Privacy Policy

Floo is built on trust. This Privacy Policy explains what data we collect, why we collect it, how we protect it, and what rights you have over it. We have written it in plain English so you can actually understand it.

1. Who we are

Floo is a transaction monitoring and fraud detection service operated by Floo Ltd. When we say "Floo", "we", "us" or "our" in this policy, we mean Floo Ltd. Our contact email is hello@tryfloo.com.

2. What data we collect

We collect the following categories of data:

• Account data: Your business name, email address, WhatsApp number, and password (stored as a one-way hash — we cannot read it).
• Transaction data: Transaction amounts, times, beneficiary names, and references extracted from bank alert emails forwarded to our system.
• Alert data: Records of fraud alerts generated by our rules engine, including risk scores and the rules that fired.
• Usage data: Basic logs of when you log in and access your dashboard, used for security and improving the service.
• Payment data: Subscription payments are processed by Paystack. We do not store your card details. Paystack's privacy policy applies to payment processing.

We access your bank alert emails in read-only mode. We never store the full text of your emails — only the structured data extracted from them (amount, time, beneficiary, reference). We never access any emails other than bank transaction alerts.

3. How we use your data

We use your data solely to provide the Floo service:

• Monitoring your bank alert emails for suspicious transactions
• Running your configured fraud detection rules against each transaction
• Sending WhatsApp alerts when suspicious activity is detected
• Generating your daily risk summary
• Displaying your transaction history and alerts on your dashboard
• Sending transactional emails (welcome, password reset, account updates)

We do not use your data for advertising, profiling, or any purpose beyond providing the service you signed up for.

4. How we share your data

We share your data only with the following service providers, strictly for the purpose of delivering Floo:

• Twilio: WhatsApp alert delivery
• SendGrid: Transactional email delivery
• Paystack: Subscription payment processing
• Render: Cloud hosting for the Floo application and database
• Anthropic: AI-powered transaction analysis (Claude)

We never sell your data. We never share your data with third parties for marketing or advertising purposes. We do not share your financial data with any party not listed above.

We may disclose data if required by Nigerian law or a valid court order, and will notify you where legally permitted to do so.

5. Data security

We take security seriously. Our measures include:

• All data transmitted between your browser and Floo is encrypted using TLS 1.3
• All data stored in our database is encrypted at rest
• Passwords are hashed using bcrypt — we cannot recover or read your password
• Gmail access uses OAuth 2.0 — we never store your Google password
• Access to production systems is restricted to authorised personnel only
• Our infrastructure is hosted on Render, which maintains SOC 2 compliance

No system is completely immune to attack. If we ever discover a breach that affects your data, we will notify you within 72 hours.

6. Data retention

We retain your transaction and alert data for as long as your account is active, plus 90 days after cancellation to allow for account recovery. After that period all your data is permanently deleted.

You can request immediate deletion of all your data at any time by emailing hello@tryfloo.com.

7. Your rights

You have the right to:

• Access: Request a copy of all data we hold about you
• Correction: Ask us to correct any inaccurate data
• Deletion: Request that we delete all your data
• Portability: Request your transaction data in a machine-readable format (CSV)
• Objection: Object to any processing of your data
• Withdrawal: Withdraw consent at any time by cancelling your account

To exercise any of these rights, email us at hello@tryfloo.com. We will respond within 5 business days.

8. Cookies

Floo uses a single session cookie to keep you logged into your dashboard. This cookie is essential to the service and does not track you across other websites. We do not use advertising cookies or third-party analytics cookies.

9. Children

Floo is a business service. We do not knowingly collect data from anyone under the age of 18. If you believe a minor has created an account, please contact us and we will delete it immediately.

10. Changes to this policy

If we make material changes to this policy we will notify you by email at least 14 days before the changes take effect. Continued use of Floo after that date constitutes acceptance of the updated policy.