Privacy Policy
Flodion is a first-party analytics and conversion-intelligence platform. This policy explains what the platform processes and why, in its two distinct capacities:
- Visitor analytics (processor). When a website owner (our "Customer") installs the Flodion tracker on their site, we process data about that site's visitors on the Customer's behalf and under the Customer's instructions. For that data, the Customer is the data controller; if you are a visitor to a website that uses Flodion, the website's own privacy notice governs, and requests about your data should go to that website's operator.
- Platform accounts (controller). For the people who sign in to Flodion itself, the operator of this instance is the controller of their account data.
1. What the Tracker Collects About Website Visitors
- Usage events: pages viewed (URL paths and, where the Customer enables it, query strings), navigation within the site, time on page, scroll depth, clicks and call-to-action clicks, whether key page elements were visible, and page performance signals.
- Form interactions — but not form contents: which form and fields a visitor interacted with (field names and types), timing, validation errors, and whether the form was submitted. The tracker is designed not to capture the text or values entered into form fields.
- Device and browser: user-agent details (browser and version, operating system and version, device type), screen size, and language.
- Network: IP address — stored in full or with the final octet masked, depending on the Customer's anonymization setting — and approximate location (country, region, city) derived from it.
- Traffic source: referrer URL and campaign parameters (such as UTM tags).
- Identifiers: a randomly generated first-party visitor ID and session ID (see Section 3). These identify a browser to the one website being measured; they are not shared across different websites and are not linked to advertising IDs.
- Custom data: structured data the Customer's website chooses to send (for example, selected appointment slots or quiz answers). The Customer controls what is sent and is responsible for it.
From these, the platform derives aggregated statistics, funnel and conversion results, behavioral lead scores, and experiment measurements for the Customer.
What Flodion does not do: no third-party or advertising cookies, no cross-site tracking or profile building across different customers' websites, no capture of form field contents, and no selling or sharing of visitor data for advertising.
2. How Visitor Data Is Used
Visitor data is used solely to provide analytics and optimization to the Customer whose website was visited: traffic and behavior reporting, funnel and conversion analysis, lead scoring, friction diagnostics, experiment measurement, custom reports, alerts, and the webhooks and exports the Customer configures. It is not used for our own marketing and is not combined across unrelated websites.
3. Cookies and Local Storage
- On tracked websites: the tracker stores a random visitor ID, session ID, and a short-lived copy of its configuration in the browser's local storage for the tracked site. These are first-party to that website. The tracker does not set third-party cookies.
- On the Flodion dashboard: a session cookie is used to keep signed-in users authenticated. It is strictly necessary for the Service.
- The tracker does not itself interpret browser signals such as Do Not Track or Global Privacy Control; website operators are responsible for honoring applicable signals and consent requirements — for example, by loading the tracker only after consent where required.
4. IP Addresses and Location
The visitor's IP address is used for approximate (city-level) geolocation, session enrichment, and abuse prevention (rate limiting). Customers can enable IP anonymization, which masks the final octet before storage. To derive location, IP addresses are looked up against an IP-geolocation service (currently ip-api.com); only the IP address is sent for this purpose, and results are cached to minimize lookups.
5. Platform Account Data
For people who sign in to Flodion, we process: name, email address, a hashed password (passwords are never stored in plain text), authentication session data, and audit records of significant administrative actions (for example, changes to experiment traffic weights are logged with the acting user and timestamp). This data is used to operate, secure, and audit the platform.
6. Sharing and Subprocessors
We do not sell personal data and do not share it for advertising. Data is disclosed only to:
- Infrastructure providers that host this Flodion instance and its database and backups;
- The IP-geolocation service described in Section 4 (receives IP addresses only);
- Vercel, only where a Customer connects the Experiments feature: the platform sends experiment weight configuration to the Customer's own Vercel account. No visitor data is sent to Vercel;
- Content-delivery networks that serve the dashboard's interface assets (stylesheets, fonts, chart libraries) to signed-in users' browsers;
- Authorities where disclosure is required by law, after review of the demand.
7. Retention and Deletion
- Raw event streams are kept for a limited rolling window and purged on a schedule; aggregated statistics are retained to provide long-term reporting.
- Custom datasets have per-dataset retention that the Customer configures; expired partitions are dropped automatically.
- Deleting a site or dataset in the Service permanently removes the associated data from active systems; backups are overwritten in the ordinary course.
- Account data is retained while the account is active and removed after account deletion, except where law requires longer retention.
8. Security
The Service is served over HTTPS. Passwords are stored hashed; stored third-party API credentials are encrypted at rest and are never displayed back or sent to the browser after saving. Access to data is limited to authenticated users of the instance, and administrative actions that affect production behavior are audit-logged. No system is perfectly secure, but we work to protect the data we process and will handle incidents in line with applicable law.
9. Your Rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data, to object to processing, and to complain to a supervisory authority.
- Website visitors: direct requests to the operator of the website you visited — they are the controller and can act on the data, and we assist them in fulfilling such requests.
- Platform users: direct requests to the operator of this Flodion instance (see Contact below).
10. International Transfers
Data is processed where this Flodion instance and its infrastructure are hosted. Where personal data is transferred across borders, the parties rely on safeguards recognized by applicable law.
11. Children
The Service is business software and is not directed to children. Customers must not use it to knowingly track children where such tracking is prohibited.
12. Changes to This Policy
We may update this policy from time to time; the "Last updated" date reflects the current version, and material changes will be signposted in the Service.
13. Contact
Privacy questions and requests can be directed to the administrator of this Flodion instance. Visitors to tracked websites should contact the operator of the website they visited.