Fluyio Developers

Información de referencia en inglés sobre funciones, privacidad y derechos de las personas.

Documento de referencia en inglés. El cuerpo original se conserva sin modificar sus compromisos. Para aclaraciones sobre su alcance o vigencia, utiliza los contactos indicados en esta página.

Our role

Under GDPR terminology:

You (the Fluyio customer) are the data controller for your subscribers' data.
Fluyio is the data processor, acting on your instructions.
Fluyio is the data controller for your own account data (your name, email, billing).

This split matters: a subscriber's request goes to you (the controller), and you use Fluyio (the processor) to act on it — through the dashboard or the API.

Data Processing Agreement

We do not have a self-service DPA yet. To sign one, email [email protected] with your legal entity name and a signing contact; we will send the document and return the countersigned copy by email.

Production runs on our own server in the European Union and backups stay in the EU. Some subprocessors are companies established outside the EU (for example Stripe, Google, Anthropic and Cloudflare); they process data under their own data processing terms. Ask [email protected] if you need the details for your records of processing.

Data subject rights

Your subscribers exercise their rights through you. The API lets you act on them:

Right of access (Art. 15)

# Find the subscriber by email
curl -g "https://fluyio.com/api/v1/subscribers?filter[email][email protected]&limit=1" \
  -H "Authorization: Bearer fly_live_..." \
  -H "Fluyio-Version: 2026-05-15"

The subscriber object contains everything the API holds about the person: identity, consent per channel, properties, lists, tags and the time of the last email open or click. Campaign-level statistics are available in the dashboard.

Right to rectification (Art. 16)

curl -X PATCH https://fluyio.com/api/v1/subscribers/sub_... \
  -H "Authorization: Bearer fly_live_..." \
  -H "Fluyio-Version: 2026-05-15" \
  -H "Content-Type: application/json" \
  -d '{ "first_name": "Jane", "email": "[email protected]" }'

Right to erasure (Art. 17)

curl -X DELETE https://fluyio.com/api/v1/subscribers/sub_... \
  -H "Authorization: Bearer fly_live_..." \
  -H "Fluyio-Version: 2026-05-15"

This removes the subscriber record — identity, properties, list memberships and tags — from the live database immediately. Backups containing the record disappear as they rotate. Aggregated campaign statistics are kept because they no longer identify the person.

Right to portability (Art. 20)

Use the access request above: the response is JSON, a machine-readable format.

Right to object / restrict processing (Art. 18, 21)

Use POST /v1/subscribers/:id/unsubscribe with { "channel": "all" } to stop all marketing messages while keeping the opt-out on record. To stop all processing, delete the subscriber.

Consent is stored per channel (email, sms, whatsapp) on every subscriber. For WhatsApp, Fluyio also records how the opt-in was collected (source) and when. Record consent only when you have actually obtained it: the subscribe endpoint documents consent, it does not collect it.

Cookies

The Fluyio developer portal (this site) uses no cookies of its own. When Cloudflare Web Analytics is enabled it is cookieless. The dashboard at fluyio.com uses a strictly necessary session cookie; the marketing site discloses its cookies in its own banner.

Questions about privacy, or a request we have not covered here? Email [email protected].

RGPD y privacidad