LEGAL
Privacy Policy
Effective date: 13 August 2026. This policy explains what Floworx Lite processes, why, when a service provider is involved, and what you can ask us to do. The operator, and the controller for the information described here, is Stanley Fisher LLC.
1. Scope and roles
This policy covers the public Floworx Lite website and the authenticated application. For account and website information the operator is the controller. For the content a customer places in its workspace — pump records, imported files, duties, selections and projects — the customer is the controller and the operator processes it on that customer’s behalf and on its instructions.
2. What we process
Account information: name, work email address, organisation name, password (stored only as a cryptographic hash), role and membership. Authentication information: session records, and the one-time tokens used to confirm your address or reset your password — stored only as cryptographic hashes and expired after use. Workspace content: pump records, imported spreadsheets, duties, selections, projects and generated outputs. Operational information: sign-in events, a hashed IP address, browser user agent, and session and audit records used for security and support. Support information: what you send through the contact form — your name, email, organisation, chosen topic and message, together with a hashed IP address used solely to rate-limit abuse. Billing-related information: subscription, plan and invoice records, and safe payment-method metadata such as card type, brand, last four digits and expiry.
3. What we do not process
We do not store full payment-card numbers, card security codes, bank credentials or raw payment tokens; card details are handled by the payment processor on its own pages. The public website carries no advertising network and no third-party analytics or marketing tracker. We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use your workspace content for advertising or to train a model.
4. Why we process it
To provide, secure and support the service; to verify your email address at signup; to authenticate you and enforce workspace access; to send transactional and security messages such as verification, password reset and a password-change notification; to operate plans, seats, subscriptions and invoicing; to detect, investigate and prevent misuse; to respond to your enquiries; to communicate about your account and about material changes to the service; and to meet legal, tax and accounting obligations.
5. Legal bases
Where data-protection law requires a legal basis we rely on performance of the contract with you; our legitimate interests in operating, securing and improving the service; compliance with legal obligations; and, where it applies, your consent — which you may withdraw at any time without affecting processing already carried out.
6. Service providers and disclosure
We use a small number of providers to run the service: hosting and database infrastructure; a transactional email provider, for verification, password-reset and security messages; and a payment processor, for subscriptions. Each processes information only to provide that function to us. We do not share workspace content with other customers. We may disclose information where required by law, to enforce our terms, or to establish, exercise or defend legal claims. If the business is transferred, information may transfer with it, subject to this policy.
7. Security
Access to workspace data is scoped at the database level to the customer’s own workspace and to the memberships and roles that customer authorises. Passwords are stored only as cryptographic hashes, and verification and reset tokens are stored hashed, single-use and time-limited. Administrative actions are recorded in an audit trail. No method of transmission or storage is completely secure, and we hold no security certification — we will not imply one. If you need a formal security review, contact us and we will tell you plainly what we can and cannot evidence.
8. Retention
Account and workspace content is retained while the account is active and for a limited period afterwards, so that an account can be recovered and so that billing, tax and audit obligations can be met. Security, audit and billing records are retained for as long as required for those purposes. Contact form submissions are retained for accountable delivery and abuse prevention. We have not fixed a published retention period for every category; contact us if you need content removed sooner and we will tell you what is possible.
9. Your choices and rights
You can view and correct your own profile in the application, and a workspace owner can manage memberships. Depending on where you are, you may have rights to access, correct, delete, restrict or object to processing, to withdraw consent, to receive a copy of certain information, and not to be discriminated against for exercising them. Send the request through the Contact page and we will respond within the period the applicable law allows. If your information sits inside a customer’s workspace, we may need to direct your request to that customer.
10. Account deletion
Ask us through the Contact page to close an account or delete a workspace and we will do so, subject to any record we must keep for legal, tax or accounting reasons. Export or download the work you need first: deletion is not reversible.
11. International processing
The service and its providers may process information in countries other than your own, including the United States. Where such a transfer is subject to data-protection law, we rely on the transfer mechanisms available to us and require providers to apply appropriate safeguards. We do not currently offer a data-residency guarantee.
12. Cookies and browser storage
The website uses strictly necessary session and preference storage, and records your cookie choice so it can be honoured and revisited. No analytics or marketing technology is present today, and any that were added would be off until you consented. The Cookie Policy describes this in full, and Cookie Preferences in the footer reopens the choice at any time.
13. Children
Floworx Lite is a professional engineering tool, is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has provided information, contact us and we will delete it.
14. Changes and contact
We may update this policy; the effective date above will change and material changes will be notified to account holders. For any privacy question, or to exercise a right, use the form on the Contact page. The operator is Stanley Fisher LLC.