Privacy Policy

This policy explains how Floxa Ltd ("Floxa", "we", "us") collects, uses and protects personal data when you visit floxa.co.uk or use the Floxa service. Floxa is registered in England and Wales under company number 16971343, with its registered office at Office 439, Unit 5, 399-405 Oxford Street, Mayfair, London, England, W1C 2BU. For the purposes of UK data protection law, Floxa is the controller of the personal data described in this policy.

Contact us about anything in this policy at support@floxa.co.uk.

1. Two kinds of data — our role differs

Floxa is a business management service. It holds two distinct kinds of personal data, and our legal role is different for each:

• Your account and billing data — data about you as a Floxa user (registration details, subscription records, and so on). For this data Floxa is the controller, and this policy describes how we handle it.
• Customer Data — the records your business stores in Floxa about its own staff, clients, suppliers and jobs. For this data your business is the controller and Floxa is a processor, acting on your instructions under our Data Processing Agreement. If you are a member of staff or a client of a business that uses Floxa and you have questions about data held about you, please contact that business — we will redirect any request we receive to them.

2. The personal data we collect

• Account data — your name, email address, password (stored as a secure hash, never in plain text) and optional profile photo. If you sign in with Google, we receive your name, email address and profile photo from your Google account instead of a password.
• Organisation data — the business details you give us when setting up your organisation, such as its name, logo and settings.
• Billing data — your subscription plan, billing history and payment status. Payments are processed by Stripe; we never see or store your full card number.
• Usage and security data — sign-in events, session records and technical logs (such as IP addresses and browser type) generated when you use the service, used to keep accounts secure and the service running.
• Correspondence — messages you send us, for example support requests.
• Referral data — if you sign up using a partner's referral code or link, the code used, your email address, when you signed up and the commission or discount that applies. If you are a referral partner, your name, email address and payout details (payouts are handled by Stripe).
• Website analytics data — if you allow analytics cookies, information about how you use our public website (pages viewed, how you arrived, approximate location derived from your IP address, and device and browser type), collected through Google Analytics. This is not collected inside the signed-in Floxa app.
• Newsletter subscribers — if you sign up for product emails on our website without being a customer, your email address and a record of the consent you gave.
• The Floxa mobile app — the app works with the same account and data as the website. On top of that:
  • Camera and photos: only when you choose to take or attach a photo (a receipt or a job photo). The app uses your phone's own photo picker, so it only ever sees the photos you pick, never your whole library.
  • Face ID, Touch ID and fingerprint: if you turn on App Lock, your phone checks your face or fingerprint itself. Floxa never receives or stores biometric data.
  • On your phone: your sign-in session is kept in the phone's secure storage and removed when you sign out. Jobs, invoices and other data you open are held in memory while the app is open rather than saved to the phone. Photos you take sit in the app's private cache, which the phone clears as it needs space. Android backups are switched off for the app.
  • App updates: the app checks for updates with our provider Expo, which receives your IP address, the app version and a random installation ID that isn't linked to your account or device hardware.
  • The app has no adverts, no advertising ID, no analytics or tracking tools, and doesn't access your location or contacts.

3. How we use it, and our lawful bases

Product emails. We may occasionally email you about new Floxa features, tips and free resources, and short feedback polls. If you subscribed on our website we rely on your consent, confirmed by clicking the link we email you. If you are a customer we rely on the "soft opt-in" under PECR: we told you about these emails when you set up your account and gave you the chance to refuse. Either way, every message includes a working unsubscribe link, you can change what you receive under Settings → Notifications, and we keep a record of when and how you subscribed or opted out. Service emails about your account are not affected by these choices.

We do not use your personal data for automated decision-making that produces legal or similarly significant effects, and we never sell personal data.

4. Cookies

Floxa sets strictly necessary cookies — the session and security cookies our authentication system needs to keep you signed in and protect your account (including a two-factor verification cookie and, if you choose to trust a device, a cookie that remembers it for 30 days), a cookie that remembers whether the app sidebar is open, and a cookie that remembers your cookie preference itself. Because these are essential to provide the service you have asked for, UK law (PECR) does not require consent for them.

With your permission only, we may also set these optional cookies:

• Partner referrals (floxa_ref, 30 days) — if you arrive through a referral partner's link, remembers the partner's code so they are credited and any discount they offer is applied when you sign up. If you enter a referral code yourself on the sign-up form, we also use this cookie to carry it through sign-in with Google.
• Analytics (_ga and _ga_8J9ZY3Q2DE, up to 2 years) — Google Analytics cookies that distinguish visitors and sessions so we can see how our public website is used, such as which pages are visited and how people find us. Analytics runs only on our public website, not inside the signed-in Floxa app. We have turned off Google Signals and ad personalisation, and we do not use this data to advertise to you. If you withdraw consent, Google Analytics stops and we remove these cookies.

On your first visit you will be asked to accept, reject, or choose which optional cookies to allow. You can change your mind at any time using the "Cookie preferences" link in the footer, which reopens the same choices. Optional cookies are not set until you allow them.

We do not use advertising cookies, and the emails we send contain no tracking pixels or rewritten tracking links.

5. Who we share personal data with

• Service providers (sub-processors) — the companies that host and power Floxa, listed with locations and purposes at floxa.co.uk/legal/subprocessors. Each is bound by a written data protection agreement.
• Stripe — for payments, acting as an independent controller for payment processing, fraud prevention and its own regulatory compliance.
• Google — if you choose to sign in with Google, acting as an independent controller for your Google account; and, if you allow analytics cookies, Google Analytics, which processes website usage data on our behalf. See how Google uses information from sites that use its services.
• Expo (650 Industries, Inc., United States) — if you use the mobile app, Expo delivers app updates and receives your IP address, the app version and a random installation ID when the app checks for one. It receives no account details or business data.
• Referral partners — if you signed up through a partner's referral, we may tell that partner that a referral converted and the commission due. We do not share your Floxa account contents with them.
• Professional advisers and authorities — where necessary for legal, accounting or insurance purposes, or where the law requires disclosure.
• A buyer or successor — if Floxa is involved in a merger, acquisition or asset sale, in which case we will notify you before your personal data becomes subject to a different privacy policy.

6. Where data is stored and international transfers

Floxa's data is stored in the United Kingdom and the European Union — our database runs in London, uploaded files are held under EU jurisdiction, and email is sent from the EU. Where a service provider processes personal data outside the UK or EEA (for example in the United States), the transfer is protected by a lawful transfer mechanism — the UK Extension to the EU–US Data Privacy Framework and/or Standard Contractual Clauses with the UK International Data Transfer Addendum — as described on our sub-processor page.

7. How we protect it

All connections to Floxa are encrypted in transit with TLS, and data is encrypted at rest. Particularly sensitive fields (such as saved bank details) are additionally encrypted at the application layer with AES-256-GCM, with the key held separately from the database. Every organisation's data is isolated by enforced database row-level security in addition to application-level checks, uploaded files are served only through authenticated, organisation-scoped access — never public links — and our isolation and encryption controls are verified by an automated security test suite. The full set of measures is described in Annex 2 of our Data Processing Agreement.

8. How long we keep it

• Account and organisation data — for as long as your account is active, then deleted from our production systems within 90 days of closure.
• Billing and transaction records — kept for six years after the end of the relevant financial year, as UK tax law requires.
• Backups — encrypted backups expire on a fixed rotation of no more than 35 days; deleted data leaves backups as that rotation completes.
• Correspondence and security logs — for as long as reasonably necessary for support, security and evidencing compliance, then deleted.
• Referral and commission records — kept for six years after the end of the financial year in which commission was paid, as they form part of our accounting records. This applies even if the referred account is closed.
• Website analytics data — kept in Google Analytics for no more than 14 months, then deleted automatically. Analytics cookies expire after up to 2 years, or straight away if you withdraw consent.
• Product email preferences — if you unsubscribe, we keep your email address and a record of the opt-out so that we do not email you again.

9. Your rights

Under UK data protection law you have the right to:

• Access — request a copy of the personal data we hold about you;
• Rectification — have inaccurate data corrected (you can edit most account details directly in settings);
• Erasure — ask us to delete your personal data;
• Restriction and objection — limit or object to certain processing, including any processing based on legitimate interests;
• Portability — receive the data you provided to us in a structured, commonly used, machine-readable format.

Deleting your account. Sign in and go to Settings → Security → Delete your account on the website, or More → Account & security → Delete my account in the Floxa app. If you can't sign in, email support@floxa.co.uk from the email address on your account. Either way you'll get an email confirming the request, its reference and the date it will be completed by. The full steps, and what we delete and keep, are on floxa.co.uk/legal/account-deletion.

To exercise any of the other rights, including an export of your data, email support@floxa.co.uk from the email address on your account. We will respond within one month, as the law requires, and action account deletion within 30 days of verifying the request. Note that where your request concerns Customer Data controlled by a business that uses Floxa (section 1), we will pass your request to that business rather than acting on it ourselves, and that we must retain billing records required by tax law even after an account is deleted.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or 0303 123 1113 — though we would appreciate the chance to resolve your concern first.

10. Children

Floxa is a business tool and is not intended for, or directed at, children. Our Terms of Service require users to be at least 18, and we do not knowingly collect personal data from anyone under 18; if you believe we have, contact us and we will delete it.

11. Changes to this policy

When we make material changes to this policy we will notify account owners by email and update the date at the top of this page. The current version is always published at floxa.co.uk/legal/privacy.