Privacy policy

This policy covers visitors to flolya.com, people who create or use a professional account, prospects who contact Flolya and people who view a form or proposal hosted by a studio.

It does not cover third-party websites or services reached through a link. Their own policies apply.

For the website, accounts, subscriptions, support and product improvement, Flolya determines the purposes of processing and acts as controller. The privacy contact is contact@flolya.com.

When a studio uses Flolya to manage data about its clients, guests, suppliers or team, that studio generally determines the purposes. It is the controller and Flolya processes the data on its behalf as a processor.

Depending on how you use the service, Flolya may process:

• identity and contact data: name, email address, phone number and studio information;
• account and security data: identifier, role, sessions, technical logs and access attempts;
• business data entered into the service: clients, events, venues, arrangements, documents, messages, signatures and tracked payments;
• subscription data: plan, renewal dates, Stripe identifiers, invoices and payment status, without storing the complete card number;
• usage and communication data: viewed pages, in-product actions, device, browser, IP address, support requests and form responses.

Processing is carried out for the following purposes and lawful bases:

• creating accounts, providing the service and managing trials, subscriptions and support (performance of a contract or pre-contractual steps);
• securing Flolya, preventing fraud, diagnosing incidents and improving the product (Flolya’s legitimate interests);
• issuing invoices, keeping accounts and responding to authorities (compliance with legal obligations);
• sending optional marketing communications or enabling certain trackers (consent where required, which can be withdrawn at any time).

Data is available only to people who need it to operate and secure Flolya and to providers acting under contractual commitments. It is not sold.

The main providers currently used are:

• Supabase for authentication, database services and storage;
• Cloudflare for hosting, networking and security;
• Stripe for payments, subscriptions, invoices and fraud prevention;
• Resend for transactional email delivery;
• PostHog for audience measurement, usage analytics and product diagnostics, and SignWell for electronic signature flows when used.

Some providers may process data from countries outside the European Economic Area or use international subprocessors.

In such cases, the transfer relies on an adequacy decision, European Commission standard contractual clauses or another safeguard recognised by the GDPR. Further information can be requested at contact@flolya.com.

Data is kept only for as long as needed for its purpose, then erased, anonymised or placed in restricted intermediate archives. The main criteria are:

• account and usage data: during the contractual relationship, then for up to five years where needed as evidence or to defend legal rights;
• invoices and accounting records: ten years from the end of the relevant financial year;
• support requests and prospects: up to three years after the last useful contact unless a dispute or a different obligation applies;
• data managed by a studio for its own clients: according to its instructions and for the life of its account, subject to technical backup periods and applicable legal obligations.

Flolya uses cookies or local storage needed for authentication, security, language choice, interface preferences and journey continuity. Disabling them may prevent some features from working correctly.

PostHog may use technical identifiers, cookies or local storage to measure audience and understand product use. No advertising tracker is used. Where consent is legally required, users must be able to accept or refuse before the relevant tracker is enabled.

Flolya implements proportionate technical and organisational measures, including access controls, studio separation, encrypted communications, restricted server keys, backups and error monitoring.

No system can offer absolute security. Users must use a unique password, protect their account and promptly report suspicious activity.

Depending on the processing, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests and withdraw consent at any time.

Send requests to contact@flolya.com. Flolya generally responds within one month. If the request concerns data entered by a studio to manage its own clients, contact that studio first because it is the controller.

You may also lodge a complaint with the French data protection authority, the CNIL, at cnil.fr.

This policy may change when the service, providers or regulations change. The date at the top identifies the applicable version.

Material changes will be brought to users’ attention by an appropriate means before they take effect where necessary.