Privacy Policy

Flux Studio (“PromoStack”, “we”) operates promostack and its API. Contact: abdullah129026@fluxyai.codes.

• Account data: when you sign up via GitHub OAuth we receive your GitHub profile (username, email, avatar); via email sign-in we store your email address.
• Merchant data you create: promotions, coupon codes, gift cards, referral and loyalty records, redemption logs, and API keys (stored as irreversible hashes — we cannot see your key values).
• End-customer identifiers you send us: if your integration passes customer references for redemptions, we store them to operate fraud controls and ledgers.
• Billing data: processed by Paddle, our merchant of record. We receive subscription status and plan, not your card details.
• Operational logs: request metadata (timestamps, IP addresses, user agents) retained briefly for security and debugging.

• To operate, secure, and improve the service.
• To process payments and manage subscriptions (via Paddle).
• To detect abuse and fraud (velocity checks, blocklists, review queues).
• To contact you about your account, billing, or material service changes.

We do not sell your data. We do not use it for advertising. We do not train models on it.

We store and process data with:

• Neon — managed Postgres database;
• Vercel — application hosting;
• Upstash — Redis for rate limiting;
• Resend — transactional email;
• Paddle — billing and payments (merchant of record).

Each processes data only on our instructions. Our Data Processing Addendum governs processor relationships for customers who need it.

We use strictly-necessary cookies for sign-in sessions (Auth.js) and security. We use no advertising or cross-site tracking cookies. See our Cookie Policy.

• Account and merchant data: kept while your account is active.
• Redemption and ledger records: kept for the life of the account — ledgers are append-only by design and cannot be edited.
• Operational logs: retained for a short window (weeks, not years) for security purposes.
• On account closure, we delete or anonymize your data on request, except where law or legitimate interests (e.g. fraud prevention, tax records) require retention.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. Email abdullah129026@fluxyai.codes and we will respond within 30 days.

Data is encrypted in transit (TLS) and at rest by our infrastructure providers. API keys are stored as SHA-256 hashes. Details are on our Security page.

Our infrastructure providers may process data in the United States and the EU. Where required, transfers are safeguarded by standard contractual clauses or equivalent mechanisms.

We will post updates here with a revised date and notify account holders of material changes by email.