Privacy Policy

Last updated 29 July 2026

In review. This policy is accurate to how the product works today and is currently with counsel. We will remove this notice once that review is complete.

ForeFlux is a demand-forecasting and stock-planning tool for small businesses in the Philippines. This policy explains what we hold, where it sits, and how you get it back or get rid of it. It covers foreflux.ai and the ForeFlux app. What you may do with the service, and what we promise about it, is a separate document — the terms of service.

What we collect

• Your sign-in details. Your email address and, if you sign in with Google, the name and profile picture Google gives us. We never receive your Google password.
• Your business name, as you type it during setup or on your profile page.
• Your business records. Everything you enter or generate in the app: sales and receipts, stock levels and adjustments, purchase orders, suppliers, locations and opening hours, and the items you sell. This is your data about your business — it is stored as a single record attached to your account.

We do not collect payment details, because there is nothing to pay for during the pilot. We do not run advertising, and we do not sell or share your records with anyone.

Where it is stored

• Supabase hosts the database and handles sign-in. Your records are stored in Supabase's Oceania region — Sydney, Australia.
• Cloudflare Pages serves the site's static files.
• Google processes the sign-in itself, if you choose to sign in with Google.
• PostHog, on their US region, hosts the product-analytics data described under Cookies below.
• OpenStreetMap draws the map on our contact page. Loading that map sends your IP address and browser version to OpenStreetMap, and nothing else — no account, no cookie, no record of yours. It is the only page that loads it.
• jsDelivr serves one JavaScript file to the pages you see after you sign in. Loading it sends your IP address and browser version to jsDelivr, and nothing else. Our public pages no longer load it at all — we serve that file ourselves.

Those six are our only processors. We will update this list before adding another — including a payment processor, which we do not have yet.

Your data leaves the Philippines

Because our database is in Sydney, your business records are stored outside the Philippines. Australia has its own data-protection law (the Privacy Act 1988), and the Philippine Data Privacy Act allows this transfer provided we stay accountable for your data wherever it sits — which we do. Your rights below apply in full regardless of where the servers are.

We chose Sydney because it is the nearest region to the Philippines that Supabase offers with the features this product needs. If we move regions we will say so here first.

A copy of your records is also kept in your own browser's local storage so the app keeps working when your connection drops. Clearing your browser data removes that copy, not the one on the server.

Why we hold it

To run the service you asked for: to show your stock and sales back to you, and to forecast demand from your own sales history. Forecasts are computed from your data, for you. We do not use your records to train models used by anyone else.

Who can see it

Your records are readable only by your own account. Access is enforced by the database itself (row-level security), not just by the app. During the pilot our team can access records when you ask us for support, or where we are required to by law.

Getting your data out, and getting it erased

• Export: Profile → Data → Download backup. That file is everything we hold about your business.
• Reset: the same section empties your records while keeping your login.
• Delete everything: Profile → Danger zone → Delete account. This removes your login and every record attached to it. It is immediate and cannot be undone.

We keep your records for as long as your account exists. Backups taken before a deletion age out on the hosting provider's own schedule.

Cookies

We use one thing that behaves like a cookie: a sign-in token stored in your browser so you stay signed in. There are no advertising or third-party tracking cookies.

Inside the signed-in app — never on foreflux.ai's public pages — we use PostHog for product analytics: which screens and features get used, so we know where the product needs work. What it receives is your account id and the pages and actions you take, tied to your business account — not your business records, and no personal detail beyond what Sign-in details above already covers. This is for our own team's use. It is never sold, shared with advertisers, or used to advertise to you.

Your rights

Under the Philippine Data Privacy Act of 2012 you have the right to be informed, to access, to correct, to object, to erasure or blocking, to damages, and to data portability. The export and delete controls above cover access, portability and erasure directly. For anything else, write to us.

Who is accountable. ForeFlux is operated from Metro Manila, Philippines. The business entity behind it is being registered now, and registration with the National Privacy Commission as a personal information controller — together with the name of our Data Protection Officer — will be recorded here as soon as it completes. Until then, requests under the Act reach a named human at the address below, and are answered.

Children

ForeFlux is a business tool and is not intended for anyone under 18.

Changes

If this policy changes materially we will say so by email to the address on your account before the change takes effect.

Contact

Email hello@foreflux.ai, or send us a message — the same inbox either way. We answer data requests — access, correction, export, deletion — within seven working days.