authentication and preference cookies. We also use Google Analytics 4 with Consent Mode v2 — analytics cookies are denied by default and only set if you accept via our cookie banner. We do not run advertising or cross-site tracking cookies.

2.3 Information from third parties

• If you use Google OAuth, we receive your name and email from Google.
• If you connect a LinkedIn account, we receive your LinkedIn member ID (sub), display name, email, and profile picture URL via the OpenID Connect /v2/userinfo endpoint. See Section 12 for retention and caching rules.
• If you connect a Facebook or Instagram account, we receive your Facebook Page ID + name, linked Instagram Business account ID + username, and a long-lived Page access token. See Section 12.
• When you enter a website URL for brand analysis, our scraper fetches publicly available content from that URL.

3. How we use your information

• To provide, maintain, and improve the Fluxary service.
• To generate branded content based on your brand kit configuration.
• To send transactional emails (account confirmations, invoices, alerts).
• To communicate product updates and feature announcements (you can opt out at any time).
• To prevent fraud, abuse, and ensure platform security.
• To comply with legal obligations.

We do not use your data to train AI models, nor do we sell, rent, or share your personal data with third parties for marketing purposes.

4. Legal basis for processing (GDPR)

• Contract: processing necessary to provide the service you signed up for.
• Legitimate interests: security, fraud prevention, and service improvement.
• Consent: marketing communications (you can withdraw at any time).
• Legal obligation: where required by applicable law.

5. Data sharing and subprocessors

We share data only with trusted subprocessors necessary to operate the service:

• Supabase — authentication and database hosting.
• Railway — backend API infrastructure.
• Stripe — payment processing.
• OpenAI / Anthropic — AI content generation (only brand-related prompts are sent; no personal user data).
• Vercel — frontend hosting and CDN.
• Resend — transactional and marketing email delivery.
• LinkedIn, Meta (Facebook / Instagram) — only when you explicitly connect those accounts, so we can publish on your behalf and read engagement metrics for posts we created.

All subprocessors are contractually required to protect your data and comply with applicable privacy laws.

6. Data retention

We retain your account data for as long as your account is active. Generated content and brand data are retained until you delete them or close your account. Log data is retained for up to 90 days. After account deletion, all personal data is permanently deleted within 30 days.

7. International transfers

Our infrastructure is primarily based in the United States and EU. If you are located in the EU/EEA, data transfers to the US are covered by Standard Contractual Clauses (SCCs) or adequacy decisions as applicable.

8. Your rights

Depending on your location, you may have the following rights:

• Access: request a copy of the data we hold about you.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data ("right to be forgotten").
• Portability: receive your data in a machine-readable format.
• Restriction: limit how we process your data.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: for any consent-based processing.

To exercise any of these rights, email us at [email protected]. We will respond within 30 days. See our GDPR page for more details.

9. Cookies and analytics

We use two categories of cookies:

• Strictly necessary: authentication, session and preference cookies required to operate the service. These cannot be disabled.
• Analytics (optional): Google Analytics 4 to understand which pages and features are used. Loaded under Google Consent Mode v2 with analytics_storage set to denied by default — Google receives only "cookieless pings" until you accept via the cookie banner shown on first visit. You can change your choice at any time by clearing the consent.v1 entry in your browser storage.

We do not run advertising, cross-site tracking, or profiling cookies. You can also manage cookies through your browser settings.

10. Security

We implement industry-standard security measures including TLS encryption in transit, encrypted storage at rest, and access controls. However, no system is 100% secure — please use a strong, unique password and enable any available 2FA options.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or an in-app notice at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.

12. Connected social accounts (LinkedIn, Facebook, Instagram)

When you connect a social account, you authorize Fluxary to publish on your behalf and to read engagement metrics for content we created. This section explains exactly what we receive, how long we keep it, and how we honor each platform's API terms.

12.1 LinkedIn

We use LinkedIn's Sign In with LinkedIn using OpenID Connect and Share on LinkedIn products. With your authorization (scopes: openid, profile, email, w_member_social) we receive:

• Stable member identifier (sub) — persisted so we can attach published posts to the correct account.
• Profile data — display name, email, profile picture URL.
• Access token — stored encrypted at rest (AES-256-GCM) and used only to publish posts you have approved and to fetch engagement metrics for those posts.

Retention windows (LinkedIn API Terms):

• Member profile data is cached for no more than 24 hours. After 24 hours, the cached copy is refreshed from LinkedIn or discarded.
• Social action / activity data (likes, comments, share counts) is cached for no more than 48 hours. After 48 hours, the cached copy is refreshed from LinkedIn or discarded.
• Stable identifiers (sub, post URNs) are not subject to these limits and are kept while your account is connected.
• When you disconnect or revoke the integration, we delete the access token immediately and purge cached profile and activity data.

12.2 Meta (Facebook & Instagram)

If you connect Facebook or Instagram, we receive a Page access token and the Page / IG Business account ID and name. We use it solely to publish posts you have approved and to read insights (impressions, likes, comments, follower counts) for those posts. Tokens are stored encrypted at rest. When you disconnect, the token is revoked and removed.

12.3 Engagement metrics history

To show you growth charts over time, we store aggregated daily snapshots of follower / fan counts (not the raw social actions feed). These snapshots contain only numeric counts and a timestamp — no personal data of the platform's members. You can delete this history at any time by disconnecting the account or deleting your Fluxary account.

12.4 What we never do

• We never sell, rent, or share data received from LinkedIn, Facebook, or Instagram with third parties.
• We never use member data from these platforms to train AI models.
• We never publish or fetch data without your prior authorization in-app.

13. Contact

Questions or concerns about this policy? Contact us at [email protected] or visit our Contact page. You also have the right to lodge a complaint with your local data protection authority.