Privacy Policy

1. Information We Collect

We collect information you provide directly: name, email address, company name, job title, and industry. We also collect data you upload to the platform: submittals, specifications, blueprints, and project documents. Usage data (page views, feature usage, timestamps) is collected automatically to improve the Service.

2. How We Use Your Data

• -To provide and maintain the Flostaq platform
• -To perform AI-assisted submittal analysis and specification extraction
• -To generate compliance reports and audit trails
• -To send account-related notifications (security alerts, billing confirmations)
• -To improve the Service through aggregated, anonymized usage analytics

3. AI Data Processing

When you use AI features (discrepancy analysis, spec extraction, CSI code prediction), your document data is sent to Google Gemini for processing. Flostaq uses the Gemini API in non-training mode - your data is never used to train Google models. AI outputs are transient and not stored by the AI provider beyond the request lifecycle. All AI-generated findings are labeled for human review and are not finalized without PE verification.

4. Data Encryption & Storage

• -At Rest: AES-256-GCM encryption for all documents and blueprints
• -In Transit: TLS 1.3 for all network communications
• -Database: PostgreSQL hosted on Supabase (SOC 2 certified infrastructure)
• -File Storage: Supabase Storage with per-file encryption
• -Encryption keys are retrieved at runtime from a secure vault - never hardcoded

5. Tenant Isolation

Your firm data is isolated using PostgreSQL Row-Level Security (RLS) policies. Every database query is automatically filtered by your firm ID at the database layer. Cross-tenant data access is architecturally impossible - another firm cannot access your data even if they modify API requests.

6. Audit Trail & Data Retention

All platform actions are recorded in an append-only audit trail using SHA-256 hash chaining. Audit records cannot be modified or deleted - this is enforced by database triggers. Audit data is retained for the lifetime of your account plus 7 years for regulatory compliance. Upon account deletion, project data is purged after 90 days; audit records are retained as required by law.

7. Data Sharing & Third Parties

• -We never sell your data to third parties
• -We share data only with service providers necessary to operate the platform:
• - Supabase (database hosting, SOC 2)
• - Vercel (application hosting, SOC 2)
• - Google (Gemini AI processing, non-training mode)
• - Resend (transactional email delivery)
• - Stripe (payment processing, PCI DSS Level 1)
• -We may disclose data if required by law, court order, or regulatory authority

8. Your Rights

• -Access: Request a copy of all data we hold about you
• -Correction: Update or correct inaccurate personal information
• -Deletion: Request deletion of your account and associated data
• -Export: Download your submittals, reports, and audit trail in standard formats (PDF, CSV)
• -Portability: Receive your data in a machine-readable format
• -Objection: Object to processing of your data for specific purposes

9. Cookies & Tracking

Flostaq uses essential cookies only: session authentication (NextAuth.js) and CSRF protection. We do not use advertising cookies, tracking pixels, or third-party analytics that follow you across the web. We use privacy-respecting, aggregated analytics to improve the product.

10. International Data Transfers

Your data may be processed in the United States where our infrastructure providers are located. We ensure appropriate safeguards are in place for any international data transfers, including encryption in transit (TLS 1.3) and at rest (AES-256-GCM).

11. Children

Flostaq is designed for professional use by AEC firms. We do not knowingly collect data from individuals under 18 years of age.

12. Changes to This Policy

We will notify you of material changes to this Privacy Policy via email at least 30 days before they take effect. The current version is always available at flostaq.com/privacy.

13. Contact

For privacy-related inquiries, data access requests, or to exercise your rights, contact our Data Protection team at privacy@flostaq.com.