Privacy Policy

1. Data We Collect

Account Information

When you create an account we collect:

• Name and email address
• Restaurant or bar name and location (city, state/region)
• Password (stored as a secure hash, never in plaintext)
• Billing information (collected and held by our payment processor; we do not store raw card numbers)

Restaurant Brand Information

During onboarding and ongoing use we collect:

• Brand materials you upload: logos, colors, fonts, tone-of-voice descriptions
• Website and social media profile URLs you provide
• Menu, hours, and other restaurant details you enter

When you provide a website address for your restaurant, Flo uses an automated crawler, identified by the user agent FloBot/1.0 (+https://flomarketing.ai/bot), to collect photos and text from that website for brand research. Flo does not verify that you own or control that domain. Photos collected this way are handled under the same AI-processing consent you give at signup for uploaded photos.

Uploaded Media

When you upload photos to the Service:

• The photo files themselves, stored in our cloud infrastructure
• Metadata such as file name, upload time, and file type
• AI-generated tags and category labels applied by our auto-organization feature (see Section 4)

Usage Data

We collect information about how you use the Service, including:

• Pages visited, features used, and time spent in the app
• Content you generate, schedule, or publish via the Service
• Device type, browser, and operating system
• IP address and approximate location derived from IP

Communications

If you contact our support team, we retain the content of those communications.

2. How We Use Your Data

We use the data we collect to:

• Create and maintain your account
• Deliver the features of the Service, including AI-assisted content generation and social scheduling
• Auto-organize your media library using AI image classification (described in Section 4)
• Improve the accuracy and relevance of AI-generated suggestions over time
• Send transactional communications: account confirmation, password reset, billing receipts
• Send product updates and feature announcements (you can opt out of marketing emails at any time)
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations

We do not sell your personal data to third parties. We do not use your data to train third-party AI models unless you separately and explicitly opt in to such a program.

3. Legal Basis for Processing

Where required by applicable law (for example, under GDPR for EU users), we process your personal data on the following bases:

• Contract performance: Processing necessary to provide the Service you signed up for
• Legitimate interests: Usage analytics, security monitoring, and product improvement, where these do not override your rights
• Consent: AI processing of uploaded photos (you provided explicit consent at signup; see Section 4)
• Legal obligation: Where we are required to process data by law

4. AI Processing of Uploaded Photos

What happens to your uploaded photos

When you upload photos to your Flo AI media library, those photos are sent to a third-party AI service for automatic classification and organization. The AI service analyzes the visual content of each photo (for example, distinguishing food shots from interior shots from event photos) and assigns category tags. This is what powers the auto-organization feature in your media library.

Additionally, photos you select for use in content generation may be sent to third-party AI model providers to create marketing images and other visual content.

Subprocessors - AI and Infrastructure

The following third-party services receive your data as part of providing the Service. We have contracts with each that restrict their use of your data to providing the service described.

Your consent for AI photo processing

You provided explicit consent for AI processing of your uploaded photos when you checked the consent box at signup. You may withdraw this consent at any time by contacting us at Legal@flomarketing.ai. If you withdraw consent, you will no longer be able to use the AI-powered media organization and image generation features, but your account and other features will remain accessible.

What AI subprocessors do NOT do with your photos

Our subprocessor agreements prohibit the use of your uploaded photos to train their own AI models or for any purpose outside of providing the specific service described above, unless you separately consent to that use.

5. Data Sharing

Beyond the subprocessors listed in Section 4, we share your data only in these circumstances:

• Legal requirements: If required by law, court order, or government authority
• Business transfer: If Flo AI is acquired or merges with another company, your data may transfer to the acquiring entity; we will notify you and give you the opportunity to delete your data before the transfer completes where practicable
• With your direction: When you connect a social media account (Instagram, Facebook), you authorize Flo AI to post on your behalf; that data is governed by those platforms' policies
• Aggregated, non-identifiable data: We may share aggregate usage statistics that cannot identify individual users

You can disconnect your Meta account (Facebook or Instagram) from Flo at any time in Settings under Connections. Disconnecting stops Flo from publishing to that account. The access token Flo stored for that connection is kept after you disconnect until you make a separate request to have your data deleted; see Section 6. You can also remove Flo's access from within your own Facebook or Instagram settings, which is true of any app connected to those platforms.

6. Data Retention

When you delete a specific photo or piece of content, we remove it from our active systems promptly. Copies in backup systems are purged on our standard backup rotation cycle, typically within 30 days.

7. Your Rights

Depending on where you are located, you may have rights regarding your personal data, including:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your personal data (subject to legal retention obligations)
• Portability: Request your data in a structured, machine-readable format
• Withdraw consent: Withdraw consent for AI photo processing (see Section 4)
• Opt out of marketing: Unsubscribe from non-transactional emails at any time via the link in any marketing email, or by contacting us

To exercise any of these rights, contact us at Legal@flomarketing.ai. We will respond within 30 days. For verified deletion requests, we will confirm deletion within 90 days.

If you are located in the EU or UK and believe we have not addressed your request appropriately, you have the right to lodge a complaint with your local data protection authority.

8. Security

We implement industry-standard security measures including:

• Encrypted data transmission (TLS)
• Encrypted storage for sensitive data
• Authentication via Supabase Auth with secure password hashing
• Row-level security policies that ensure each restaurant account can only access its own data
• Access controls limiting internal access to production data on a need-to-know basis

No system is completely secure. In the event of a data breach that affects your personal data, we will notify you as required by applicable law.

9. Children's Data

The Service is not directed to individuals under the age of 18 and is intended solely for business use by restaurant and bar operators. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, contact us at Legal@flomarketing.ai and we will delete it promptly.

10. Changes to This Policy

We will post the updated Privacy Policy at the URL where you first accessed this document and update the effective date. Where changes are material - particularly changes to how we process AI or photo data - we will notify you by email at least 14 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance, except where applicable law requires fresh consent.

11. Contact

Questions, requests, or complaints about this Privacy Policy: