Privacy Policy

This policy explains what Flocuity LLC (“Flocuity”, “we”) collects when you use flocuity.com and the Flocuity application, what we do with it, and the choices you have. The short version: we collect what the forecast needs, we use it to run the product for you, we do not sell it, and you can delete it.

1. What we collect

Information you give us

• Account details: your name, email address and password. The password is stored only as a salted hash by our authentication provider. If you sign in with Google, we receive your name and email address from Google.
• Business details: the name of your business or household, its industry, legal form, state, time zone, and your answers to the setup questions.
• Financial information: bank transactions and balances that you upload or connect, bills, invoices, recurring items, tax settings, assumptions and scenarios.
• Staffing information: if you use the Staffing Model, the names or titles, pay, schedules and dates you enter for the people on your team. You are responsible for having the right to give us that information.
• Messages: what you send us by email, or through the forms on our Custom plan and AI Automation pages.

Information from services you connect

• Your bank, through Plaid. When you connect a bank account, Plaid Inc. collects your bank credentials and sends us account names, the last digits of account numbers, balances and up to 24 months of transactions. We never receive your bank username or password. Their handling of your information is covered by the Plaid End User Privacy Policy.
• Your accounting software. When you connect QuickBooks Online or Xero, we read your open invoices and bills, and when past ones were paid: names, customers or vendors, amounts and dates. We also read the bank accounts and transactions in your books, with their categories. We never write anything back.
• Square. When you connect Square, we read your business name, your open Square invoices (customers, amounts and due dates) and Square’s deposits to your bank (amounts and dates). When you ask for it in the Staffing Model, we also read your team members’ names, job titles, pay and timecards, and keep only what you choose to apply. We never write anything back.
• Your Stripe account. When you connect Stripe, by installing Flocuity’s app in your Stripe account, we read your business name and how Stripe pays you out, your balance and payouts (amounts and dates), your open Stripe invoices (customers, amounts and due dates) and your subscriptions (amounts and how often they bill, kept only as a monthly total). We never receive your customers’ card details, and we never write anything back.
• Stripe. When you subscribe, Stripe collects your card details. We receive your plan and its status, never your card number.

Information collected automatically

• Log data: IP address, browser type, pages requested and times, kept by our hosting provider to run and protect the service.
• Activity records: a log of important actions in your business (who changed what, and when), which you can see in the app.
• The check that you are a person: when you sign up, sign in, reset a password or write to us through the Custom plan or AI Automation form, Cloudflare Turnstile checks that a person is filling the form in. It sees your IP address and browser details; we receive only whether the check passed.

2. How we use it

• To build and show your forecast, alerts and reports.
• To run your account: sign-in, invitations, billing, and service emails such as receipts and password resets.
• To support you when you write to us.
• To keep the service secure, prevent abuse and fix problems.
• To meet legal obligations.

We do not sell your personal information. We do not share it for advertising. We do not use your financial data to train artificial intelligence models.

3. Who we share it with

We share information only with the companies that help us run Flocuity, under contracts that limit what they may do with it:

• Supabase (database, file storage and sign-in) and Vercel (hosting, and the page-view counts described in section 4).
• Stripe (payments, and Stripe connections).
• Resend (sending email).
• Cloudflare (Turnstile, the check on our sign-in, sign-up and contact forms that you are a person; it sees your IP address and browser details).
• Plaid (bank connections).
• Intuit (QuickBooks connections).
• Xero (Xero connections).
• Square (Square connections).
• Google, only if you choose to sign in with Google.

We may also disclose information if the law requires it, to protect the rights and safety of our customers or ourselves, or as part of a merger or sale of the business. After a merger or sale, this policy still applies to your information.

Other members of your business can see its data according to the role an owner gives them. Staffing pay is visible only to the members an owner chooses.

4. Cookies

We use a small number of cookies, all of them needed for the product to work. We use no advertising cookies, and no analytics that identify you or follow you to other sites.

• Sign-in cookies keep you signed in. They are HttpOnly and sent over HTTPS only.
• Preference cookies remember which business you last opened, whether the sidebar is folded, how you last set up the Dashboard and your reports, the plan you picked before signing up, and, in the demo, which view you chose.
• Stripe sets its own cookies on its checkout and billing pages to prevent fraud.

Because these cookies are strictly necessary, there is no cookie banner. You can block cookies in your browser, but you will not be able to sign in.

We do count page views, through Vercel Web Analytics. It sets no cookies and stores no identifier for you: each view records the page, and coarse details like country, browser and the site you arrived from. It is how we learn which pages are worth keeping. Page addresses that carry anything private (an invitation link, a file id, a sign-in link) are trimmed or dropped in your browser before anything is sent, and we never send your email address, your name or any of your financial data.

5. How long we keep it

• Uploaded bank files are deleted automatically 30 days after upload (14 days for an account that never started a plan). The transactions read from them stay in your forecast.
• Your business’s data is kept while your account is open. An owner can delete the business, and everything in it, at any time from Settings.
• After a plan ends, we keep the data for 90 days so you can come back to it, then delete it permanently. Before that happens we email the owners four times, the last time the day before. Starting a plan again at any point stops the deletion.
• A business that never starts a plan is kept for six months after it is set up. After that the same 90 days and the same four emails apply, and starting a plan at any point stops the deletion.
• Backups and logs are cleared on their own schedule, within a few weeks of deletion. Billing records are kept as long as tax law requires.

6. Security

Data is encrypted in transit and at rest, each business is separated from every other at the database level, connection tokens are sealed with AES-256-GCM, and bank and accounting access is read-only. The details are on our Security page. No system is perfectly secure; if we learn of a breach that affects you, we will tell you promptly, as the law requires.

7. Your choices and rights

• See and correct your information in the app at any time.
• Export your forecast and reports to a spreadsheet.
• Delete your business from Settings, and your own login from your account page once you belong to no business.
• Disconnect a bank or accounting connection at any time.
• Email preferences: switch the Monday email and the alert emails on or off for yourself in Settings, under Notifications. Service emails (receipts, invitations, security notices, and the reminders before data is deleted) cannot be switched off while you have an account.

Depending on where you live (California, for example, or another state with a privacy law), you may have the right to know what we hold about you, to have it corrected or deleted, and not to be treated differently for asking. To make a request, write to privacy@flocuity.com. We will confirm it is you before acting and answer within the time the law sets.

8. Businesses and their teams

When a business uses Flocuity, that business decides what goes into it, including information about its customers, vendors and employees. For that information we act on the business’s behalf as its service provider. If you are an employee or customer of a business that uses Flocuity, please contact that business first. A data processing agreement is available on request at privacy@flocuity.com.

9. Children

Flocuity is for adults running a business or a household. It is not directed to anyone under 18, and we do not knowingly collect their information.

10. Where your data is processed

Flocuity is operated from the United States and is offered to customers in the United States. If you use it from elsewhere, your information is processed in the United States.

11. Changes to this policy

If we make a change that matters, we will tell you by email or in the app at least 30 days before it takes effect. The date at the top shows when this version took effect.

12. Contact

Flocuity LLC
68 Harrison Ave Ste 605 #839657 Boston, MA 02111
privacy@flocuity.com