Privacy Policy

FlowMoose, Inc. ("FlowMoose," "we," "us," or "our") provides a platform that lets businesses ("Operators") sell prepaid sessions that customers buy or gift, book into a time slot, and unlock with a QR code scan. This Privacy Policy explains what information we collect, how we use it, and the choices you have. It applies to business.flowmoose.com, flowmoose.com, admin.flowmoose.com, desk.flowmoose.com, the FlowMoose mobile apps, and our API at api.flowmoose.com (together, the "Services").

By using the Services, you agree to this Policy. If you do not agree, please do not use the Services.

1. Who this policy covers

• Customers — people who create a FlowMoose account (in the mobile app) to buy or gift sessions, redeem gift codes, book time slots, and unlock sessions at a business.
• Guests — people who gift a session bundle, or book a time slot, on flowmoose.com without creating an account.
• Operators and their team members — businesses that sell sessions, and the staff who manage them in the operator dashboard (admin.flowmoose.com) or check customers in at the front desk.
• Visitors — anyone who browses our marketing site or contacts us.

Operators are independent businesses. When you book with an Operator, or unlock sessions at its location, that Operator receives certain information about you (see Section 5).

2. Information we collect

Information you provide:

• Account information. Your email address. FlowMoose accounts are passwordless — you sign in with a one-time code sent to your email, and operators also register passkeys. For a passkey we store its public key, a credential identifier, a signature counter, and details describing the authenticator — a name, its type and model, how it connects, and whether it syncs across your devices; the fingerprint, face, or PIN you use to approve it never leaves your device.
• Operator and business information. Business name, website, and logo; the names, physical addresses, and geographic coordinates of your facilities; time zones; your team members' email addresses and roles; the email addresses of people you invite to your team; and the complimentary codes your team issues — the sessions each carries, the team member who issued it, and any note they attached.
• Payment information. When you buy or gift sessions, your card details are entered directly into Stripe's payment interface and processed by Stripe; if you pay with Apple Pay or Google Pay, your wallet shares an encrypted payment token with Stripe — not with FlowMoose. FlowMoose does not receive or store your full card number, CVV, or expiration date. We store payment records — the amount, currency, quantity, and item purchased, plus Stripe identifiers (a Stripe customer ID, a payment ID, and the Operator's Stripe account ID) — to fulfill and track your order. If you gift or book as a guest on flowmoose.com, you enter your email address on FlowMoose's own checkout form — twice, so a typo can't send your purchase to the wrong mailbox. We store that address with the purchase or booking, and we pass it to Stripe as the address for your receipt. It is how your gift code, booking confirmation, and booking-management link reach you, and how that activity can later join an account you create under the same address.
• Operator payout information. To receive payouts, Operators onboard to Stripe Connect. Identity and bank account details for payouts are collected and verified by Stripe directly; FlowMoose stores only a Stripe account identifier and basic status (for example, whether charges and payouts are enabled).
• Booking information. When you book a time slot, we record which slot you booked, how many spots ("party size"), whether you booked in the app or on the web, and the deadline for cancelling free of charge. If you book as a guest, we also record the name and email address you enter. If the booking is cancelled we record when and why — you cancelled, you cancelled after the deadline, the Operator cancelled the slot, or the payment never completed. If you are checked in, we record when, and whether a team member or a registered front-desk device marked you.
• Communications. If you contact us or submit a demo request through business.flowmoose.com, we collect your name, email, optional business name, and any message you send.

Information we collect automatically when you use the Services:

• Transaction and activity data. Records of the sessions you buy, gift, and use, the gift codes you create or redeem (including a complimentary code an Operator issued), and your unlocks at a facility (which facility, when, and whether the unlock succeeded). We also record the businesses and locations you mark as favorites and the first time you visit each business. For Operators, we keep an audit log of the configuration changes their team makes. An entry records the acting team member's email address and, where the change concerns someone else — a role granted or revoked, an invitation sent or withdrawn, an email address changed — that person's email address too, including the old and the new address on a change.
• Terms acceptance and identity records. When you create an account, sign in on the mobile app, or accept updated terms, we record which versions of our terms and this Policy you accepted, when, by what method, and the IP address and browser or app details at the time. Alongside them we keep an identity history for the account: every verified change of your email address, as the old address and the new one, and, when an account is deleted, a closing entry holding the address it was deleted under. These records are permanent and cannot be altered or removed — our database refuses any change or deletion — and we keep them to demonstrate your agreement (see Section 6).
• Location data. With your permission, the mobile app and website use your device's location to show nearby businesses and sort them by distance. Location is accessed when you use the discovery view or pick a location; the mobile app keeps it briefly in memory (about 15 minutes) and does not store a history of your location. Coordinates are sent to our servers only to compute distances. You can deny or revoke this permission at any time; if you do, we simply stop sorting businesses by distance.
• Camera (mobile). A facility's QR code is scanned with your phone's own camera app, which opens a FlowMoose link; the app then checks you in or redeems a session. Some versions of the app read that code with a scanner built into the app instead. When you pay in the app, you can also choose to scan your payment card instead of typing its number; the scan only fills in your card details in Stripe's payment interface, where they are handled exactly as if you had typed them. These are the reasons FlowMoose may appear in your device's camera permissions. In every case, no photo or video is ever recorded, stored, or transmitted.
• Calendar (mobile). When you tap "Add to calendar" on a booking, the app writes that one event to your device's calendar. If you have granted the app full calendar access, it also reads your calendar around that booking's time, for one purpose only: so the same event isn't added twice. Otherwise your phone's own new-event screen opens and you decide whether to save it. The contents of your calendar never reach FlowMoose. The app keeps a short list on your device of the bookings it has already added (see Section 3). You can deny or revoke this permission at any time.
• Device and log data. Your IP address and standard server logs, which we use to operate the Services, prevent abuse, limit excessive requests, and debug problems. Browsers also send us an automatic security report when one of our pages tries to load something our content-security rules don't allow; such a report records the address of the page, what was blocked, and the IP address it came from, and carries no cookies and nothing about your account.
• Email records. For each email we send you, we keep a record of the address it went to, what kind of message it was, the content we sent, and whether it was delivered. We also keep a list of addresses we must stop mailing — an address that unsubscribes, that bounces, that reports our mail as spam, or that is reported through the "I didn't make this booking" link in a booking email (see Section 8).
• Guest activity joined to an account. If you create a FlowMoose account, or change your account's email address, and gifts or bookings were made as a guest under that verified address, those purchases, bookings, and sessions move to your account and we record that the link was made. This happens once per address, and it joins activity previously held under an email address alone to a named account.

Information we do not collect. We do not collect or store full payment card numbers, government-issued IDs, dates of birth, background or continuous location, microphone audio, your photo library, contacts, health, or biometric data. We do not use advertising identifiers (no IDFA/AAID) and do not send SMS or push notifications.

3. Cookies, tracking, and on-device storage

We do not use third-party analytics or advertising technologies. FlowMoose has no Google Analytics, no Meta Pixel, no advertising networks, and no cross-site or cross-app tracking. We do not serve targeted ads, and we do not allow third parties to track you across other sites through our Services.

We use only essential, first-party storage to make the Services work:

• Authentication tokens to keep you signed in (in the operator dashboard and the mobile app).
• Preferences, such as the operator dashboard's sidebar_state cookie (remembers the sidebar open/closed, ~7 days), your selected business, dashboard filters, and light/dark theme.
• On flowmoose.com, the gift codes you create are saved in your browser so you can re-share them.
• On a registered front-desk device (desk.flowmoose.com), the device's connection key and the device, location, and business names are stored in the browser so the kiosk stays signed in, along with the staff's display preferences for the kiosk screen.
• In the mobile app, your email, sign-in state, the business and location you've selected, and that business's locations are stored on your device, as is a short list of the bookings this device has already added to your calendar. A facility you scanned, or a gift link you opened, before signing in is held briefly so that it still works once you do. Login tokens are protected by your device's secure storage (iOS Keychain / Android Keystore).

Emails about a booking carry links that act as keys — to manage a guest booking, to add it to your calendar, to unsubscribe, or to report a booking you didn't make. We store only a scrambled (hashed) form of a guest booking's management key, and we replace that key every time the booking changes. Anyone who has one of these links can use it, so treat a booking email as private.

You can clear this information anytime through your browser or device settings. Because we do not track you across sites, we do not respond to "Do Not Track" signals — there is nothing for them to turn off.

4. How we use information

We use the information above to:

• Provide and operate the Services — create and manage accounts; process purchases and gifts; let recipients redeem gift codes; take, change, and cancel bookings and record check-ins; record facility unlocks; and power business discovery.
• Process payments and Operator payouts through Stripe.
• Communicate with you — send sign-in and verification codes, service notices, and responses to your inquiries; purchase receipts are emailed by Stripe on the Operator's behalf.
• Send email on an Operator's behalf — booking confirmations, changes, and cancellations; gift deliveries; and the Operator's email campaigns to the customers who hold bookings on its schedules (see Section 8).
• Honor email opt-outs — we keep a record of every address that has unsubscribed or that we must stop mailing, so that we go on honoring it.
• Protect the Services — authentication, fraud and abuse prevention, rate limiting, and security monitoring.
• Keep audit logs of an Operator's configuration changes, which support security and give Operators visibility into their team's activity.
• Comply with our legal, tax, and accounting obligations.
• Maintain, troubleshoot, and improve the Services.

5. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share information only as described here:

• Service providers that run the Services on our behalf:
  • Amazon Web Services (AWS) — cloud hosting, database, file storage, and email delivery: every email we send goes out through Amazon SES. Your data is stored and processed in the United States.
  • Stripe — payment processing and Operator payouts (Stripe Connect), governed by Stripe's privacy policy.
  • Google Maps Platform — address lookup/autocomplete in the operator dashboard; the address text an Operator types is sent to Google, governed by Google's privacy policy.
  • Expo — tools we use to build and deliver our mobile apps. When you launch the app, it checks Expo's update servers for the latest app code; Expo receives your IP address and basic app and device details (such as the app version and runtime) to serve the right update, governed by Expo's privacy policy.
  • Apple and Google — the App Store and Google Play distribute our mobile app and receive whatever their own stores collect when you download or update it, governed by their own policies. We do not use an Apple or Google account to sign you in.
• Operators. An Operator and their authorized staff — in the operator dashboard, and on a registered front-desk device at the location — can see, for their own facilities: your bookings, including the slot and how many spots you booked; whether you were checked in, and when; your unlock activity, including which session you used and your remaining balance for that product; if you redeem a complimentary code the Operator issued, that you redeemed it, when, and how many of its sessions you have used; and the email address on your account, or the name and email address you entered if you booked as a guest. A time slot's check-in roster shows each spot's name and email address before anyone arrives, so staff can expect you and check you in. Operators can also send email campaigns through FlowMoose to the customers who hold bookings on their schedules (see Section 8). In FlowMoose's operator dashboard, Operators see aggregate sales and usage analytics for their business, not a purchase-by-purchase list. Separately, each Operator is the merchant of record for your purchase: your payment is processed by Stripe directly on the Operator's own Stripe account, so the Operator can see its individual payments there — including the email on your account, the amount, and your card's brand and last four digits (never your full card number). Operators' use of your information is governed by their own privacy practices.
• Legal and safety. We may disclose information to comply with law, enforce our terms, or protect the rights, property, or safety of FlowMoose, our users, or the public.
• Business transfers. If FlowMoose is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction.

6. Data retention and deletion

We keep personal information for as long as your account is active or as needed to provide the Services. After that, we keep only what we need to meet our legal and tax obligations (for example, transaction and payout records), resolve disputes, and prevent fraud and abuse.

• Account deletion. You can delete your account in the mobile app or the operator dashboard (or by emailing us); you sign in again first, so that nobody else can do it for you. If you are the sole owner of a business, you'll first need to transfer ownership to another owner — otherwise the deletion is refused. Deleting a customer account also cancels your upcoming bookings, and a booking already past its free-cancellation deadline uses up its session, just as a late cancellation would. Deletion does not refund purchases or sessions. For step-by-step instructions, see Delete your account.
• What deletion removes. Your sign-in credentials (including any passkeys) and your account, with its email address; your roles, favorites, and stored Stripe customer links. For a customer account we also clear the name and email address a guest booking carried before it joined your account, the record that joined that guest activity to your account, and the recipient and content of your email records.
• What we keep after deletion. Records we keep for legal and financial recordkeeping survive deletion: transaction and payout records, which, for a purchase you made as a guest, keep the email address you gave at checkout; your terms-acceptance and identity records (Section 2), which keep the email addresses they were created under and which our database will not let us change or delete; your email opt-outs and suppressions, which we keep precisely so that an opt-out goes on being honored; and, for Operators and their team members, audit and administrative records of the changes they made (see "Audit logs" below), the approving operator's email address and last-seen time on a registered front-desk device, and the email campaigns they sent, on which their address is replaced with "Deleted operator."
• Operator/business deletion. Deleting a business removes its facilities, products, team roles, and related records. A business can be deleted from the dashboard only while every one of its locations and products is still a draft and no Stripe account has been connected to it; once a business has gone live it cannot be deleted there — email privacy@flowmoose.com.
• Refunds, disputes, and withdrawn codes. We record each refund an Operator issues and each card dispute raised against a purchase, together with its outcome, and each complimentary code an Operator issues or withdraws. A full refund, or a dispute the Operator loses, also revokes that purchase's unused sessions, cancels any bookings holding them, and voids an unredeemed gift code from that purchase; withdrawing a redeemed complimentary code revokes its unused sessions and cancels any bookings holding them the same way.
• Automatic expiration. Purchased sessions expire according to the validity period the Operator sets for that product, which may be a fixed number of days or no expiration. The period is fixed when the purchase is made — a gift's clock starts when the gift is bought, not when it is redeemed. Temporary data we keep to prevent abuse expires automatically, and database backups are retained for about 7 days. Security audit logs may be kept longer.
• Audit logs. To keep the Services secure and maintain accurate records, our audit logs retain the email addresses described in Section 2. We keep this information for security and recordkeeping, and it is not removed by in-app account deletion; to request erasure from our audit logs, email privacy@flowmoose.com and we will handle it through a manual review.

7. Security

We protect information with encryption in transit (HTTPS/TLS) and at rest in our database, passwordless sign-in (one-time email codes and passkeys) with no passwords to steal or reuse, card processing handled by Stripe (a PCI-DSS Level 1 provider), device login tokens stored in your operating system's secure keystore, access controls, and rate limiting. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security.

8. Your choices and rights

• Access and update. You can view and update your email address, manage your passkeys (operators), and update your business details, in the mobile app or the operator dashboard.
• Delete. You can delete your account as described in Section 6.
• Device permissions. You can grant or revoke camera, location, and calendar permissions at any time in your device settings.
• Email. Service messages — sign-in codes, booking confirmations, changes and cancellations, gift deliveries, and security notices — are part of the Services, carry no unsubscribe link, and are sent whether or not you have unsubscribed; purchase receipts are emailed by Stripe on the Operator's behalf. Operator campaigns are email an Operator sends through FlowMoose to the customers who hold bookings on its schedules; they may carry schedule news and offers, and they go out from a FlowMoose address (Amazon SES) on that Operator's behalf. Every campaign carries a footer that FlowMoose writes and the Operator cannot edit, naming the business and its address and carrying an unsubscribe link. That link is the control: one click stops campaign email to your address from every business on FlowMoose. We also stop mailing an address that bounces, that reports our mail as spam, or that is reported through the "I didn't make this booking" link in a booking email. We keep these opt-out records even after an account is deleted, so that the opt-out goes on being honored. FlowMoose sends no marketing email of its own, and we never sell or rent your address.

To make a request, email privacy@flowmoose.com or call (608) 960-9380. We may need to verify your request using the email associated with your account.

9. California privacy rights (CCPA/CPRA)

If you are a California resident, you have rights regarding your personal information.

Categories we collect (in the last 12 months): identifiers (such as name, email, account and Stripe identifiers, and IP address); commercial information (purchase, booking, and usage records); geolocation (precise location, only with your permission); internet/electronic activity (how you use the Services); and, for Operators, professional or business information. We collect this information from you directly and automatically as you use the Services, for the business purposes described in Section 4, and we disclose it to the service providers listed in Section 5 and, as described there, to the Operators you buy from, book with, and unlock with.

We do not sell or share personal information for monetary value or for cross-context behavioral advertising, and we do not knowingly do so for consumers under 16.

Your rights: to know/access the personal information we hold, to delete it, to correct it, and to not receive discriminatory treatment for exercising these rights. (Because we do not sell or share personal information or use sensitive personal information to infer characteristics, the rights to opt out of sale/sharing and to limit the use of sensitive information do not apply.)

To exercise these rights, email privacy@flowmoose.com or call (608) 960-9380. We will verify your request through your account email, and you may use an authorized agent.

10. Children's privacy

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact us at privacy@flowmoose.com and we will delete it.

11. International users

FlowMoose is operated from, and stores and processes data in, the United States. If you access the Services from outside the United States, you understand that your information will be processed in the United States, where data protection laws may differ from those in your location.

12. Third-party links and services

The Services may link to third-party sites and services (for example, Operator websites, Stripe, and Google). We are not responsible for their privacy practices; their own policies govern your use of them.

13. Changes to this policy

We may update this Policy from time to time. When we do, we will revise the "Effective date" above and, for material changes, provide a more prominent notice. Your continued use of the Services after an update means you accept the revised Policy.

14. Contact us

FlowMoose, Inc.
Email: privacy@flowmoose.com
Phone: (608) 960-9380