Privacy Policy

1. Introduction

BuildTeam Inc., operating as Flowtropy ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, mobile applications, and services (collectively, the "Services").

By using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our Services.

In many cases, the studio you join through Flowtropy controls the member data it collects about you for bookings, attendance, memberships, and communications. In those situations, the studio is the data controller and we process that information on the studio's behalf. For platform-level information such as account creation, authentication, billing, and direct support interactions with us, BuildTeam Inc. acts as the data controller.

2. Information We Collect

2.1 Information You Provide

We collect information you provide directly to us, including:

• Account Information: Name, email address, phone number, and password when you create an account.
• Profile Information: Studio name, address, business type, timezone, and other details you add to your profile.
• Payment Information: Credit card details and billing address when you subscribe to our services (processed securely by Stripe).
• Health & Fitness Data: If you choose to connect Apple Health (HealthKit) or Google Health Connect, we collect workout and activity data you explicitly authorize. This data is used solely to provide the health and fitness features you enable, such as displaying your progress within the app. We do not sell this data, use it for third-party advertising, or use it to build data profiles for unrelated marketing. You can disconnect these integrations at any time through your device or app settings.
• Feedback & Communications: Class reviews, ratings, and information you provide when you contact us for support.

2.2 Information We Collect Automatically

When you use our Services, we automatically collect:

• Usage Data: Pages viewed, features used, time spent on pages, and other interaction data.
• Device Information: Device type, operating system, browser type, IP address, and unique device identifiers.
• Push Notification Tokens: Device tokens (e.g., Firebase Cloud Messaging) to deliver push notifications you have opted into.
• Location Data: With your explicit consent, we collect your location to help you find nearby studios. You can revoke location access at any time through your device settings.
• Cookies and Similar Technologies: Information collected through cookies, pixel tags, and similar technologies on our website.

2.3 Information from Third Parties

We may receive information from third parties such as payment processors (Stripe), analytics providers, and authentication providers (Google Sign-In, Apple Sign-In) when you connect your accounts or interact with our Services through these platforms.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services
• Process transactions and send related information
• Send administrative messages, updates, and security alerts
• Deliver push notifications for class reminders, booking confirmations, and studio updates
• Respond to your comments, questions, and customer service requests
• Send marketing communications (with your consent)
• Monitor and analyze trends, usage, and activities
• Detect, investigate, and prevent fraudulent transactions and abuse
• Personalize and improve your experience
• Comply with legal obligations

4. Information Sharing

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: With vendors who perform services on our behalf (e.g., Stripe for payment processing, Firebase for push notifications, Google Cloud for hosting).
• Your Studio: When you join a studio as a member, the studio can see your name, email, booking history, and attendance within their studio.
• Business Transfers: In connection with a merger, acquisition, or sale of assets.
• Legal Requirements: When required by law or to protect our rights, privacy, safety, or property.
• With Your Consent: When you direct us to share information with third parties.

5. Data Security

We implement industry-standard security measures to protect your information:

• SSL/TLS encryption for all data in transit
• Encryption for data at rest
• Secure token storage on mobile devices
• Role-based access controls
• Password hashing using bcrypt

6. Data Retention

We retain personal information for as long as reasonably necessary to provide the Services, satisfy legal and accounting obligations, resolve disputes, and enforce our agreements. Retention periods vary by data type.

• Account and profile data: Retained while your account is active and generally deleted or de-identified within 30 days after account deletion, unless a longer period is required by law.
• Billing and transaction records: Retained for as long as needed for tax, accounting, fraud prevention, and financial reporting obligations.
• Support requests and contact form submissions: Retained for a reasonable period to respond, follow up, maintain records of requests, and improve support quality.
• Usage logs and security records: Retained for security monitoring, troubleshooting, and abuse prevention, then deleted or aggregated in the ordinary course of business.
• Backups: Deleted on a rolling basis after they age out of our backup schedules.

7. Your Rights and Choices

You have the following rights regarding your data:

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your personal information and account.
• Portability: Request a copy of your data in a portable format.
• Opt-out: Unsubscribe from marketing emails, disable push notifications, or revoke location and health data permissions at any time.

To exercise these rights, please contact us through our contact form.

7.1 US State Privacy Rights

If you live in a US state that grants consumer privacy rights, such as California, Colorado, Connecticut, Utah, or Virginia, you may have additional rights under applicable law, including the right to know, access, delete, correct, or obtain a copy of certain personal information, and in some cases to opt out of certain uses.

We do not sell personal information. To submit a privacy rights request, please use our contact form. We may need to verify your identity before acting on your request.

8. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We use Google Cloud Platform for hosting, which may store data in data centers globally. We ensure appropriate safeguards are in place for such transfers.

9. Children's Privacy

Studio owner and administrator accounts are not intended for children. Member-facing booking and account features may be used by minors through participating studios, subject to studio policies, parental or guardian involvement where applicable, and applicable law. Community features are not available to users under 16. If we learn that we have collected personal information in a manner not permitted by this policy or applicable law, we will take steps to delete or de-identify that information.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.

11. Contact Us

If you have questions about this Privacy Policy or our privacy practices, or wish to exercise any of your data rights, please reach out: