Fluence Inc. Privacy Policy

Effective Date: July 1, 2025

1. Overview
   Fluence Inc. respects your privacy. This Policy explains how we collect, use, disclose, and safeguard your information when you use the Fluence Service or visit our website.

2. Information We Collect
   
   

   • Account Information: Name, email, profile image (from Google OAuth, email/password, or other SSO providers)

   • Payment Information: Card details (via Stripe; Fluence stores tokenized references only)

   • Usage Data: Log files, IP address, device/browser info, pages viewed (automatically collected)

   • Cookies & Analytics: Google Analytics, Posthog (see Cookie Notice)

   We do not collect content that users upload (the Service currently has no upload feature) and do not knowingly collect data from children under 16.

3. How We Use Information
   
   

   • Provide, operate, and maintain the Service

   • Process subscription payments

   • Send transactional emails, product updates, and newsletters (you may opt out of marketing emails at any time)

   • Monitor usage, detect fraud, and improve the Service

   • Comply with legal obligations

4. Lawful Bases for Processing (GDPR)
   Contractual necessity (to provide the Service); Legitimate interests (product improvement, fraud prevention); Consent (marketing emails, non‑essential cookies); Legal obligation (tax, accounting, compliance).

5. Sharing and Disclosure
   We share personal data only with:

   • Service Providers: Supabase (hosting & auth), Vercel (hosting), Stripe (payments), Google Analytics & Posthog (analytics)

   • Law enforcement or regulators when required by law

   • Successors: in connection with a merger, acquisition, or asset sale

   We do not sell or "share" personal data for crosscontext behavioral advertising (as defined by the CCPA).

6. Cookies and Tracking Technologies
   We use cookies and similar technologies for analytics and to remember user preferences. EU/UK visitors will see a cookie‑consent banner that allows acceptance or rejection of non‑essential cookies.

7. International Data Transfers
   Personal data is stored and processed in the United States. For EU/EEA/UK residents, transfers rely on Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum.

8. Data Retention
   We retain personal data for the duration of your account and 90days thereafter, unless a longer period is required by law. Backups may persist for up to 30additional days.

9. Security
   Fluence employs a defense‑in‑depth approach and leverages Supabase's managed Postgres platform for core data storage and authentication. Key measures include:

   • Encryption: All traffic is encrypted in transit via TLS 1.2+ and data is encrypted at rest with AES‑256 on Supabase‑hosted disks.

   • Row‑Level Security (RLS): PostgreSQL RLS ensures every query is automatically scoped to the authenticated user's JSON Web Token, preventing cross‑tenant data access.

   • Least‑Privilege & RBAC: Fluence staff access is governed by role‑based permissions; Supabase project roles (Owner, Admin, Read‑only, etc.) further restrict administrative actions.

   • Backups & Recovery: Supabase performs automated daily snapshots and supports Point‑in‑Time Recovery (PITR) for up to 35 days, enabling restoration to any second within that window. Fluence's disaster‑recovery objective (RTO) is 48 hours.

   • Monitoring & Logging: Continuous infrastructure monitoring, log aggregation, and alerting help detect anomalies in real time.

   • Independent Assurance: Supabase undergoes an annual SOC 2 Type II audit; Fluence reviews the attestation summary and addresses any relevant findings.

   • Penetration Testing: Fluence commissions annual third‑party penetration tests of its application layer.

   • Data Breach Notification: We will notify affected users within 24hours of confirmation of any breach of Personal Data, describing the nature of the breach, likely consequences, and remedial actions.

10. Your Rights
    Depending on your location, you may have rights to access, correct, delete, or port your data, object to processing, or withdraw consent. To exercise any right, email privacy@getfluence.app.

11. Children's Privacy
    The Service is not directed to children under 16. We do not knowingly collect personal data from anyone under 16.

12. Changes to This Policy
    We may update this Policy from time to time. Material changes will be announced via email or inapp notice. Continued use of the Service after an update constitutes acceptance.

13. Contact Us
    Fluence Inc.
    3809 N Cuade St, Eagle Mountain, UT 84005, USA
    Email: joshua@getfluence.app
    Phone: (480) 234‑8306