Flupy Privacy Policy

1. Introduction

Flupy (“Flupy”, “we”, “us”, “our”) is a household and family management service that helps households organise shopping lists, calendars, budgets, photos, documents, and related household information. This Privacy Policy explains what personal data we collect when you use Flupy, why we collect it, how we protect it, and the choices and rights you have.

This policy applies to flupy.com and the Flupy web application (including the installable progressive web app), and to every account type on Flupy: Account Holders, Members, Restricted profiles (including children’s profiles), and Guests.

Flupy is provided by Compval Trading & Services Ltd, company number - NI614155, registered office - Unit 271, Moat House, 54 Bloomfield Avenue, Belfast, BT5 5AD (“the Company”), which is the data controller for the personal data described in this policy.

2. Information We Collect

2.1 Account and household information

When an Account Holder signs up, we collect:

• Name and email address
• Password (stored as a salted hash – we never store passwords in plain text)
• Household name and preferred language/currency
• Billing information, handled by our payment processor, Stripe (see Section 8 – we do not store full card numbers ourselves)
• Records of your subscription tier, storage usage, and trial status

2.2 Household members: Members, Restricted profiles, and Guests

An Account Holder can add other people to a household. Depending on the role assigned, we collect:

• A display name for each Member, Restricted profile, or Guest
• For Restricted profiles used by children: a parent-declared age band only – we do not require or collect a child’s date of birth, email address, or other identifying contact details. Child profiles are created and managed entirely by the Account Holder; children do not register for themselves.
• Guest access is a scoped, time-limited share (for example, a shared shopping list) rather than a full account, and does not require the guest to create a profile or provide contact details beyond what is needed to deliver the shared link.

2.3 Content you store in Flupy

Flupy lets households store their own content, including todo lists, home and kitchen inventory records, calendar entries, budget entries, photos, documents, and diary entries. This content is yours: we process it only to provide the service to your household, and only your household’s authorised members (per the roles and permissions your Account Holder configures) can see it.

2.4 Usage and technical data

Like most web applications, we automatically collect some technical data needed to operate and secure the service: IP address, browser/device type, access times, and error/diagnostic logs. This data is used for security, troubleshooting, and service reliability, and is not used to build advertising profiles.

3. How We Use Your Information

We use personal data for the following purposes and on the following legal bases under UK GDPR:

• To provide and maintain the Flupy service, process your subscription, and manage your account – necessary for performance of our contract with you.
• To communicate essential service and account notices – for example about your trial or subscription status – necessary for performance of our contract with you.
• To keep the service secure, prevent abuse, and maintain backups – our legitimate interest in operating a reliable and secure service.
• To respond to support requests – necessary for performance of our contract, or our legitimate interest in resolving your query.
• To send optional marketing communications (for example about new features or referral rewards) – only with your consent, and only to Account Holders and Members, never to child Restricted profiles (see Section 5).
• To comply with our legal obligations, for example tax and accounting records relating to payments.

4. Children’s Privacy and the Children’s Code

Flupy allows an Account Holder to set up a Restricted profile for a child in their household, so we treat children’s privacy as a first-class design requirement, not an afterthought, and we have designed Flupy with the UK Information Commissioner’s Office (ICO) Age Appropriate Design Code (the “Children’s Code”) in mind. In particular:

• A child’s Restricted profile defaults to the most privacy-protective and access-restrictive settings available, and an Account Holder must actively choose to grant additional access.
• We collect the minimum data necessary to operate a child’s profile – a display name and a parent-declared age band – and nothing more.
• Child profiles are excluded from upgrade prompts, marketing communications, and personalisation or profiling features.
• Flupy does not collect precise geolocation data today; if location features are ever introduced, they will be off by default for child profiles.
• Where an Account Holder is able to view a child’s activity within the household, the child is made aware that this visibility exists, in age-appropriate terms, rather than being monitored invisibly.

Age assurance on Flupy relies on a parent or guardian (the Account Holder) declaring the age band of any child profile they create. Flupy provides the tools and controls described in this policy; the Account Holder, as the responsible adult for their household, is responsible for how those tools are configured and used for children in their care.

5. Cookies and Similar Technologies

Flupy uses strictly necessary cookies (for example, to keep you signed in and remember your household session) and, where enabled, functional cookies to remember preferences such as language or currency. We do not use third-party advertising cookies or trackers. Where we use any non-essential cookies in future, we will ask for your consent through our consent management tool before they are set.

6. How We Store and Protect Your Information

• Hosting location: Flupy’s servers are physically located in Germany, within the European Economic Area (EEA).
• Encryption: photos and documents you upload are encrypted at rest. Connections to Flupy are encrypted in transit (HTTPS/TLS).
• Access control: internal access to your data is limited to what is strictly necessary (“least privilege”) for named staff to operate and support the service.
• Backups: we back up the platform periodically as an additional safeguard against accidental data loss on our side. This is not a substitute for keeping your own copy of anything important – see Section 7 for how to export your data at any time.
• Data minimisation: we design each feature to collect only the data it actually needs, and periodically review what we hold.
• Breach notification: in the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, as required by law, and will notify affected households directly where the risk to them is high.

7. How Long We Keep Your Information

We keep your household’s data for as long as your account is active.

• Trial: a 30-day free trial, no card required.
• If your trial ends, or a subscription lapses, without an active paid plan in place, your household loses the ability to add or change Content until you subscribe (or resubscribe) – nothing is deleted automatically. We are developing a more detailed lifecycle for this (with defined grace periods and advance notice at each stage) and will update this policy before it takes effect.

You do not have to wait for any of this: you can export your household’s data in a portable format at any time, directly from within Flupy (Settings → Export your data – see Section 10), or ask us to permanently delete your account at any time by contacting us (Section 13).

8. Sharing Your Information

We do not sell your personal data. We share data only with the following categories of trusted processors, who act on our instructions and are bound by data protection agreements:

• Stripe – to process subscription payments securely. We do not store full payment card numbers ourselves.
• Our hosting provider – to store and run the Flupy application and your household’s data, as described in Section 6.

We will update this list if we introduce additional processors, and will describe here what each one does for us.

9. International Data Transfers

Flupy’s infrastructure is located in Germany (EEA). Where any element of our processing involves a transfer of personal data outside the UK or EEA – for example, where a processor we use operates internationally – we ensure an appropriate safeguard is in place, such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, or that the destination benefits from an applicable adequacy decision.

10. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Export your data in a portable format, at any time, from within Flupy
• Request erasure of your data (“right to be forgotten”), including full account deletion at any time – not only at the end of a trial or subscription
• Object to, or ask us to restrict, certain processing
• Withdraw consent at any time where we rely on consent (for example, marketing communications)
• Lodge a complaint with the ICO (ico.org.uk) or your local supervisory authority

To exercise any of these rights, use the relevant tool within Flupy where available, or contact us at hello@flupy.com. Requests relating to a child’s Restricted profile should be made by that child’s Account Holder.

11. Marketing Communications

We will only send marketing communications (such as feature announcements or referral offers) to Account Holders and Members who have opted in, and you can unsubscribe at any time using the link in any marketing email or via your account settings. As set out in Section 4, child Restricted profiles are never sent marketing communications and are excluded from personalisation used for marketing purposes.

12. Changes to This Policy

We may update this policy from time to time, for example as Flupy adds new features or as our legal obligations change. We will update the “Last updated” date at the top of this page, and where a change is material we will notify Account Holders directly (for example by email or an in-app notice) before it takes effect.

13. Contact Us

If you have questions about this policy or how we handle your data, contact us at hello@flupy.com.

You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) if you believe we have not handled your personal data properly.