Tratamiento de datos
Información de referencia en inglés sobre almacenamiento, protección, acceso y conservación de datos.
Documento de referencia en inglés. El cuerpo original se conserva sin modificar sus compromisos. Para aclaraciones sobre su alcance o vigencia, utiliza los contactos indicados en esta página.
What we store
Fluyio processes three categories of data:
| Category | Examples | Sensitivity |
|---|---|---|
| Account data | Your name, email, password hash, billing details held by Stripe | Restricted |
| Subscriber data | Your subscribers' emails, phone numbers, names, properties, consent per channel, email opens and clicks | Personal data under GDPR |
| Operational data | Campaign content, send logs, API request metadata, webhook endpoint configuration | Sensitive |
Where it lives
Production runs on a server we operate in the European Union: the application, the PostgreSQL database and the Redis queue live there, and database backups are kept in the EU too.
Traffic to fluyio.com passes through Cloudflare (DNS, TLS termination at the edge, DDoS
protection and web application firewall). Email is delivered through Resend, payments are
handled by Stripe and WhatsApp messages go through 360dialog. See
subprocessors for the full list and what each one receives.
Protection
| Layer | What we do |
|---|---|
| In transit | TLS for every connection to the API, the dashboard and this portal. HSTS with max-age=31536000; includeSubDomains; preload. |
| At rest | Data is stored on our EU server. We do not currently publish a disk-encryption attestation for it. |
| Passwords | Hashed with bcrypt with a per-user salt. Never stored or logged in plaintext. |
| Two-factor authentication | Optional TOTP (authenticator app) for dashboard users. |
| Session cookies | HttpOnly, Secure in production, scoped to the Fluyio domain. |
| API keys | Only a SHA-256 hash is stored. The plaintext is shown once at creation. |
| Webhook secrets | Only a SHA-256 hash is stored; the plaintext is shown once at creation and at rotation. |
| WhatsApp credentials | Encrypted with AES-256 using rotatable keys. |
Who can access your data
| Role | Access |
|---|---|
| You and your team | Full access within your account. |
| Fluyio engineering | Access to production systems for operations and for support requests you initiate. No third-party support staff has access to production. |
Retention
| Data | Retention |
|---|---|
| Subscriber data | Until you delete it, from the dashboard or with DELETE /v1/subscribers/:id. Deletion removes the record from the live database immediately; it disappears from backups when those rotate. |
| Campaign content and statistics | While your account is active. |
| Account data | Until you close your account. Write to [email protected] to request account deletion; billing records are kept as long as tax law requires. |
| Backups | Daily database backups, rotated on a fixed schedule. |
| Server and application logs | Rotated on the server. They record request metadata (method, path including query string, status, IP address, user agent, request id) and never contain API keys or passwords. Avoid putting personal data you would not want logged in query strings. |
Backups
- Daily database dumps, kept in the EU.
- Rotated automatically after a fixed number of days.
- Restores are tested when we run migrations, not on a published schedule.
Need a specific retention period or a data export for compliance? Email [email protected] and we will tell you what we can do.