Privacy Policy

• Account data — your name, email address, and authentication credentials (passwords are hashed; we never store them in plain text).
• Business & client data you enter — clients, projects, time entries, freelancer cost rates, invoices, expenses, and notes. You control this data; we process it to provide the service.
• Payment configuration — if you connect Stripe or PayPal, we store the API credentials you provide so we can create payment links on your behalf. Card numbers are handled by those providers, not by us.
• Waitlist data — if you join our early-access list, we store your email address.
• Technical & usage data — IP address, device/browser information, and log data, used for security, rate limiting, and to operate the service.

• Provide, maintain, and secure the service and your account.
• Authenticate you and prevent fraud, abuse, and unauthorised access.
• Process invoices and payment links you choose to generate.
• Send essential service communications (and early-access updates if you joined the waitlist).
• Diagnose problems, improve features, and understand aggregate usage.

We rely on the following legal bases to process personal data:

• Performance of a contract — to provide the service you sign up for.
• Legitimate interests — to secure, operate, and improve the service, balanced against your rights.
• Consent — for the early-access waitlist and any optional analytics/marketing (which you can withdraw at any time).
• Legal obligation — where we must retain records (e.g. for tax or accounting).

We use the following sub-processors to run Fluxlancer. We share only what is necessary, and they are bound to protect your data:

• Convex — application database and backend.
• Vercel — application hosting and delivery.
• Better Auth — authentication; Google and GitHub if you use social sign-in.
• Stripe, PayPal, and Polar — payment processing and subscription billing.
• Resend — transactional email delivery.
• Sanity — content for our blog/marketing pages.

We do not sell your personal data.

Some of our providers are based outside the UK/EEA (for example, in the United States). Where data is transferred internationally, we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses or an adequacy decision.

We keep your account and business data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain records to meet legal obligations.

Under UK GDPR you have the right to:

• Access a copy of your personal data.
• Correct inaccurate data, or complete incomplete data.
• Erase your data (the “right to be forgotten”).
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time, where we rely on consent.

To exercise any of these, contact hello@fluxlancer.com. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

We protect your data with encryption in transit (HTTPS), tenant isolation, server-side access controls, and rate limiting. No system is perfectly secure, but we work to keep your data safe and to notify you of any breach as required by law.

We use essential cookies to keep you signed in and to secure the service. If we introduce non-essential analytics cookies in future, we will ask for your consent first.

Fluxlancer is not intended for anyone under 16, and we do not knowingly collect data from children.

We may update this policy from time to time. We will post the new version here and update the “Last updated” date above; material changes will be communicated where appropriate.

Questions about this policy or your data? Email us at hello@fluxlancer.com. Fluxlancer is operated by Jay Doolan, a sole trader based in the United Kingdom; our postal address is available on request.