Privacy Policy

Overview

Fluxora (“we,” “us”) provides a hosted, multi-tenant enterprise resource planning (“ERP”) platform for distributors and businesses. This Privacy Policy describes how we collect, use, disclose, and protect information when you use our websites, applications, APIs, authentication flows (including email magic links and optional Google sign-in), billing (via Stripe), and support tools.

Fluxora operates as a data processor for much of your business content (for example orders and customer records uploaded by your organization), depending on how you configure integrations. Where we determine purposes and means — for example billing and product analytics — we act as a controller as described below.

Data we collect

• Account and authentication information. When you register or sign in, we collect identifiers such as your email address, name (first and/or last), optional profile image metadata from federated login, and identifiers associated with sessions and security events.
• Tenant (workspace) content.You and authorized users submit data tied to a workspace, such as organization details, contacts, customer records, products, inventory, suppliers, pricing, quotes, orders, invoices, shipments, payments, attachments, audit events, collaboration features, internal notes where offered, support tickets including message content you provide, and other operational ERP data (“Tenant Data”).
• Usage, diagnostic, and log data. We automatically collect technical data when you interact with our service, including timestamps, approximate location derived from IP when needed for fraud prevention or security, HTTP requests, referrer, device type, browser, app version identifiers, structured error telemetry, latency metrics where applicable, authentication events (sign-in successes and failures at a high level), and similar operational logs maintained to keep the platform reliable and secure.
• Billing data. When you subscribe to paid offerings, Stripe (or successor payment processor) collects and processes billing details such as billing contact email, plan selection, invoicing identifiers, subscription status updates, partial card metadata (for example brand and expiry as processed by Stripe), payment success or failure statuses, and tax-related identifiers you provide checkout-side. We retain references and history needed to reconcile access to your billing account.
• Communications. If you correspond with sales or contact support via email forms or in-product tickets, we process the contents of messages and identifiers you include.

How we use data

• Provide and operate the service. For example provisioning tenants, authenticating sessions, syncing data your users enter, powering search and reporting where available, enforcing role-based permissions, invoicing entitlement, running background jobs, integrations (when enabled), exporting data at your direction where supported, backups, and maintaining availability.
• Improve reliability and product direction. We may use aggregated, de-identified, or summarized usage patterns — for example funnel completion rates — to understand feature adoption without needing to disclose customer-specific transaction narratives.
• Billing and account administration. Managing subscriptions through Stripe, sending transactional notices about invoicing failures, seat changes subject to configuration, reminders about trial status, receipts when applicable, responding to lawful account-holder requests, enforcing policies, enforcing anti-abuse safeguards, enforcing fair use safeguards.
• Communications relevant to security and lawful operations. Administrative messages about outages, breaches when required under law, substantive changes that affect your rights, confirmations of opt-out requests processed.
• Legal compliance.When required — to honor subpoenas, enforce our agreements, protect Fluxora’s legitimate interests subject to overriding law, cooperate with lawful requests narrowly tailored.

Sharing and subprocessors

We do not sell personal information and we do not share Tenant Data for third-party marketing lists. Sharing is limited:

• Stripe: we route payments through Stripe for subscription checkout, invoicing integrations (where activated), webhook-driven subscription state reconciliation, dunning retries where Stripe supports them depending on gateway configuration configured by you/the cardholder appropriately.
• Email delivery: we send transactional and product email (including magic-link authentication invitations, subscription lifecycle notices, onboarding guidance, invitations to join organizations, alerts about security-critical events involving your credential) via an email sending provider compatible with transactional delivery such as Resend or an equivalent transactional ESP we operate under materially similar privacy commitments.
• Hosting and observability vendors: our cloud infrastructure vendors (for example managed PostgreSQL, object storage, secret management where applicable), optionally application performance monitoring tooling, CDN or edge providers, log retention, intrusion detection — notwithstanding we aim to segregate tenancy logically.
• Integrated providers you authorize:when you deliberately connect OAuth providers beyond Google SSO or enable integrations, those providers’ terms govern their processing of redirected tokens or API calls we forward per your administrators’ selections.
• Authorities when required; mergers or acquisitions subject to safeguards.
• Vendors assisting support: if we allow some support communications to route through ticketers (for example ticketing SaaS) — only minimally necessary excerpts.
• Anonymized or aggregated benchmarking material if we publish industry metrics — we will not knowingly include Customer Confidential Information that could identify a specific customer without contractual permission unless already public factual matter.

Retention

We retain Tenant Data according to administrators’ instructions where technically feasible — for example honoring deletion workflows on objects if supported — or until you delete an account or disconnect a tenant when permissible. Operational logs retention windows vary based on security needs (typically between days and twelve months rolling). Billing records retained for as long as needed to meet tax, accounting, and audit obligations. Support tickets may be archived for follow-up quality for a bounded period then purged or anonymized.

When you delete an account, we may retain minimal records to prevent re-registration abuse, prove compliance, or resolve disputes for a limited period consistent with law.

Security

We implement administrative, technical, and organizational measures designed to protect against unauthorized access, alteration, disclosure, or destruction appropriate to the risk of the processing — TLS in transit for web traffic, least-privilege access for employees, secrets rotation, encryption at rest for certain provider-managed stores as applicable, tenant-scoped database row controls in application logic, monitoring and alerting, vulnerability response processes. No online service is perfectly secure; you should keep credentials secret, enable multi-factor authentication when we offer it, and promptly notify us of suspected compromise.

Your choices and rights

Depending on where you live, privacy laws may grant rights such as access, correction, deletion, portability, objection to certain processing, restriction, or withdrawal of consent for non-essential cookies or marketing (we send very little marketing by default for B2B ERP). To exercise rights, email us (see Contact). We will verify requests consistent with law and may need your workspace owner to coordinate for Tenant Data we process as a processor.

You may opt out of non-essential communications (we limit promotional email for B2B contexts); we will always send essential transactional or security notifications required to operate your account.

International transfers

If you access Fluxora from outside the geography where servers primarily reside (for example US regions hosted by Neon or similar Postgres providers depending on deployment), transfers may occur under appropriate safeguards described in DPAs as applicable once executed for enterprise customers.

Children

Fluxora is a B2B product not directed to minors under sixteen; we do not knowingly collect data from children. Contact us if you believe a minor submitted data so we may delete promptly.

Changes to this policy

We may update this Privacy Policy periodically. Material changes will be signaled through our product interface, banner, changelog, or email to account owners when appropriate. Continuing to use Fluxora thereafter constitutes acknowledgement of meaningful updates absent mandatory opt-in regimes requiring separate consent — which we honor when mandated.

Contact us

Questions or requests about privacy: