Privacy Policy

FluxVantage provides a multi-tenant warehouse management platform. This policy explains what data we handle when you use the service, why we handle it, the legal bases we rely on, and how it is protected. It applies to our website, the application, and the APIs we expose.

For the operational data your organization stores in the platform, we act as a processor (or service provider) acting on your instructions. For the account, billing, and contact data we collect to run the business relationship, and for website usage data, we act as a controller. The legal entity responsible is identified in the Contact section below.

We collect the following categories of data:

• Account data: names, work email addresses, roles, and authentication credentials of your users.
• Operational data: the inventory, orders, shipments, receipts, and related records your organization stores in the platform.
• Usage data: log and telemetry data such as IP address, device and browser metadata, approximate location derived from IP, and the actions taken in the application.
• Billing data: the plan, billing contacts, and payment metadata required to invoice your subscription. Card details are handled by our payment processor and are not stored on our systems.
• Communications data: the content of support requests, emails, and other messages you send us.

We use the data we collect to:

• Provide, secure, and operate the platform for your organization.
• Authenticate users and enforce role-based access and tenant isolation.
• Diagnose issues, monitor performance, and prevent fraud or abuse.
• Communicate with you about your account, support requests, and material changes to the service.
• Meet legal, accounting, and audit obligations.

We do not sell or share personal data, we do not use it for cross-context behavioral advertising, and we do not use your operational data to train machine-learning models for other customers.

Where the EU or UK General Data Protection Regulation applies, we rely on the following legal bases to process personal data:

• Performance of a contract — to provide the platform to your organization and administer your account.
• Legitimate interests — to secure and improve the service, prevent abuse, and communicate about your account, balanced against your rights and freedoms.
• Legal obligation — to meet accounting, tax, and other statutory requirements.
• Consent — where we ask for it, such as certain non-essential cookies or optional communications. You may withdraw consent at any time without affecting prior processing.

We use strictly necessary cookies to keep you signed in, maintain your session, and protect the application. With your consent where it is legally required, we also use limited first-party analytics to understand aggregate usage and improve the service. We do not use third-party advertising cookies.

You can control non-essential cookies through your browser settings or any cookie controls we provide, and we honor recognized opt-out preference signals, such as Global Privacy Control, where the law requires us to.

Your operational data is isolated from other customers at the database layer using PostgreSQL Row-Level Security. Access is scoped to your tenant on every query, and our staff access to customer data is limited, logged, and granted only when required to operate the service or respond to a support request you initiate.

We share data only as needed to run the service: with infrastructure and subprocessor vendors that host and support the platform, with integration providers you choose to connect (for example, a sales channel, carrier, or payment processor), and where required by law or to protect our rights and the safety of others.

Each subprocessor is bound by contractual obligations to protect data consistent with this policy and to process it only on our instructions. A current list of subprocessors is available on request, and we will give notice of material changes so you can object where your agreement allows.

We are based in the United States, and we and our subprocessors may process data in the United States and other countries whose data-protection laws may differ from those where you are located. Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where needed. A copy of the relevant safeguards is available on request.

We retain account and operational data for as long as your subscription is active. After termination, operational data is retained for a wind-down window of up to 30 days so you can export it, then deleted or anonymized within 90 days unless a longer period is required by law. Backups are purged on a rolling cycle. Audit logs are retained on a separate bounded schedule, and billing records are kept for the period required by tax and accounting law.

We protect data with encryption in transit (TLS 1.3) and at rest, least-privilege database roles, authenticated encryption for stored secrets, and SOC 2-aligned operational controls. No system is perfectly secure, but security is designed into the platform rather than added afterward. If we become aware of a breach affecting your personal data, we will notify you without undue delay as required by applicable law. See our Security page for detail.

Depending on where you live, you may have some or all of the following rights over your personal data:

• Access — obtain a copy of the personal data we hold about you.
• Correct — fix inaccurate or incomplete data.
• Delete — request erasure, subject to legal retention requirements.
• Restrict or object — to certain processing, including direct marketing.
• Port — receive your data in a portable, machine-readable format.
• Withdraw consent — where processing is based on consent.

If you are a California resident, you also have the right to know what personal information we collect and how it is used, to request deletion or correction, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we will not discriminate against you for exercising your rights.

Account administrators can manage most user data directly in the application. For other requests, contact privacy@fluxvantage.com — you may use an authorized agent — and we will verify your identity and respond within the time required by applicable law.

If you are in the EEA or the UK and believe we have not handled your data properly, you have the right to lodge a complaint with your local data-protection supervisory authority (in the UK, the Information Commissioner’s Office). We would appreciate the chance to address your concern first.

The platform is a business tool and is not directed to children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy as the service and the law evolve. We will post the updated version here with a new effective date and, for material changes, provide additional notice. Continued use of the service after an update takes effect constitutes acceptance of the revised policy.

FluxVantage is operated by DE-FAZ GROW LLC, a limited liability company organized in New Jersey, United States. That entity is the controller of the account, billing, and contact data described in this policy.

Questions, requests, or complaints about this policy or your data can be sent to privacy@fluxvantage.com, marked to the attention of the Privacy Team. We will respond promptly and route the request to the right team.