Definitions
“Customer Personal Information” means personal information contained in the tools you connect to Fluxion and handled by Fluxion in providing the service. “Applicable Privacy Law” means the United States federal and state privacy laws that apply to that information, each as amended.
Terms such as “business”, “service provider”, “personal information”, “sell” and “share” have the meanings given to them in Applicable Privacy Law.
This Addendum forms part of, and is subject to, the Terms of Service between the parties. In the event of conflict on the subject of data handling, this Addendum controls.
Roles of the parties
You decide what is connected. We use it to run the service for you, and to improve Fluxion.
Summary only - the clause below is what bindsIn providing the service to you - reading the tools you connect, computing figures, and producing briefs, insights, reports and answers - Fluxion handles Customer Personal Information on your behalf and at your direction. Connecting a tool, asking a question and configuring your workspace are each a direction to do so.
Fluxion also uses Customer Personal Information for its own purpose of developing, testing and improving the service and the models behind it, including by training models, and retains it for that purpose as described in section 8. You authorise that use and confirm you are entitled to.
Fluxion does not sell Customer Personal Information, does not share it for cross-context behavioural advertising, and does not combine it with information from other sources to build profiles of individuals for third parties.
Account data and usage data are handled by Fluxion on its own behalf, as described in the Privacy Policy.
Scope and nature of processing
| Item | Detail |
|---|---|
| Subject matter | Provision and improvement of the Fluxion service |
| Duration | For the life of the workspace, and afterwards as set out in section 8 |
| Nature | Reading, storing, computing, generating written explanations, and model development |
| Purpose | Producing figures, briefs, insights, reports and answers for the customer; improving the service |
| Whose information | The customer's staff, customers, vendors, contacts and correspondents |
| Kinds of information | Names, business contact details, transaction and invoice records, deal records, email messages, calendar events |
| Sensitive information | None requested or required. Email and transaction records may contain whatever their authors put in them. |
Fluxion holds read-only access to connected tools and cannot write to them. The service does not make automated decisions that produce legal or similarly significant effects on individuals; it reports to you, and you decide.
Service providers we use
A short, published list. We tell you before it changes.
Summary only - the clause below is what bindsYou authorise Fluxion to use the service providers listed below to help deliver the service. Each receives only what it needs to do its job, and Fluxion remains responsible for their handling of Customer Personal Information.
| Provider | Purpose |
|---|---|
| Supabase | Database hosting and storage |
| OpenAI | Written explanations and search over records |
| Plaid | Bank and card connections |
| Sign-in with Google | |
| Cloudinary | Storage of uploaded images |
| Email delivery provider | Account email and notices |
Fluxion will update this list before adding or replacing a provider that handles Customer Personal Information. If you object on reasonable privacy grounds, write to privacy@fluxion.co; if we cannot accommodate the objection, you may stop using the service.
Security measures
Fluxion implements and maintains reasonable technical and organisational measures to protect Customer Personal Information, including at minimum:
- Encryption of data in transit using TLS.
- Encryption of the credentials for connected tools with AES-256-GCM before storage.
- Read-only access to connected tools, with no ability to write to them.
- Separation of each workspace's data from every other workspace's.
- Role-based access inside a workspace, with the owner controlling which screens each role can open.
- Staff access limited to those who need it, and logged.
- Passwords stored only as a salted hash; sessions that can be revoked on every device at once.
- Rate limiting and activity records to detect and investigate abuse.
Measures may be updated over time provided the overall level of security is not reduced.
Requests from individuals
If someone exercises their privacy rights against you, we help you answer them.
Summary only - the clause below is what bindsTaking into account the nature of the service, Fluxion will give you reasonable assistance in responding to a request from an individual to exercise rights under Applicable Privacy Law in respect of Customer Personal Information, including a request to delete it where the law requires deletion.
Where an individual contacts Fluxion directly about Customer Personal Information, Fluxion will direct them to you, and will act on the request where the law requires Fluxion itself to.
Breach notification
Fluxion will notify you without undue delay after becoming aware of a breach of security leading to unauthorised access to, or disclosure of, Customer Personal Information.
The notification will describe what is known about the nature of the breach, the kinds of information and individuals affected, the measures taken or proposed, and a contact point for further information. Where the full detail is not available at once, it will follow as it becomes known.
Retention after you leave
Disconnecting or deleting ends access. What was already read is kept.
Summary only - the clause below is what bindsDisconnecting a tool withdraws Fluxion's access to it immediately. Records already read from it remain in the workspace.
Deleting a workspace closes it after a 7-day period in which it can be restored. Once closed, it can no longer be opened by any member. Fluxion retains the data it holds, without a fixed end date, and uses it for the purpose described in section 2. The service does not provide an export or return of that data; it remains available to you in the tools it came from.
Retained data stays subject to the security measures in section 5 and the restrictions in section 2. Where Applicable Privacy Law requires particular information to be deleted, Fluxion will delete it on a verified request sent to privacy@fluxion.co.
Information and assessments
On reasonable written request, and subject to confidentiality, Fluxion will provide the information reasonably necessary to show that it is meeting this Addendum, including written answers to a security questionnaire.
A request may be made no more than once in any twelve-month period, on at least 30 days' written notice, and must not disrupt Fluxion's operations or compromise the confidentiality of other customers' data. Each party bears its own costs.
Where data is processed
Customer Personal Information is stored and processed by Fluxion and by the service providers in section 4, in the United States and in the other countries where they run their infrastructure. The primary database is currently hosted in Japan. The service is offered to businesses in the United States and is not intended for information subject to the data-protection laws of other countries.
If you connect a tool holding personal information about people outside the United States, you are responsible for ensuring you are permitted to do so.
Contact and execution
To execute a countersigned copy of this Addendum, write to legal@fluxion.co with your legal entity name, registered address and signatory details.
Privacy questions can be sent to privacy@fluxion.co. Security matters, including reporting a vulnerability, should be directed to security@fluxion.co.