Privacy Policy
1. Who we are
Flexus TrackMail (“Flexus”, “we”) is operated by Flexus Solutions. This policy explains what we collect when you use our website, web app, Outlook add-in, and Gmail Chrome extension.
2. Information we collect
- Account identity — Microsoft or Google account identifiers (such as Microsoft OID / Google sub), email address, and display name when you sign in with OAuth.
- Workspace data — workspace membership, roles, seat assignment, trial dates, and subscription status.
- Tracked email metadata — subject, recipients, send time, plan at send, and whether a Free watermark was applied — for messages you choose to track.
- Engagement signals — open and click events, including timestamp, IP address, approximate location (country/region/city when available), user-agent, and proxy labels (for example Gmail/Yahoo).
- Notifications — optional Web Push subscription endpoints and notification preferences; Chrome extension notification preferences stored in the browser.
- Schedule send — if you use send-later, we may store an encrypted OAuth refresh token so we can send on your behalf at the chosen time.
- Billing — Stripe customer and subscription IDs and status. Card numbers are processed by Stripe, not stored by Flexus.
- Technical logs — IP address, user-agent, and security-related auth attempt metadata used to protect accounts.
3. How we use information
- Provide open/click analytics, reminders, schedule send, and notifications you enable.
- Enforce Free / Trial / Pro entitlements and watermarking rules.
- Operate billing, team seats, and support.
- Prevent abuse, debug reliability issues, and improve the service.
4. Legal bases
Where applicable (for example GDPR), we process data to perform our contract with you, to pursue legitimate interests in operating a secure product, and — where required — based on your consent (such as browser notification permission).
5. Sharing
We do not sell personal data. We share data with processors who help us run the service, including hosting providers, Stripe (payments), and Microsoft/Google solely for OAuth authentication you initiate. We may disclose information if required by law.
6. Retention
We retain account and tracking data while your account is active and for a reasonable period afterward for backups, dispute resolution, and legal compliance. You may request deletion as described below.
7. Security
We use HTTPS, hashed API tokens, encrypted OAuth refresh tokens at rest, session cookies with HttpOnly/SameSite attributes, and workspace isolation for tracked emails. No method of transmission or storage is 100% secure.
8. Your choices
- Disconnect Microsoft or Google access from your provider’s account settings.
- Disable notification preferences in the web app or Chrome extension.
- Request export or deletion of your account data by emailing support@theflexus.biz.
9. Children
The service is not directed to children under 16, and we do not knowingly collect their data.
10. International transfers
Your data may be processed on servers in the regions where our hosting and subprocessors operate. We take steps appropriate to the nature of the data and applicable law.
11. Changes
We may update this policy. The “Last updated” date at the top will change when we do. Continued use after changes means you accept the updated policy.
12. Contact
Questions: support@theflexus.biz · Support page · Terms