Privacy

An account record: your email address, the display name and profile fields you entered, and your sign-in provider. Everything else is work you brought to the app:

• clients and their contact details;
• invoices, their line items, and the payments recorded against them;
• quotes and proposals, including revisions and client responses;
• projects, milestones and budgets;
• vendor payables and expenses;
• time logs and the rates they were billed at;
• recurring retainer templates and the drafts they generate;
• work chains, which group those records around a client and project;
• share tokens, their expiry dates and their revocation dates;
• an activity log of edits, and the log of emails FluxPay sent for you.

To operate the product: to total your invoices, to generate PDFs, to send the emails you ask FluxPay to send, to enforce access rules, and to keep the service reliable. Your ledger is not used to build an advertising profile, it is not sold, and it is not shared with third parties for their own purposes.

In Firebase services — Firestore for records, Storage for uploaded files such as logos, and Firebase Authentication for sign-in. Records are scoped to your authenticated user ID and the Firestore and Storage rules restrict reads and writes to your own account.

Creating a share link issues a token URL. Anyone who holds that URL can open the invoice it points at, with no account and no sign-in. The payload is sanitised server-side: bank name, IBAN and SWIFT are deliberately excluded, and so are activity logs, before the public view is served.

A link is live while it has a token, has not been revoked, and its expiry has not passed. You set the expiry, including “never expires”, and you can revoke a link at any time; a revoked link stops opening immediately. Anyone with a revoked link’s URL can still see the invoice text if they kept a copy, so treat the URL as the secret.

A payment reported from a public invoice view — a name, an email address, an amount, a method and an optional reference — is written to a pending queue for you to confirm. It is not a payment until you confirm it, and no card details are collected on that page.

You can export invoice and expense data from Settings, delete individual records from the dashboard, and revoke any share link. Those exports are CSV summaries of the invoice and expense ledgers; they are not a full copy of your workspace, so they should not be treated as a backup of everything FluxPay holds.

Settings has a Delete account action: type your account email and confirm a recent sign-in, and the account — with all its data, including records, uploaded logos and PDFs, and your @handle — is scheduled for deletion. During the 30 days before it is permanently deleted your customers can still view and pay open invoices, but public quotes stop accepting responses immediately. During that window you can sign back in and choose ‘Keep my account’ to cancel. Download your invoices first: they are your business records, and you are legally required to keep your own copies. Individual records are still deleted from their own screens, immediately, with no trash, and you can release your @handle from the Handle panel in Settings, which frees it immediately for anyone to claim.

Once the 30-day window closes, the account and its data are permanently deleted. Nothing of the account’s data is kept after the purge, except:

• a record with the account ID and the deletion dates, kept so a deleted account cannot be confused with one that never existed — deleted automatically after 90 days;
• FluxPay’s own billing records, held by its payment provider for as long as tax law requires;
• data under a legal hold, where the law requires it to be kept.

Export your invoices before you delete your account: they are your business records, and you are legally required to keep your own copies.

FluxPay is in public beta. The privacy statement above describes the software as it is built today and will be revised when the paid tiers and the support desk arrive.