Privacy Policy

This Privacy Notice for Flotorq ("we," "us," or "our"), describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:

• Visit our website at flotorq.app or any website of ours that links to this Privacy Notice
• Engage with us in other related ways, including any marketing or events

Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have any questions or concerns, please contact us at dreamforgeyman@gmail.com.

1. What Information Do We Collect?

Personal Information You Provide Directly

In Short: We collect personal information that you voluntarily provide to us.

We collect personal information that you voluntarily provide when you register on the Services, express an interest in obtaining information about us or our products, participate in activities on the Services, or otherwise contact us.

Personal Information Provided by You. The personal information we collect depends on the context of your interactions with us and the Services, the choices you make, and the features you use. The personal information we collect may include the following:

• Names and email addresses
• Usernames and passwords
• Profile information (profile photo if added)
• Contact preferences
• Habits you choose to track, including names, schedules, and completion data
• Tasks, projects, deadlines, and priorities you enter
• Journal entries, mood logs, and any notes or reflections you write
• Expense amounts, categories, descriptions, and budgets
• Calendar events and scheduling information
• Goals, savings targets, and financial information you voluntarily input
• Voice input if you use the voice command feature

Payment Data. We may collect data necessary to process your payment if you choose to make purchases, such as your payment instrument number and the security code associated with your payment instrument. All payment data is handled and stored by DodoPayments. We never see or store your full card number.

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Google or GitHub account. If you choose to register in this way, we will collect certain profile information about you from the social media provider, as described in the section "How Do We Handle Your Social Logins?" below.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes.

Information Collected Automatically

In Short: Some information — such as your IP address and browser/device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity but may include device and usage information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. The information we collect includes:

• Log and Usage Data: Service-related, diagnostic, usage, and performance information our servers automatically collect, including your IP address, device information, browser type and settings, pages and files viewed, date/time stamps, feature usage, searches, and error reports (crash dumps)
• Device Data: Information about your computer, phone, tablet, or other device, including IP address (or proxy server), device and application identification numbers, browser type, hardware model, operating system, Internet service provider, and system configuration information
• Location Data: Information about your device's location, which can be either precise or imprecise based on your IP address. You can opt out of allowing us to collect this information by disabling your Location setting on your device
• Cookies and similar tracking technologies (see our Cookie Policy)

Information From Third Parties

Flotorq uses third-party services to function. These services may collect additional information governed by their own privacy policies:

• Clerk (Authentication): When you sign in, Clerk processes your authentication credentials, email address, and authentication tokens. If you use social login, Clerk provides us with your name, email, and profile picture from the social media provider. Clerk's privacy policy
• Supabase (Database): Your application data is stored in Supabase-hosted PostgreSQL databases. Supabase processes your data as a data processor on our behalf. Supabase's privacy policy
• DodoPayments (Payments): If you subscribe to Flotorq Pro, DodoPayments processes your payment information. DodoPayments's privacy policy
• Vercel (Hosting): Our web application is hosted on Vercel's infrastructure. Vercel processes request data and logs. Vercel's privacy policy
• Third-Party AI Models (Anthropic): When you explicitly trigger AI-powered features, your relevant user data—including raw Journal entries, Tasks, and Goals—may be transmitted to third-party AI providers (such as Anthropic) for processing. We only send the data strictly necessary to fulfill your specific AI request. Your data is not used by these providers to train their underlying foundational models. Anthropic's privacy policy
• Upstash (Redis/Queue): We use Upstash for background job processing. Minimal data passes through this service. Upstash's privacy policy

2. How Do We Process Your Information?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

To provide the service:

• Facilitate account creation and authentication and manage user accounts
• Store and retrieve your habits, tasks, journal entries, notes, mood logs, and expenses
• Generate your dashboard, statistics, streaks, and progress data
• Send you scheduled reminders and notifications you've configured
• Process your subscription payments

To improve the service:

• Understand which features are used and which aren't
• Identify bugs and errors
• Improve performance and reliability
• Develop new features based on usage patterns

To communicate with you:

• Send transactional emails (account confirmation, password reset, payment receipts)
• Send your weekly AI digest email if you've enabled it
• Respond to your support requests
• Notify you of significant changes to the service or these policies

To generate AI insights:

When you use AI commands or request AI analysis, your data is processed by third-party AI APIs to generate the response. This processing uses the data you've entered into Flotorq.

For security and fraud prevention:

We may process your information to protect our Services, prevent fraudulent activity, and enforce our Terms of Service.

To save or protect an individual's vital interest:

We may process your information when necessary to save or protect an individual's vital interest, such as to prevent harm.

3. What Legal Bases Do We Rely On to Process Your Information?

In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason to do so under applicable law.

If you are located in the EU or UK:

The General Data Protection Regulation (GDPR) and UK GDPR require us to explain the valid legal bases we rely on. We may rely on the following:

• Consent: We may process your information if you have given us permission to use your personal information for a specific purpose. You can withdraw your consent at any time by contacting us.
• Contract performance: Processing your data to provide the Flotorq service you've signed up for — this is necessary to fulfill our contractual obligations to you.
• Legitimate interests: Improving the service, preventing fraud, ensuring security, analyzing usage patterns. We balance these interests against your rights.
• Legal obligations: Where we believe processing is necessary for compliance with our legal obligations, such as cooperating with law enforcement or exercising/defending our legal rights.
• Vital interests: Where we believe processing is necessary to protect your vital interests or those of a third party, such as situations involving potential threats to safety.

You have rights under GDPR including: the right to access, correct, delete, port your data, restrict or object to processing, and withdraw consent. To exercise these rights, contact us at dreamforgeyman@gmail.com. We will respond within 30 days.

If you are located in the UK and are unhappy with how we have handled your personal information, you can make a complaint directly to us or to the Information Commissioner's Office (ICO).

If you are located in the EEA, you have the right to complain to your Member State data protection authority.

If you are located in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

If you are located in Canada:

We may process your information if you have given us specific permission (express consent) or in situations where your permission can be inferred (implied consent). You can withdraw your consent at any time.

In some exceptional cases, we may be legally permitted under applicable law to process your information without your consent, including:

• If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
• For investigations and fraud detection and prevention
• For business transactions provided certain conditions are met
• If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court
• If the information is publicly available and is specified by the regulations

4. When and With Whom Do We Share Your Personal Information?

In Short: We may share information in specific situations described in this section and/or with specific third parties necessary to operate the Service.

We share your personal information only with the following categories of third-party service providers, each for a specific operational purpose:

Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

We have not disclosed, sold, or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. We will not sell or share personal information in the future belonging to website visitors, users, and other consumers.

5. Do We Use Cookies and Other Tracking Technologies?

In Short: We may use cookies and other tracking technologies to collect and store your information.

We may use cookies and similar tracking technologies (like web beacons and pixels) to gather information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions.

Specific information about how we use such technologies and how you can refuse certain cookies is set out in our Cookie Policy.

We do not use Google Analytics or third-party advertising cookies. We do not run ads and do not work with advertising networks.

6. Do We Offer Artificial Intelligence-Based Products?

In Short: We offer products, features, and tools powered by artificial intelligence, machine learning, or similar technologies.

As part of our Services, we offer products, features, and tools powered by artificial intelligence, machine learning, or similar technologies (collectively, "AI Products"). These tools are designed to enhance your experience and provide you with intelligent insights across your habits, tasks, mood, and productivity data.

Use of AI Technologies

We provide the AI Products through third-party service providers ("AI Service Providers"), including Anthropic and Groq. Your input, output, and relevant personal information will be shared with and processed by these AI Service Providers to enable your use of our AI Products. You must not use the AI Products in any way that violates the terms or policies of any AI Service Provider.

Our AI Products include:

• Natural language commands for managing habits, tasks, and expenses
• AI-generated weekly digest emails summarizing your productivity
• Intelligent insights and pattern recognition across your data
• AI-powered journaling prompts

How We Process Your Data Using AI

All personal information processed using our AI Products is handled in line with this Privacy Notice and our agreements with third-party providers. We send the minimum necessary data to AI APIs. We do not send raw journal entries or identified financial transaction details to AI services without first processing them into aggregate, non-identifying summaries.

7. How Do We Handle Your Social Logins?

In Short: If you choose to register or log in using a social media account, we may have access to certain information about you.

Our Services offer you the ability to register and log in using your third-party social media account details (like your Google or GitHub account). Where you choose to do this, we will receive certain profile information about you from your social media provider. The profile information we receive may vary depending on the provider, but will often include your name, email address, and profile picture, as well as other information you choose to make public.

We will use the information we receive only for the purposes described in this Privacy Notice. We do not control, and are not responsible for, other uses of your personal information by your third-party social media provider. We recommend reviewing their privacy notice to understand how they handle your data.

8. How Long Do We Keep Your Information?

In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.

We will only keep your personal information for as long as it is necessary for the purposes set out in this Privacy Notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). No purpose in this notice will require us keeping your personal information for longer than the period in which you have an account with us.

If you delete your account, we will delete your personal data within 30 days, except:

• Where we are required by law to retain it longer
• Anonymized aggregate data (which cannot identify you) may be retained indefinitely for analytics
• Backup copies may persist for up to 90 days before being purged

We retain payment records for 7 years as required by applicable financial regulations.

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because it has been stored in backup archives), then we will securely store it and isolate it from any further processing until deletion is possible.

9. How Do We Keep Your Information Safe?

In Short: We aim to protect your personal information through appropriate organizational and technical security measures.

We implement security measures appropriate to an early-stage application, including:

• HTTPS encryption for all data in transit
• Database encryption at rest via Supabase's security infrastructure
• Authentication tokens managed by Clerk
• No storage of payment card details (handled entirely by DodoPayments)
• Access controls limiting who can access the production database

If we discover a data breach that affects you, we will notify you by email as soon as reasonably practicable — and within 72 hours for EU/EEA users where required. For full details, see our Security Policy.

10. What Are Your Privacy Rights?

In Short: Depending on your state of residence in the US or in regions such as the EEA, UK, Switzerland, and Canada, you have rights that allow you greater access to and control over your personal information.

In some regions, you have certain rights under applicable data protection laws. These may include the right:

• To request access and obtain a copy of your personal information
• To request rectification or erasure
• To restrict the processing of your personal information
• If applicable, to data portability
• Not to be subject to automated decision-making
• To object to the processing of your personal information

You can make such a request by contacting us at dreamforgeyman@gmail.com. We will consider and act upon any request in accordance with applicable data protection laws.

Withdrawing your consent: If we are relying on your consent to process your personal information, you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of the processing before its withdrawal, nor will it affect processing conducted on lawful grounds other than consent.

Account Information

If you would at any time like to review or change the information in your account or terminate your account, you can:

• Log in to your account settings and update your user account

Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information as described in Section 8.

If you have questions or comments about your privacy rights, email us at dreamforgeyman@gmail.com.

11. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems include a Do-Not-Track ("DNT") feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.

12. Do United States Residents Have Specific Privacy Rights?

In Short: If you are a resident of certain US states, you may have additional rights regarding your personal information.

Categories of Personal Information We Collect

The following table shows the categories of personal information we have collected in the past twelve (12) months:

We will use and retain the collected personal information as long as the user has an account with us.

Your Rights Under US State Laws

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have specific rights including:

• Right to know whether we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to obtain a copy of your data
• Right to non-discrimination for exercising your rights
• Right to opt out of targeted advertising, the sale of personal data, or profiling

How to Exercise Your Rights

To exercise these rights, contact us by emailing dreamforgeyman@gmail.com. Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf.

Request Verification

Upon receiving your request, we will need to verify your identity. We will only use personal information provided in your request to verify your identity or authority to make the request.

Appeals

Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at dreamforgeyman@gmail.com. We will inform you in writing of any action taken or not taken in response to the appeal. If your appeal is denied, you may submit a complaint to your state attorney general.

California "Shine The Light" Law

California Civil Code Section 1798.83 permits California residents to request information about categories of personal information disclosed to third parties for direct marketing. We have not disclosed any personal information to third parties for direct marketing purposes. If you are a California resident and would like to make such a request, contact us at dreamforgeyman@gmail.com.

13. International Data Transfers

Flotorq is operated from India. Our infrastructure providers (Vercel, Supabase, Clerk, DodoPayments, Anthropic, Groq, Upstash) may store and process your data in countries other than your country of residence, including the United States. By using Flotorq, you consent to the transfer of your information to these jurisdictions, which may have different data protection laws.

For EU/EEA users: We rely on the data processing agreements and standard contractual clauses of our third-party providers for data transfers.

14. Children's Privacy

Flotorq is not intended for use by children under the age of 13 (or 16 in the EU). We do not knowingly collect personal information from children under these ages. If you are a parent or guardian and believe your child has provided us with personal information, contact us and we will delete it.

15. Do We Make Updates to This Notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated "Last Updated" date at the top. If we make material changes, we may notify you either by prominently posting a notice or by sending you a notification directly. We encourage you to review this Privacy Notice frequently.

16. How Can You Contact Us About This Notice?

If you have questions or comments about this notice, you may email us at dreamforgeyman@gmail.com or contact us by post at:

17. How Can You Review, Update, or Delete the Data We Collect From You?

Based on the applicable laws of your country or state of residence, you may have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law.

To request to review, update, or delete your personal information, please contact us at dreamforgeyman@gmail.com.