Privacy policy

What we collect

• Account data - name, email address, password hash, two-factor secret, role, and sign-in events for people who log in to FlowX.
• Connected social account data - when an account owner links an X, YouTube, Instagram, TikTok or Discord account, we store the OAuth tokens that authorisation grants and the analytics those platforms return: profile details, follower counts, post lists and per-post metrics (views, impressions, likes, comments, shares, saves, watch time, audience country and age/gender breakdowns where the platform supplies them).
• Public social data - publicly visible profile and post metrics for accounts on our watchlists.
• Business records - sponsorship deals, deliverables, payouts, contact details for sponsors and creators, and notes our team enters.
• Technical data - server logs with IP address, browser and timestamps, used for security and debugging. We do not run third-party advertising or tracking pixels.

How we use it

• Operating the platform: authentication, permissions, and keeping records of deals and deliverables.
• Reporting on accounts the owner has connected: performance dashboards for the account owner and our team, and sponsorship reports that summarise reach and engagement for sponsors.
• Security: detecting abuse, investigating incidents, and maintaining backups.

We do not sell personal data and we do not use it for advertising.

Google user data

When you connect a YouTube channel, FlowX requests read-only access through Google OAuth using the youtube.readonly and yt-analytics.readonly scopes. We use that access only to read your channel details, uploads and YouTube Analytics figures (views, watch time, likes, comments, shares, subscribers gained and lost) and show them in the account owner's dashboard and in sponsorship reports the owner has agreed to. We do not post, edit or delete anything on your channel.

FlowX's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google data is not used to train AI or machine-learning models, is not sold, and is not shown to third parties other than in the aggregate reports described above.

You can revoke FlowX's access at any time from your Google account permissions page, or by asking us to disconnect the channel. Revoking access stops further reads; we delete the stored tokens on the next sync and the retained analytics on request.

Other platforms

X, Instagram (via Meta or the Ayrshare and Phyllo connectors), TikTok and Discord connections work the same way: read-only access granted by the account owner, revocable from that platform's settings or by asking us. Each platform's own terms govern the data it provides.

Sharing

We share data only with service providers needed to run the platform: our hosting provider (Hetzner, EU), transactional email (Resend), analytics connectors the owner chose to use (Ayrshare, Phyllo), and AI providers used to transcribe media and draft text (OpenAI, DeepSeek) - social analytics are not sent to AI providers. Aggregated reach and engagement figures for connected accounts may appear in reports we produce for sponsors. We disclose personal data if the law requires it.

Storage and retention

Data is stored on servers in the European Union. Connected-account tokens are kept while the account stays linked. Analytics history is kept while the account is on the platform so that period-over-period reporting works, and deleted within 30 days of the account being removed or a deletion request. Logs are kept for up to 90 days. Backups roll off within 35 days.

Your rights

You can ask us to access, correct, export or delete your personal data, or to disconnect a social account, by emailing privacy@scalpxcapital.com. If you are in the UK or EU you also have the right to object to processing and to complain to your data protection authority.

Changes

We will update this page when our practices change and revise the date at the top. Material changes affecting connected accounts will be flagged inside the platform.

Contact

SCALPX · privacy@scalpxcapital.com