Privacy Policy

Last updated: October 2, 2026

At Floxar, Inc., a Delaware corporation ("Floxar", "we", "us", or "our"), we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.

Who Is Responsible for Your Information

Floxar, Inc. is the controller of the personal information described in this policy that it collects for its own purposes: account and sign-in information, billing information, communications with Floxar, information collected on Floxar's websites, and information about how the Service is used. When an organization uses Floxar, the content it and its users put into the Service — flows, bits, trails, references, recorded values, files and AI conversations — is processed by Floxar on that organization's behalf, under Floxar's Data Processing Addendum. For that content, the organization is the controller: requests about it should be made to the organization, and Floxar will refer requests it receives to the organization.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, and password when you create an account
• Profile Information: Organization name, job title, and other optional details
• Content: Flows, bits, trails, and other content you create within the platform
• Communications: Information you provide when you contact us for support

1.2 Information Collected Automatically

When you use our Service, we automatically collect certain information:

• Usage Data: Pages visited, features used, actions taken within the platform
• Device Information: Browser type, operating system, device type
• Log Data: IP address, access times, referring URLs

1.3 Cookies and Similar Technologies

We use essential cookies required for authentication and security. We do not use tracking or advertising cookies. For details, see Section 6 below.

1.4 Sign In With Google

If you choose to sign in with Google, Google shares your name, email address, whether that email address is verified, and your Google account ID with us. We use this information only to sign you in and to link you to your Floxar account. We do not use it for advertising, we do not sell it, and we share it only with our authentication provider, Amazon Web Services (see Section 3.2). We do not access any other data in your Google account.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke Floxar's access to your Google account at any time at myaccount.google.com/permissions.

2. How We Use Your Information

We use the information we collect to:

• Provide, maintain, develop, and improve the Service, including its AI features
• Process transactions and manage your account
• Send you technical notices and support messages
• Respond to your comments, questions, and requests
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent or unauthorized activity
• Comply with legal obligations

3. Information Sharing

We do not sell your personal information. We may share your information in the following circumstances:

3.1 With Your Consent

We may share information when you direct us to do so or give us explicit consent.

3.2 Service Providers

We share information with third-party service providers ("sub-processors") who process it on our behalf, such as our cloud infrastructure provider (Amazon Web Services, including Amazon Cognito for authentication and Amazon SES for email) and our AI model provider (Anthropic). The current list, with what each provider processes and where, is maintained on our Sub-processors page.

When you use an AI feature, only the content needed to handle that request (for example your question and the relevant flows, bits, or references) is sent to our AI model provider, and the response is returned to the Service.

If you or your organization connect your own AI client or agent to Floxar, for example over the Model Context Protocol, the information that client retrieves is shared at your direction (see Section 3.1) and is handled by that client's provider under your agreement with them.

3.3 Legal Requirements

We may disclose information if required by law or in response to valid legal requests.

3.4 Business Transfers

If Floxar is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4. Data Retention

We retain your information for as long as your account is active or as needed to provide you services. We may also retain and use your information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

Upon account deletion request, we will delete or anonymize your personal data within 30 days, except where retention is required by law.

5. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/SSL) and at rest
• Regular security assessments and updates
• Access controls and authentication requirements
• Secure cloud infrastructure with industry-standard protections

While we strive to protect your information, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6. Cookies

We use only essential cookies that are strictly necessary for the Service to function:

Cookie Type	Purpose	Duration
Authentication	Keep you signed in securely	Session / 7 days
Security	Prevent cross-site request forgery	Session
Preferences	Remember your cookie consent choice	1 year

We do not use analytics, advertising, or third-party tracking cookies.

7. Your Rights

Depending on your location, you may have certain rights regarding your personal information:

7.1 Access and Portability

You can request a copy of your personal data in a commonly used format.

7.2 Correction

You can update or correct your account information through your profile settings.

7.3 Deletion

You can request deletion of your account and personal data by contacting us.

7.4 Objection and Restriction

You may object to certain processing of your data or request that we restrict processing in certain circumstances.

To exercise any of these rights, please contact us at privacy@floxar.com.

8. International Data Transfers

Floxar is based in the United States, and information is processed there. Where personal information is transferred from the European Economic Area, the United Kingdom or Switzerland, Floxar relies on the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents, as incorporated in its Data Processing Addendum, or on another lawful transfer mechanism.

9. Children's Privacy

The Service is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn we have collected such information, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Where a change is material, we will also notify account administrators by email or in the Service before it takes effect. We will post the updated policy on this page and update the "Last updated" date. Your continued use of the Service after such changes constitutes your acceptance of the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us:

Floxar, Inc.
Email: privacy@floxar.com

12. Additional Information for EU/EEA Users

If you are located in the European Union or European Economic Area:

• Legal Basis: We process your data based on: (a) your consent, (b) performance of our contract with you, (c) our legitimate business interests, or (d) compliance with legal obligations.
• Data Controller: Floxar, Inc. is the controller for the information it collects for its own purposes, as described at the start of this policy. For content an organization puts into the Service, the organization is the controller and Floxar its processor.
• Supervisory Authority: You have the right to lodge a complaint with your local data protection authority.