Privacy Policy

This Privacy Policy explains how Navaix Technology Private Limited ("Navaix", "Fluxo", "we", "us" or "our"), a company incorporated in India, processes information through the Fluxo website, applications, support channels and related services (collectively, the "Services").

The Services are offered to businesses and their authorized personnel, not to consumers acting in a personal capacity. Questions or requests may be sent to it.helpdesk@heyfluxo.com.

We act as a controller or data fiduciary for information used to operate our website, administer accounts, communicate with prospects and customers, secure the Services and meet our own legal obligations.

When we process information from a customer's Connected Services solely to provide the Services under that customer's instructions, the customer is the controller or data fiduciary and we act as its processor or service provider. Requests concerning information controlled by a customer may be referred to that customer, and we will provide reasonable assistance.

Depending on how the Services are used, we may process:

• Business and account information: name, business email, company, role, account credentials, preferences and authorized users.
• Commercial and support information: plan, billing and transaction records, communications, requests, feedback and support history. Payment card details are handled by payment providers and are not intended to be stored by Fluxo.
• Connected Services data: account and business identifiers, campaign settings, budgets, creatives, placements, performance, conversions, aggregated audience and engagement metrics, analytics reports, products, inventory, order identifiers, order value, order status and related dashboard information made available through customer-authorized integrations.
• Technical information: IP address, browser and device information, timestamps, authentication events, logs, diagnostic data and interactions with the Services.
• Public information: information lawfully available from public websites, public advertising libraries and other public sources.

Fluxo does not intentionally request Shopify customer names, email addresses, phone numbers, shipping addresses or payment details. A Connected Service may nevertheless return personal information if the customer enables a permission or field containing it. Customers must not provide sensitive or special-category personal data unless Fluxo has expressly agreed in writing to process it.

• Directly from visitors, customers and authorized users.
• From Connected Services authorized by a customer.
• Automatically through security, authentication and service logs.
• From public sources used for research and business intelligence.
• From service providers acting on our behalf.

• Provide, configure, support and improve the Services.
• Connect authorized business platforms and retrieve requested data.
• Analyze campaign, analytics and commerce performance.
• Generate recommendations and perform Authorized Actions.
• Authenticate users and protect accounts, integrations and systems.
• Administer plans, billing, support and customer relationships.
• Communicate service notices and, where permitted, marketing messages.
• Comply with law, enforce agreements and prevent misuse.

Where applicable law requires a legal basis, we process information as necessary to perform a contract, comply with legal obligations, protect our legitimate interests or those of our customers, and protect the Services. We rely on consent where required, including for certain marketing or non-essential tracking. Consent may be withdrawn without affecting earlier lawful processing. Processing on a customer's behalf is governed by the customer's instructions and applicable agreement.

"Connected Services" means advertising, analytics, ecommerce, measurement and other third-party business platforms that a customer authorizes Fluxo to access. Available integrations and permissions may change as the Services evolve.

We request permissions needed for the applicable plan or customer agreement. The authorization screen or integration documentation may provide more specific and current information about requested permissions. Third-party platforms process information under their own terms and privacy policies. Fluxo does not obtain ownership of a customer's Connected Services accounts or data.

Fluxo may use artificial intelligence systems to process Customer Content and Connected Services data solely to provide, secure and support the Services requested by the customer.

We do not use private Customer Content, private connected-account data, private campaign information or private commerce information to train generalized, shared or cross-customer models unless the customer gives separate, explicit written consent. We require model and infrastructure providers that receive private customer data to process it only to provide their contracted services, subject to their applicable contractual terms.

We may use public information and aggregated operational information to develop or improve Fluxo. Aggregated information must not reasonably identify a customer, campaign, household or individual, and we do not attempt to re-identify it. A customer may ask us to exclude its aggregated operational information from optional product-improvement analysis.

We may disclose information:

• To cloud, database, authentication, AI, monitoring, communication, billing, support and professional-service providers that help operate the Services.
• To a Connected Service when instructed by the customer or required to perform an Authorized Action.
• To authorities or other parties when required by law or reasonably necessary to protect rights, safety, security and the integrity of the Services.
• In connection with a merger, financing, reorganization or sale, subject to appropriate confidentiality and data-protection obligations.

We do not sell personal information or disclose it for third-party cross-context behavioural advertising. Service providers may use information only for the services they provide to us or as otherwise permitted by applicable law and contract.

Fluxo primarily processes information in India. Other processing or hosting regions may be provided under an applicable plan or Order Form. We and our service providers may process information in other countries where we use contractual, organizational and legal safeguards required by applicable law, including approved transfer mechanisms where relevant. A customer's agreed data-region commitment will be stated in its Order Form or other written agreement.

We retain information only while reasonably necessary for the purposes in this Policy, the applicable plan or Order Form, and legal obligations. Unless a written agreement or law requires otherwise:

• Integration tokens are retained while the integration is connected.
• Customer Content and decision history are retained during the subscription term.
• Raw imported data follows the retention period configured for the plan or customer.
• Customers normally have 30 days after termination to request an export.
• Active-system copies are deleted within 60 days after the applicable account closes or a verified deletion request is approved.
• Routine backups expire within 90 days.
• Security and audit logs may be retained for up to 12 months.
• Billing, tax, fraud-prevention and legal records are retained for the period required or permitted by law.

We may retain irreversibly aggregated information that does not identify a customer or individual. Legal holds, disputes and security investigations may require longer retention.

We maintain administrative, technical and organizational measures designed to protect information, including encryption in transit and at rest, protected integration credentials, access controls, tenant separation, logging, monitoring, backups, vulnerability management and incident response. No service can guarantee absolute security. Customers must keep their credentials secure, configure appropriate user access and promptly report suspected misuse.

Depending on location and context, a person may have rights to request access, correction, deletion, restriction, objection, portability, withdrawal of consent, an explanation of certain processing, or review of a decision about a privacy request. A person may also opt out of marketing communications using the unsubscribe control provided in the message.

Requests may be sent to it.helpdesk@heyfluxo.com. We may verify identity and authority before responding. If we process the information solely for a customer, the request should normally be directed to that customer. We will respond within the period required by applicable law and will not discriminate for exercising a privacy right.

To disconnect a Connected Service, use the integration controls in Fluxo or the relevant third-party platform. Disconnection stops new collection from that integration but may not automatically delete previously imported data required for account history, legal compliance or an active customer agreement.

To request deletion of previously collected information, email it.helpdesk@heyfluxo.com from an address associated with the account and identify the business, user and Connected Service involved. After verifying authority, we will delete or de-identify information unless retention is required by law, security needs, a dispute or the controlling customer's instructions. Platform tokens are revoked or deleted promptly when no longer required.

We may use cookies or similar technologies that are necessary for authentication, security and user preferences. If we introduce non-essential analytics, advertising or session-recording technologies, we will provide notices and choices required by applicable law before activating them. A browser may block cookies, but some essential account functions may then be unavailable.

India: Individuals may exercise rights available under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, as the relevant provisions come into force, including access to information, correction, erasure, grievance redressal and withdrawal of consent where applicable.

EEA and United Kingdom: Where the GDPR or UK GDPR applies, individuals may have rights including access, correction, erasure, restriction, objection and portability, and may complain to their local supervisory authority. Where required, international transfers use an adequacy decision, standard contractual clauses or another lawful mechanism.

United States: Residents of applicable states may have rights to know, access, correct, delete and obtain a copy of personal information and to opt out of certain sale, sharing, targeted advertising or profiling. Fluxo does not sell personal information or use it for third-party cross-context behavioural advertising. We will honor legally recognized opt-out preference signals when required by law.

The Services are intended for businesses and users who are at least 18 years old and authorized to act for a business. We do not knowingly collect personal information from children. If you believe a child has provided information to us, contact us and we will take appropriate steps to delete it.

We may update this Policy as our Services, integrations or legal obligations change. We will post the revised version and update the date above. Where required, we will provide additional notice or obtain consent before materially changing how previously collected information is used.

Contact Navaix Technology Private Limited at it.helpdesk@heyfluxo.com.