Privacy Policy

1. Introduction

BuildTeam Inc., operating as Flowtropy ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile applications, and services (collectively, the "Services").

By using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our Services.

In many cases, the studio you join through Flowtropy controls the member data it collects about you for bookings, attendance, memberships, and communications. In those situations, the studio is the data controller and we process that information on the studio's behalf. For platform-level information such as account creation, authentication, billing, and direct support interactions with us, BuildTeam Inc. acts as the data controller.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, phone number, and password when you create an account.
• Profile Information: Studio name, address, business type, timezone, and other details you add to your profile.
• Payment Information: Credit card details and billing address when you subscribe to our services (processed securely by Stripe).
• Health & Fitness Data: If you choose to connect Apple Health (HealthKit) or Google Health Connect, we collect workout and activity data you explicitly authorize. This data is used solely to provide the health and fitness features you enable, such as displaying your progress within the app. We do not sell this data, use it for third-party advertising, or use it to build data profiles for unrelated marketing. You can disconnect these integrations at any time through your device or app settings.
• Feedback & Communications: Class reviews, ratings, and information you provide when you contact us for support.

2.2 Information We Collect Automatically

When you use our Services, we automatically collect:

• Usage Data: Pages viewed, features used, time spent on pages, and other interaction data. For studio staff and administrators using the management app, this includes product analytics and session replays (a recording of how the app was navigated) provided by PostHog. Session replays mask everything typed into a form, and we do not record member-facing pages, check-in kiosks, or public booking and waiver pages.
• Error and Crash Reports: When something goes wrong in the app, a report describing the error, the page or request involved, your account ID, and your device and browser type is sent to Sentry, our error-monitoring provider, so we can fix it. These reports are scrubbed of names, email addresses and phone numbers before they leave our systems.
• Device Information: Device type, operating system, browser type, IP address, and unique device identifiers.
• Push Notification Tokens: Device tokens (e.g., Firebase Cloud Messaging) to deliver push notifications you have opted into.
• Location Data: With your explicit consent, we collect your location to help you find nearby studios. You can revoke location access at any time through your device settings.
• Cookies and Similar Technologies: Information collected through cookies, pixel tags, and similar technologies on our website.

2.3 Information from Third Parties

We may receive information from third parties such as payment processors (Stripe), analytics providers (PostHog), authentication providers (Google Sign-In, Apple Sign-In, Facebook Login), Meta (Instagram and Facebook) and Google (YouTube) when you connect your accounts or interact with our Services through these platforms.

2.4 Connected Instagram Accounts (Meta Platform Data)

A studio can choose to connect its own Instagram professional account to Flowtropy through Meta's login. The studio decides whether to connect, sees exactly which permissions it is granting on Meta's screen, and can disconnect at any time. We call the information we receive from Meta this way "Platform Data."

What we receive. Only what the permissions the studio granted allow:

• The connected account's profile details (such as its username, name, and profile picture).
• The account's own posts and their performance figures (such as reach and engagement).
• Comments left on the account's posts and direct messages sent to the account, together with the public username of the person who wrote them.
• Notifications from Meta that a new comment or message has arrived.

How we use it. Only to provide the service to the studio that connected the account:

• To show the studio its comments and messages in one inbox and send the replies it writes.
• To send automatic replies the studio has set up and approved in advance — for example, a booking link when someone comments a word the studio chose.
• To publish and schedule posts the studio creates.
• To show the studio how its posts performed and which posts led to bookings.

What we do not do.

• We do not sell Platform Data or license it to anyone.
• We do not use it for advertising, or to build profiles of people for advertising.
• We do not share it with other studios or combine it across studios. A studio sees only the data of the account it connected.
• We share it only with the service providers that host and run Flowtropy for us, who may use it solely to provide that service, or when the law requires it.

If you wrote to a studio on Instagram. When you comment on or message a studio that uses Flowtropy, the studio is responsible for that conversation and we handle it on the studio's behalf. We keep your Instagram username and the conversation so the studio can answer you and see whether it led to a booking.

Disconnecting and deleting.

• A studio can disconnect its Instagram account at any time in its Flowtropy settings. We then delete the access we were given, stop receiving new comments and messages, and stop acting on the account.
• Removing Flowtropy from the account's settings on Instagram or Facebook has the same effect: Meta tells us, and we delete the access we hold.
• Anyone can ask us to delete the Instagram data we hold about them — through Meta's own data deletion request, which gives you a confirmation code and a page to check progress, or by emailing support@flowtropy.com. We delete the conversations, replies and related records we hold for that person, usually within a few days and in every case within 30 days.

2.5 Connected Facebook Pages and Facebook Login (Meta Platform Data)

A business can choose to connect a Facebook Page it manages through Meta's Facebook Login for Business. It picks which Pages to connect, sees exactly which permissions it is granting on Meta's screen, and can disconnect at any time. Everything in section 2.4 about Platform Data — what we do not do with it, and how it is deleted — applies to Facebook Pages in the same way.

What we receive from a connected Page. Only what the granted permissions allow:

• The Page's name and the list of Pages the person connecting manages, so they can choose.
• The Page's own posts and their performance figures (such as views, reach and follows).
• Messenger messages sent to the Page and comments on its posts, together with the public name of the person who wrote them.
• Notifications from Meta that a new message or comment has arrived.

How we use it. Only to provide the service to the business that connected the Page: to publish, edit and delete the posts it creates; to show its messages and comments in its inbox and send the replies it writes, within the time limits Messenger sets; and to show how its posts performed. If you messaged or commented on a business's Page, the business is responsible for that conversation and we handle it on its behalf.

Disconnecting a Page. When a business disconnects a Page in its Flowtropy settings, we tell Meta to stop sending us its messages and comments, delete the access we were given, and ignore anything that still arrives for it.

Signing in with Facebook. If you choose "Continue with Facebook", Meta shares your name, email address, profile picture and an identifier for your Facebook account. We use them only to sign you in, to create your account if you ask us to, and to show your picture. We never post to Facebook on your behalf through this sign-in.

• If your Facebook email does not match an account, we ask before creating one, so you can instead link Facebook to the account you already have.
• We email you whenever a sign-in method is linked to or removed from your account. You can unlink Facebook at any time in your account settings.
• To have us delete the Facebook sign-in information we hold, unlink it in your account settings or email support@flowtropy.com.

2.6 Connected YouTube Channels (YouTube API Services)

Flowtropy uses YouTube API Services. A business can choose to connect its own YouTube channel through Google's sign-in, where it sees exactly which access it is granting. Google's handling of this information is described in the Google Privacy Policy.

What we store. Only what the access the business granted allows:

• The channel's profile (such as its name, picture, description and subscriber count).
• The channel's videos and their figures, and the channel's own figures (such as views and watch time).
• Comments left on the channel's videos, with the public name of the person who wrote them, so the business can read and answer them in its Inbox.

How we use it. Only to show that business its own results, upload the videos it chooses, and answer comments on its videos, including automatic replies it has set up in advance. YouTube data is never combined across businesses: a business sees only the data of the channel it connected. We do not sell it or use it for advertising.

Removing access and deleting.

• A business can disconnect YouTube at any time in its Flowtropy settings, or remove our access in its Google account at security.google.com/settings/security/permissions.
• We delete the YouTube data we hold within 7 days of access being removed.
• While a channel stays connected, we refresh the YouTube data we keep, or delete it, at least every 30 days.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services
• Process transactions and send related information
• Send administrative messages, updates, and security alerts
• Deliver push notifications for class reminders, booking confirmations, and studio updates
• Respond to your comments, questions, and customer service requests
• Send marketing communications (with your consent)
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent transactions and abuse
• Personalize and improve your experience
• Comply with legal obligations

4. Information Sharing

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: With vendors who perform services on our behalf (e.g., Stripe for payment processing, Firebase for push notifications, Google Cloud for hosting, SendGrid and Twilio for email and text delivery, Sentry for error monitoring, and PostHog for product analytics). Each is bound by contract to use the information only to provide its service to us.
• Your Studio: When you join a studio as a member, the studio can see your name, email, booking history, and attendance within their studio.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.
• Legal Requirements: When required by law or to protect our rights, privacy, safety, or property.
• With Your Consent: When you direct us to share information with third parties.

5. Data Security

We implement industry-standard security measures to protect your information:

• SSL/TLS encryption for all data in transit
• Encryption for data at rest
• Secure token storage on mobile devices
• Role-based access controls
• Password hashing using bcrypt

6. Data Retention

We retain personal information for as long as reasonably necessary to provide the Services, satisfy legal and accounting obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type.

• Account and profile data: Retained while your account is active and generally deleted or de-identified within 30 days after account deletion, unless a longer period is required by law.
• Billing and transaction records: Retained for as long as needed for tax, accounting, fraud prevention, and financial reporting obligations.
• Support requests and contact form submissions: Retained for a reasonable period to respond, follow up, maintain records of requests, and improve support quality.
• Usage logs and security records: Retained for security monitoring, troubleshooting, and abuse prevention, then deleted or aggregated in the ordinary course of business.
• Connected Instagram accounts: Kept while the account stays connected. When a studio disconnects, we delete the access we were given straight away; the studio's own post history and results stay in its account until the studio deletes them or closes its account. See section 2.4 for deletion requests.
• Connected Facebook Pages: Kept while the Page stays connected. When a business disconnects, we stop receiving the Page's messages and comments and delete the access we were given straight away. See section 2.5.
• Connected YouTube channels: Refreshed or deleted at least every 30 days while connected, and deleted within 7 days of access being removed. See section 2.6.
• Backups: Deleted on a rolling basis after they age out of our backup schedules.

7. Your Rights and Choices

You have the following rights regarding your data:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information and account.
• Portability: Request a copy of your data in a portable format.
• Opt-out: Unsubscribe from marketing emails, disable push notifications, or revoke location and health data permissions at any time.

To exercise these rights, please contact us through our contact form.

7.1 US State Privacy Rights

If you live in a US state that grants consumer privacy rights, such as California, Colorado, Connecticut, Utah, or Virginia, you may have additional rights under applicable law, including the right to know, access, delete, correct, or obtain a copy of certain personal information, and in some cases to opt out of certain uses.

We do not sell personal information. To submit a privacy rights request, please use our contact form. We may need to verify your identity before acting on your request.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We use Google Cloud Platform for hosting, which may store data in data centers globally, and our error-monitoring (Sentry) and product-analytics (PostHog) providers store their data in the United States. We ensure appropriate safeguards are in place for such transfers.

9. Children's Privacy

Studio owner and administrator accounts are not intended for children. Member-facing booking and account features may be used by minors through participating studios, subject to studio policies, parental or guardian involvement where applicable, and applicable law. Community features are not available to users under 16. If we learn that we have collected personal information in a manner not permitted by this policy or applicable law, we will take steps to delete or de-identify that information.

10. SMS / Text Messaging

Flowtropy and the fitness and wellness studios that use our platform may send you SMS/text messages related to your account and class activity — for example, class check-in links, waiver signing links, class reminders, booking confirmations, and account notifications.

• Consent: You provide your mobile number and consent to receive these messages when you book a class, create an account, or check in at a studio. Consent to receive text messages is not a condition of purchase.
• Message frequency varies based on your activity (for example, per booking or check-in).
• Message and data rates may apply.
• Opt-out: Reply STOP to any message to unsubscribe at any time. Reply HELP for help, or reach us via our contact form.
• No sharing: No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information may be shared with subprocessors (such as our messaging provider) solely to deliver the messages you request.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

12. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise any of your data rights, please reach out: