Privacy Policy

Floq is an AI-powered invoicing and rent management service. When this policy refers to “Floq”, “we”, “us”, or “our”, it means the relevant CasaPay entity acting as data controller for your region:

• UK users: CasaPay Ltd, registered in England and Wales (Companies House No. 14806725), 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.
• EU/EEA users: CasaPay OÜ, registered in Estonia (registry code 16781169), Narva mnt 5, Kesklinna linnaosa, 10117 Tallinn, Estonia.

This Privacy Policy explains how we collect, use, store, and share your personal data when you use our website or application at floq.casapay.com.

We collect information you provide directly and information generated by your use of our service:

• Account information — your name and email address when you register.
• Business data — invoices, tenant details, payment records, and other content you create or import while using Floq.
• Usage data — pages visited, features used, and actions taken within the application (with your consent where required).
• Technical data — IP address, browser type, device type, and session identifiers.

We use your personal data to:

• Provide, maintain, and improve the Floq service.
• Authenticate your identity and keep your account secure.
• Send transactional communications such as invoice confirmations and payment notifications.
• Understand how the service is used so we can make it better (analytics, with your consent).
• Comply with legal obligations, including HMRC reporting requirements where applicable.

We process your personal data on the following legal grounds under UK GDPR and EU GDPR (Regulation 2016/679):

• Contract — processing necessary to provide the service you have signed up for.
• Legitimate interests — improving and securing the service, where your interests do not override ours.
• Consent — for optional analytics cookies and marketing communications. You can withdraw consent at any time.
• Legal obligation — where we are required to process data by law.

We do not sell your personal data. We share data only with third-party service providers who help us operate Floq, and only to the extent necessary:

• Supabase — authentication and database infrastructure (EU-hosted).
• Google (Gemini API) — AI model infrastructure used to power the chat assistant. Prompts and responses may be processed by Google. Google processes data under its data processing terms, which include Standard Contractual Clauses for transfers outside the UK/EU.
• PostHog — product analytics, hosted on PostHog EU Cloud (data stored in the EU). Only active with your consent.

All third-party processors are bound by data processing agreements consistent with UK GDPR and EU GDPR requirements.

We retain your account data for as long as your account is active. If you close your account, we will delete your personal data within 90 days, except where we are required to retain it by law (for example, financial records required for tax purposes).

Under UK GDPR and EU GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data (“right to be forgotten”).
• Object to or restrict certain types of processing.
• Receive your data in a portable format (data portability).
• Withdraw consent at any time (where processing is based on consent).

To exercise any of these rights, contact us at privacy@casapay.com. We will respond within 30 days.

We use industry-standard measures to protect your data, including encryption in transit (TLS) and at rest. Access to personal data is restricted to authorised personnel only.

No method of transmission or storage is completely secure. If you become aware of a security concern, please contact us immediately at security@casapay.com.

We use cookies and similar technologies as described in our Cookie Policy.

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date and, where appropriate, notify you by email.

Questions about this policy? Contact us at privacy@casapay.com.

You also have the right to lodge a complaint with a data protection authority. UK users may contact the Information Commissioner's Office (ICO) at ico.org.uk. If you are based in the EU/EEA, you may lodge a complaint with the supervisory authority in your country of residence.