Privacy Notice

Who is responsible

The data controller is:

Terry Spencer-Hopkins trading as Flux Cluster
2 Albion Terrace
Brewery Road
Sittingbourne
Kent
ME10 2EQ
United Kingdom

For privacy questions or requests, email privacy@fluxcluster.co.uk.

Information we process

Account information: your email address, display name, verification state, account status and internal account identifier.

Authentication information: credentials managed through Supabase Auth, authentication sessions, password-recovery information and relevant security events.

Trial and access information: product and platform access, entitlement status, trial dates, previous trial use and associated audit records.

Download information: authorised download requests and the product or installer involved.

Licence acceptance: when you accept the Flux Listen licence before a protected download, we record the licence version, acceptance time, your account identifier and the relevant download identifier.

Technical information: service and provider logs may include IP addresses, request times, request outcomes and browser or device information.

Support information: your contact details and information you choose to provide when asking for help, including any diagnostic report you send.

Do not send passwords, authentication or recovery links, signed download URLs or private keys in a support request.

Why we use this information

We use information to operate the account and services you request, including:

• Registering, verifying and authenticating your account.
• Administering trials and existing access rights.
• Providing authorised downloads and recording licence acceptance.
• Sending necessary verification and password-recovery emails.
• Preventing misuse and protecting accounts and services.
• Investigating faults and responding to support requests.
• Handling privacy requests and meeting legal obligations.

Our lawful bases

Contract: operating the account, trial and licensed services you request.

Legitimate interests: protecting accounts and services, preventing trial abuse, investigating faults or misuse and maintaining proportionate security and audit records.

Legal obligation: processing information where necessary to meet applicable legal duties.

Accepting a software licence does not give permission for marketing or optional tracking. Necessary account emails are part of providing and securing the account service.

Service providers

We use:

• Supabase for authentication, account and access records, backend functions, private installer storage and protected-download delivery.
• Resend for transactional emails sent through Supabase’s email configuration.
• Krystal for hosting and domain services.

Provider processing locations, logs and backups depend on the services used. Deleting information from a live service does not necessarily remove every provider backup immediately.

Our Supabase Pro project uses the Paris AWS region, with daily physical database backups and point-in-time recovery disabled. Database, authentication data, Storage objects and database backups are hosted in the selected region, but support, operational information and content delivery can involve other locations. Supabase documents a seven-day daily-backup access window for Pro; this is not an erasure deadline. Database backups do not include files stored through its Storage service.

We use Resend’s Transactional Free plan for account emails. Ireland is the sending region, but stored email content and delivery logs are in the United States. Resend publishes standard retention of 30 days for Free-plan email and log data, and seven days for backups.

Krystal provides our website and Control Centre hosting, domain services and, separately, our privacy and support mailboxes. These mailboxes use Amethyst Shared Hosting, not our VPS. Amethyst backups are daily and off-site, with 31 restore points. Our separate VPS has standard monthly, off-site backups, with no paid backup upgrade. We do not specify a backup country, the number of retained monthly generations or an immediate deletion deadline.

Supabase’s and Resend’s published data-processing terms provide Standard Contractual Clauses and UK transfer addenda for applicable international transfers. Krystal’s published Data Processing Agreement permits processing by sub-processors outside the UK or European Economic Area and requires safeguards for applicable transfers. We do not guarantee that all processing remains in the UK.

Stripe and other payment processing are not part of the current account-registration and free-trial journey.

Browser storage and tracking

The Control Centre uses browser local storage for authentication session information.

Flux Cluster does not use analytics, advertising cookies, tracking pixels or other non-essential tracking technologies on its website and Control Centre.

See our Cookies & Local Storage notice for details and your browser controls.

How long information is kept

We keep account information while it is needed to operate your account and provide the services attached to it.

We retain trial-use information to administer the trial and enforce the one-trial rule. The 14-day trial and subsequent 30-day trial-recovery period do not constitute a general account-deletion schedule.

Licence-acceptance records are retained while the associated account exists. They are removed from the live acceptance database when the associated authentication account is deleted.

Support, security and audit information is retained according to the purpose for which it is needed, including unresolved support matters, security incidents and applicable legal obligations. It should not be retained indefinitely without a continuing justification.

Provider logs and backups have separate retention and deletion arrangements. Removing a live account does not mean that all backup copies disappear immediately.

Account closure and privacy requests

To request account closure or exercise a privacy right, email privacy@fluxcluster.co.uk. We will verify your identity and explain how your request will be handled.

An email request does not itself trigger automatic account closure, session revocation or deletion.

We assess requests to erase personal information against the circumstances and applicable rights. Some information may need to be retained for a justified legal or security purpose. Where that applies, we will explain the reason.

Your rights

Depending on the circumstances, you may have rights to access, correct or erase your information, restrict its use or receive it in a portable form.

You may object to processing based on legitimate interests. Contact us using the privacy email address above.

You may also complain to the Information Commissioner’s Office:
https://ico.org.uk/make-a-complaint/

For ordinary product or account assistance, contact support@fluxcluster.co.uk.