✦Legal

Privacy Policy

FlatPurse Flow | Effective Date: June 2026 | Last Updated: August 2026

This Privacy Policy describes how FlatPurse Inc. ("FlatPurse," "we," "us," or "our"), a company incorporated in Alberta, Canada, collects, uses, discloses, and protects personal information in connection with the FlatPurse Flow platform, including our website at flatpurse.com, our web application, mobile applications, APIs, and related services (collectively, the "Service").

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please do not use the Service.

Who This Policy Applies To

FlatPurse Flow is a software-as-a-service platform that helps service businesses (such as salons, barbershops, spas, gyms, and clinics) manage bookings, payments, marketing, and customer relationships. This Policy applies to two distinct categories of users:

Business Users (Customers): Owners, operators, and staff of service businesses that subscribe to the Service. We act as the data controller of your account, billing, and product-usage information.

End Customers: Individuals who book appointments, make purchases, or otherwise interact with a Business User through the Service. We process this information primarily as a data processor on behalf of the Business User, who is the data controller.

Where we act as a processor, the Business User is responsible for ensuring it has a lawful basis to collect end-customer data and for providing end customers with appropriate privacy notices.

Information We Collect

2.1 Information You Provide Directly

Account information: name, business name, email address, phone number, password, role, and profile photo.
Business information: business address, service categories, operating hours, staff details, service menu, and pricing.
Billing information: subscription tier, billing address, and payment-method identifiers. Full card details are collected and stored by our payment processor (Stripe); we do not store full card numbers on our servers.
End-customer information entered by Business Users: customer names, contact details, appointment history, notes, intake forms, loyalty data (FlowPoints), and marketing preferences.
Communications: messages you send to our support team, survey responses, and content you submit through forms or chat.

2.2 Information Collected Automatically

Usage data: pages viewed, features used, clicks, search queries, time spent, and referral sources.
Device and technical data: IP address, browser type and version, operating system, device identifiers, language settings, and time-zone.
Cookies and similar technologies: we use cookies, pixels (including the Meta Pixel), and analytics tags (including Google Analytics 4) to operate the Service, remember preferences, measure performance, and support marketing. See Section 9 for details.
Log data: server logs, error reports, and security events.

2.3 Information From Third Parties

Payment processors: Stripe shares transaction status, last-4 card digits, card brand, and risk signals.
Authentication providers: if you sign in via Google or another identity provider, we receive basic profile information you authorize.
Marketing and advertising platforms: Meta, Google, and similar platforms may share aggregated campaign performance data.
Public sources and integrations: information from integrations you choose to connect (e.g., calendars, accounting tools).

How We Use Information

We use information for the following purposes:

Provide, operate, maintain, and improve the Service, including booking, POS, website building, marketing automation, and loyalty features.
Authenticate users, prevent fraud, and secure the Service.
Process subscription payments and end-customer transactions through Stripe.
Send transactional communications (booking confirmations, receipts, account notifications, security alerts).
Send marketing communications to Business Users about new features, beta programs, and offerings (you may opt out at any time).
Provide customer support and respond to inquiries.
Generate aggregated, de-identified analytics about how the Service is used.
Power AI features: our AI booking assistant ("Flo"), AI marketing tools, and predictive analytics use account and usage data to generate suggestions, content, and forecasts. We do not use Business User content to train foundation models maintained by third parties without your consent.
Comply with legal obligations, enforce our Terms of Service, and protect our rights, users, and the public.

Legal Bases for Processing

Where applicable law (such as Canadian PIPEDA, Alberta PIPA, the EU/UK GDPR, or other privacy laws) requires us to identify a legal basis for processing, we rely on one or more of the following:

Performance of a contract: to deliver the Service you have signed up for.
Legitimate interests: to operate, secure, and improve the Service, and to communicate with Business Users about their account.
Consent: where required, for example for certain marketing communications and non-essential cookies. You may withdraw consent at any time.
Legal obligation: to comply with tax, accounting, anti-fraud, and other legal requirements.

How We Share Information

We do not sell personal information. We share information only as described below:

Service providers: vendors who help us operate the Service, including cloud hosting, Stripe (payments), email delivery, OneSignal (notifications and email sequences), Google (analytics, workspace), Meta (advertising), and AI infrastructure providers. These vendors are bound by confidentiality and data-protection obligations.
Between Business Users and their End Customers: end-customer information is shared with the Business User whose service the end customer is engaging with.
Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality protections.
Legal and safety: to comply with law, lawful requests from public authorities, or to protect the rights, property, or safety of FlatPurse, our users, or others.
With your direction: when you authorize an integration or disclosure.

International Data Transfers

FlatPurse is headquartered in Edmonton, Alberta, Canada. Information may be processed and stored in Canada, the United States, and other jurisdictions where our service providers operate. When we transfer personal information outside of your jurisdiction, we use safeguards required by applicable law, such as standard contractual clauses or equivalent mechanisms.

Data Retention

We retain personal information for as long as necessary to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Specific retention practices include:

Account data: retained for the life of the account and for a reasonable period after termination.
Billing and tax records: retained as required by Canadian tax and accounting law (typically seven years).
End-customer data: retained as instructed by the Business User and deleted or returned upon termination of the Business User's account, subject to legal holds.
Logs and security data: typically retained for up to 24 months.
Deletion of personal data: Upon account closure or a valid deletion request, we will erase your personal data within thirty (30) days, except where longer retention is required to comply with legal, tax, or regulatory obligations (including the billing, tax, and security retention periods described above).

Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

Access a copy of the personal information we hold about you.
Correct inaccurate or incomplete information.
Delete your personal information, subject to legal exceptions.
Restrict or object to certain processing.
Withdraw consent where processing is based on consent.
Receive your information in a portable format.
Lodge a complaint with a supervisory authority (in Canada, the Office of the Privacy Commissioner of Canada; in Alberta, the Office of the Information and Privacy Commissioner of Alberta).

To exercise these rights, contact us at legal@flatpurse.com. If you are an end customer of a Business User, please direct requests to the Business User in the first instance; we will support them in responding.

Cookies and Tracking Technologies

We use cookies and similar technologies to operate the Service, remember your preferences, measure performance, and support marketing. Categories include:

Strictly necessary: required for the Service to function (e.g., authentication, security).
Performance and analytics: Google Analytics 4 and similar tools that help us understand usage.
Marketing: the Meta Pixel and other advertising tags that measure campaign performance and support retargeting.

You can control non-essential cookies through your browser settings or our cookie banner where available. See our Cookie Policy for full details. Disabling certain cookies may affect Service functionality.

Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, access controls, logging, and regular review of our security practices. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children's Privacy

The Service is intended for use by businesses and adults aged 18 and over. We do not knowingly collect personal information directly from children. If you believe a child has provided us with personal information, please contact us so we can investigate and, if appropriate, delete the information.

Third-Party Links and Services

The Service may contain links to third-party websites, integrations, or services that are not operated by FlatPurse. We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy policies.

AI Features

Certain features (including "Flo," AI marketing tools, and predictive analytics) use machine-learning models. When you use these features:

Inputs and outputs may be processed by third-party AI providers under contracts that restrict their use of your data.
Outputs are generated automatically and may contain inaccuracies. You are responsible for reviewing AI-generated content before relying on it or sending it to end customers.
Where required by law, we will obtain consent before using personal information for automated decision-making that has legal or similarly significant effects.

Limitation of Liability

In no event shall FlatPurse Inc. be liable for any indirect, incidental, special, or consequential damages arising from your use of FlatPurse Flow. FlatPurse Inc.'s total liability for any claim arising out of or relating to this Policy or your use of the Service shall not exceed the total amount paid by you to FlatPurse Inc. in the twelve (12) months preceding the claim.

Governing Law and Dispute Resolution

This Policy shall be governed by and construed in accordance with the laws of the Province of Alberta and the federal laws of Canada applicable therein, without regard to conflict of law principles. Any disputes arising under this Policy shall be resolved in the courts of the Province of Alberta.

Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service. The "Last Updated" date at the top of this Policy indicates when it was last revised. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.

Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, please contact:

FlatPurse Inc.

Attn: Privacy Officer

Edmonton, Alberta, Canada

Email: legal@flatpurse.com