Introduction
We read the tools you connect to tell you where your company stands. We never write to them and never sell your data. We do keep it, and we use it to improve Fluxion.
Summary only - the clause below is what bindsFluxion, Inc. (“Fluxion”, “we”, “us”) provides a service that connects to the business tools you authorise, computes figures from them in code, and explains those figures in plain language. This policy describes what information we handle in providing that service, why, how long we keep it, and the choices you have.
This policy applies to the Fluxion website and the Fluxion application. The service is offered to businesses in the United States. It does not apply to the third-party tools you connect to Fluxion, which remain governed by their own privacy policies.
Where you have a separate written agreement with Fluxion that conflicts with this policy, that agreement controls to the extent of the conflict.
Information we collect
Four things: who you are, what your connected tools say, how you use the product, and what you write to us.
Summary only - the clause below is what bindsWe collect information in the categories below.
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email address, password (stored only as a hash), profile photo, company name and description, time zone | You, at sign-up and in settings |
| Connected data | Bank and card transactions and balances, payments and invoices, accounting records, deals and contacts, emails, calendar events | Tools you authorise |
| Usage data | Questions you ask, reports you create, screens you open, sign-in times, device and browser type, IP address | Automatically, in product |
| Correspondence | Messages you send us and their contents | You, when you contact us |
Account data
When you create an account we collect your name, your email address and a password, or your basic profile from Google if you sign in with Google. When you create a workspace we collect the company's name, a short description, its time zone and the start of its financial year. Your email address identifies your account and cannot be changed.
Payment details are handled by the payment provider named at checkout. Fluxion does not store card numbers.
Connected-tool data
When you connect a tool, Fluxion reads records from it and stores a copy in order to compute your figures, write your brief and answer your questions. Access is read-only. What is read depends on the tool:
- Bank and cards (through Plaid) - accounts, balances and transactions.
- Payments (Stripe) - charges, refunds, payouts, subscriptions, invoices and customers.
- Accounting (QuickBooks) - invoices, bills, payments, purchases, customers and vendors.
- CRM (HubSpot) - companies, contacts, deals, pipeline stages and close dates.
- Email (Gmail, Outlook) - messages in the connected mailbox, including sender, recipients, subject, time and the body of the message.
- Calendar (Google Calendar, Outlook Calendar) - event times, durations, titles and attendees.
Connected data often includes information about other people - your customers, vendors, colleagues and correspondents. You are responsible for having the right to connect each tool and to let Fluxion read what is in it.
Usage data
We record how the product is used so that we can operate, secure and improve it: the questions you ask and the answers given, the reports you create, which screens are opened, and which errors occur. Sign-ins and changes to a workspace are recorded with the time, the device and the IP address.
How we use information
To run the product for you, keep it secure, bill you - and to make Fluxion better, including the models behind it.
Summary only - the clause below is what bindsWe use the information described above for the following purposes:
- To provide the service - computing your figures, writing your briefs, insights and reports, and answering the questions you ask.
- To secure the service - detecting abuse, investigating incidents, and keeping activity records.
- To support you - responding to your requests and diagnosing faults you report.
- To bill you - administering plans, invoices and taxes.
- To improve Fluxion - developing, testing and improving the service and the models behind it, including by training models on data held in workspaces. This includes connected data and usage data, and it continues after a workspace or account is closed (see section 7).
- To comply with law - meeting our legal, accounting and regulatory obligations.
We do not sell personal information, and we do not share it with anyone for advertising. Figures and wording produced for your workspace are shown only to members of your workspace.
How connected data is accessed
Read-only. Fluxion cannot move money, send mail or change a record in any tool you connect.
Summary only - the clause below is what bindsConnected tools are accessed through the provider's official API using access you grant and can withdraw at any time. Fluxion requests read access only: it cannot move money, send mail from your mailbox, create records or modify anything in a connected tool.
Every figure the product shows you is computed in code from records that can be traced back to the tool they came from. A language model is used to put figures that have already been calculated into words; it does not calculate them and cannot alter them.
If you choose to email one of your own customers from inside the product, the message is written by you and sent through your own sending account, which you connect for that purpose. Fluxion does not send email to your customers on its own.
Storage and security
Encrypted in transit, credentials encrypted at rest, each workspace kept separate, staff access limited and logged.
Summary only - the clause below is what bindsData moving between you, Fluxion and your connected tools is encrypted in transit using TLS. The credentials that let Fluxion read a connected tool are encrypted with AES-256-GCM before they are stored. Passwords are stored only as a salted hash.
Each workspace's data is kept separate from every other workspace's, and a member sees only the workspaces they belong to and the screens their role allows. Access by Fluxion staff is limited to those who need it to run and support the service, and is logged.
No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you without undue delay and as applicable law requires.
Sharing and service providers
A short list of vendors that help us run the service. No data brokers, no advertising networks.
Summary only - the clause below is what bindsWe share information only with the service providers that help us operate Fluxion, and only as far as each needs to do its job:
| Provider | What it does for us |
|---|---|
| Supabase | Hosts the database in which workspace data is stored |
| OpenAI | Turns computed figures into written explanations and makes records searchable; receives the relevant figures, records and questions to do so |
| Plaid | Connects bank and card accounts, when you choose to connect one |
| Sign-in with Google, when you choose to use it | |
| Cloudinary | Stores images you upload, such as a profile photo or company logo |
| Email delivery provider | Sends account email - verification, invitations, password resets and notices |
We may also disclose information where the law requires it, to enforce our agreements, or in connection with a merger, acquisition or sale of assets - in which case the information remains subject to this policy unless you are told otherwise.
We do not share personal information with advertising networks or data brokers.
Data retention
Disconnecting or deleting ends access. It does not erase what was already read - we keep it.
Summary only - the clause below is what binds| When you | What happens |
|---|---|
| Disconnect a tool | Fluxion's access to that tool ends at once. Records already read from it stay in the workspace. |
| Delete a workspace | Members have 7 days to change their mind. After that the workspace is closed, no one can open it, and its data is retained by Fluxion. |
| Delete your account | You have 7 days to change your mind. After that you can no longer sign in, your sign-in methods and sessions are removed, and your personal connections are disconnected. Workspaces you own are deleted with it, as above. Data in workspaces is retained. |
| Let a plan lapse | The workspace stays, but its screens are unavailable until a plan is chosen. Nothing is removed. |
We keep workspace data after a workspace or account is closed, without a fixed end date, and use it for the purposes in section 3 - in particular to improve the service and train the models behind it. Billing records are kept as tax and accounting law requires.
If you do not want data retained in this way, do not connect the tool that holds it. Where the law of your state gives you a right to have personal information deleted, see section 8.
Your choices and rights
You control what is connected and who is in your workspace. For anything else, write to us.
Summary only - the clause below is what bindsInside the product you can, at any time:
- Correct your name, photo and company details.
- Disconnect any tool, which ends Fluxion's access to it immediately.
- Add or remove members and decide which screens each role can open.
- Sign out of every device, change your password, and delete your account or workspace.
The product does not offer an export of workspace data, and the service is not a way to obtain a copy of the data held in your connected tools - that data remains available to you in the tools themselves.
Depending on the state you live in, you may have legal rights to know what personal information we hold about you, to have it corrected, or to have it deleted. To make a request, write to privacy@fluxion.co. We will respond within the time the law allows and will honour any request the law requires us to. We will not treat you differently for making one.
Cookies and local storage
Only what is needed to keep you signed in and remember your preferences. No advertising trackers.
Summary only - the clause below is what bindsWe use a cookie that is strictly necessary to keep you signed in, and we use your browser's local storage to remember preferences such as light or dark theme, the workspace you last used and how you left the sidebar.
We do not use advertising cookies, third-party tracking pixels or third-party analytics on the website or in the application.
Where data is processed
The service is for businesses in the United States. Some of the infrastructure behind it is elsewhere.
Summary only - the clause below is what bindsFluxion is operated from, and offered to businesses in, the United States. Information is stored and processed by us and by the service providers in section 6, in the United States and in the other countries where they run their infrastructure. The primary database is currently hosted in Japan.
The service is not directed at people or businesses outside the United States. If you connect a tool that holds information about people elsewhere, you are responsible for having the right to do so.
Children's data
Fluxion is a business product and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact privacy@fluxion.co.
Changes to this policy
We may update this policy as the product and the law change. The “last updated” date at the top of this document always reflects the current version. Where a change is material, we will tell you by email or in the product before it takes effect.
Contact us
For questions about this policy or about how your information is handled, write to privacy@fluxion.co. For security matters, including reporting a vulnerability, write to security@fluxion.co.