Privacy Policy

Before the detail, here is what we commit to:

• We do not sell your data. We have never sold personal data, and we will not.
• Your data is scoped to your account. It is not shared with or visible to other accounts unless you explicitly choose to share it.
• You control visibility. Only you decide whether other users can see your data. We will never expose it without your consent.
• No AI training. Your data will never be used to train, fine-tune, or feed any artificial intelligence or machine learning model.

---

We collect and store the following categories of data:

We do not collect data beyond what is necessary to provide and improve the service.

---

Under the UK GDPR and EU GDPR (Article 6), we process your data on the following legal bases:

• Performance of a contract (Article 6(1)(b)): To provide the Florality service to you, including storing your content, managing your account, and processing payments.
• Consent (Article 6(1)(a)): For opt-in analytics (PostHog). You can withdraw consent at any time.
• Legitimate interests (Article 6(1)(f)): For security monitoring, fraud prevention, and improving product features using aggregated and anonymised data. We balance these interests against your rights and freedoms.
• Legal obligation (Article 6(1)(c)): To comply with tax, accounting, and law enforcement requirements.

---

Florality is a personal organisation tool. It is not a medical, therapeutic, or diagnostic platform. We do not diagnose, treat, or make health assessments of any kind.

We do not classify data stored in Florality as health data. You self-describe your experiences, and we store what you provide.

However, we recognise that some users may consider their data to be sensitive or personal in nature. By creating an account and providing data to Florality, you explicitly consent to the processing of any data you provide, including data that may be considered:

• Special category data under GDPR Article 9 (such as data concerning health or data revealing racial or ethnic origin)
• Sensitive personal information under the California Consumer Privacy Act (CCPA)
• Equivalent classifications under other applicable data protection laws

The legal basis for this processing is GDPR Article 9(2)(a) — explicit consent of the data subject.

You may withdraw this consent at any time by closing your account. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

---

We do not use automated decision-making or profiling as defined by GDPR Article 22. No decisions with legal or similarly significant effects on you are made solely by automated means.

---

We use the following third-party sub-processors to operate Florality. Each processes data only as necessary for their stated purpose, and each is bound by data processing agreements.

We will update this list if we add or change sub-processors. Material changes will be communicated as described in Section 23.

---

We do not share, sell, rent, or trade your personal data with third parties for their own purposes.

---

We use your data for the following purposes:

• Provide and operate the service: Store, display, back up, migrate, and process your content so the application functions as intended.
• Improve the product: Analyse aggregated and anonymised usage patterns to fix bugs, improve features, and enhance performance. Individual data is never used for this purpose without anonymisation.
• Comply with legal obligations: Respond to lawful requests from authorities, maintain tax and accounting records.
• Communicate with you: Send service notifications, security alerts, and updates about changes to the service or these policies.
• Ensure security: Detect and prevent fraud, abuse, and unauthorised access.

Reserved rights: We reserve the right to create aggregated, anonymised, and statistical datasets derived from usage data that cannot identify any individual user. Such datasets may be used for internal benchmarking, research, and reporting.

---

We use PostHog for product analytics. Analytics are off by default. You must explicitly opt in via Settings > Data & Privacy before any analytics data is collected.

When analytics are enabled:

• Your user ID is hashed before transmission — PostHog never receives your real identifier.
• Personally identifiable information (PII) is scrubbed before any event is sent.
• IP capture is disabled — your IP address is not recorded by PostHog.
• Session recordings, where used, apply masking to exclude sensitive on-screen content.
• No data is shared with third parties for advertising or marketing purposes.

You can opt out at any time via Settings > Data & Privacy. Opting out immediately stops all future analytics capture.

Marketing pages: Our public marketing pages (such as the homepage and pricing page) may use anonymous, cookieless analytics that do not identify individual users and do not rely on the opt-in preference.

---

Your data will never be used to train, fine-tune, or feed any artificial intelligence or machine learning model. This applies to all data categories listed in Section 2.

Your data is used exclusively to operate the Florality application — storing it, displaying it, and providing the features you use.

If we ever introduce AI-powered features in the future, they will require explicit opt-in consent and will be described in an updated version of this policy before any data is processed for that purpose. (This is just a legal disclaimer, we have no plans to do this.)

---

Your data is primarily hosted in the United Kingdom by Halvex, which also operates infrastructure in the United States.

Some of our sub-processors are located outside the UK:

• United Kingdom / United States: Halvex (hosting, database, object storage)
• United States: Clerk (authentication), Stripe (payments), Resend (email)
• EU / United States: PostHog (analytics, opt-in only)

Where data is transferred outside the UK or EEA, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner's Office (ICO)
• Adequacy decisions where applicable
• Other equivalent safeguards recognised under applicable data protection law

You may request further information about the safeguards in place by contacting [email protected].

---

• Active accounts: Your data is retained for as long as your account remains active.
• Closed accounts: Upon account closure, your data will be deleted within 30 days, except where we are required by law to retain certain records (such as billing and tax records, which may be retained for up to 7 years).
• Configurable retention: You may configure retention settings for certain data (such as front history) within your account settings. Data beyond your configured retention period will be automatically removed.
• Backups: Data may persist in encrypted backups for a limited period after deletion from primary systems. Backups are cycled and overwritten on a regular schedule.

---

You have the following rights regarding your personal data:

Response times: We will respond to requests within 30 days (as required by the GDPR and UK GDPR) or 45 days (as required by the CCPA), depending on your jurisdiction. If we need additional time, we will inform you and explain why.

To exercise any of these rights, email [email protected] or use the relevant controls in your account settings.

---

United Kingdom (UK GDPR)

• Florality Ltd is the data controller.
• You have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk.
• For data protection enquiries, contact [email protected].

European Economic Area (EU GDPR)

• All rights under Articles 15–22 of the EU GDPR apply.
• You have the right to lodge a complaint with your local supervisory authority.
• International transfers are protected by Standard Contractual Clauses (see Section 11).

California, United States (CCPA / CPRA)

• Right to know: You may request the categories and specific pieces of personal information we have collected.
• Right to delete: You may request deletion of your personal information.
• Right to opt out of sale: We do not sell personal information. We never have.
• Right to non-discrimination: We will not discriminate against you for exercising your privacy rights.
• Sensitive personal information: See Section 4.

Other United States State Laws

We comply with applicable state privacy laws, including the Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and similar legislation.

Japan (Act on the Protection of Personal Information — APPI)

• We disclose cross-border transfer destinations (see Section 11).
• Your data may be transferred to the United States and the European Union for the purposes described in this policy.

Australia (Privacy Act 1988)

• We comply with the Australian Privacy Principles (APPs).
• You have the right to access and correct your personal information.
• You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC): oaic.gov.au.

Canada (Personal Information Protection and Electronic Documents Act — PIPEDA)

• We process your data with your knowledge and consent.
• You have the right to access, correct, and challenge the accuracy of your personal information.
• You may lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC): priv.gc.ca.

---

Florality is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected data from a child under 13, we will delete it promptly.

The age of digital consent varies by jurisdiction:

• United Kingdom and United States: 13
• European Union: Varies by member state (13 to 16)

Users below the age of digital consent in their jurisdiction must have verifiable parental or guardian consent to use Florality.

---

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at rest: Data stored in our databases and object storage is encrypted at rest.
• Access controls: Multi-factor authentication (MFA) is required for all developer and administrative access to production databases.
• Audit logging: Administrative actions and access to production systems are logged and monitored.
• Regular reviews: We conduct regular security reviews of our infrastructure and codebase.

No system is perfectly secure. If you believe your account has been compromised, contact [email protected] immediately.

---

In the event of a personal data breach:

• We will notify the relevant supervisory authority (the ICO for UK users) within 72 hours of becoming aware of the breach, as required by GDPR Article 33.
• Where the breach is likely to result in a high risk to your rights and freedoms, we will notify affected users without undue delay, as required by GDPR Article 34.
• Notifications will include: the nature of the breach, the categories of data affected, the measures taken or proposed to address the breach, and a contact point for further information.

---

Florality allows you to import data from third-party services, including Simply Plural, PluralKit, and Octocon.

• You are responsible for ensuring you have the right to import that data into Florality.
• Once imported, data is treated identically to data you create directly within Florality and is subject to all provisions of this Privacy Policy.
• We do not access, verify, or validate data at its source. Import records (metadata such as timestamps and mapping IDs) are stored to support import integrity.

---

Florality uses a minimal number of cookies:

• Essential cookies: Required for authentication and session management (provided by Clerk). These cannot be disabled without breaking core functionality.
• Analytics cookies: Set by PostHog only if you have opted in to analytics via Settings > Data & Privacy. These are not set by default.
• No advertising cookies: We do not use any third-party advertising or tracking cookies.

We do not use cookie consent banners for essential cookies, as they are strictly necessary for the service to function. PostHog cookies are only set after you explicitly opt in.

---

We honour Do Not Track (DNT) browser signals. Because our analytics are opt-in by default, DNT signals are respected regardless — analytics data is only collected if you have explicitly opted in.

We do not engage in behavioural advertising, cross-site tracking, or any form of ad-based profiling.

---

• Transactional emails: We send essential service communications (account alerts, security notifications, service changes) via Resend. You cannot opt out of these, as they are necessary for the operation and security of your account.
• Marketing and promotional emails: We will only send marketing emails if you have explicitly opted in. Every marketing email includes an unsubscribe link. You can opt out at any time.
• No third-party sharing: We do not share your email address with third parties for their marketing purposes.

---

Florality may contain links to third-party websites or services. We are not responsible for the privacy practices, content, or security of those third-party sites. We encourage you to read their privacy policies before providing them with any personal data.

---

We may update this Privacy Policy from time to time. When we make changes:

• We will notify you via in-app notification, email, our changelog, and our social media channels.
• For material changes, we will provide at least 30 days' notice before the changes take effect.
• The updated effective date will be displayed at the top of this page.

Your continued use of Florality after the effective date of any changes constitutes acceptance of the updated policy. If you do not agree with the changes, you may close your account.

---

If you have any questions about this Privacy Policy, your personal data, or wish to exercise any of your rights, please contact us:

• Email: [email protected]
• Entity: Florality Ltd, registered in England and Wales

---