Privacy Policy

1. What This Policy Covers

This Privacy Policy explains what information Floozy Opportunity AI ("we," "us") collects, how we use it, and who we share it with. It applies to your use of the Floozy Opportunity AI web application.

2. Information We Collect

• Account information — your email address and authentication details, managed via our authentication provider (Supabase).
• Business profile — your business name, pitch, and contact details you choose to provide, used to personalize AI-generated outreach.
• Connected platform sessions — when you connect Facebook, LinkedIn, Nextdoor, or another platform, you log in directly on that platform. Your login session for that platform is stored locally, tied to your account, and used only to monitor the community groups you've chosen. We do not receive or store your password for that platform.
• Collected public post content — text, author name, and public profile links from posts in the community groups you choose to monitor, collected only from content that platform already shows to your own logged-in account — never anything behind a wall your account cannot already see.
• Payment information — subscription payments are processed by Stripe. We do not receive or store your full card number.
• Usage data — actions you take in the app (scans run, drafts generated, credits used), used for billing, product improvement, and support.

3. How We Use Information

• To operate the Service — monitoring groups, scoring posts, generating outreach drafts.
• To process payments and manage your subscription and usage credits.
• To provide customer support and respond to your requests.
• To improve the Service, including diagnosing bugs and reliability issues.
• To comply with legal obligations.

4. Third Parties We Share Data With

We use the following third-party services to operate the Service. Each processes data on our behalf, under their own terms:

• Google Gemini API — evaluates collected post text and generates outreach drafts.
• Supabase — hosts our database and handles authentication.
• Vercel — hosts the application.
• Stripe — processes subscription payments.
• GoHighLevel (optional) — if you enable CRM dispatch in Settings, qualified lead details are sent to your connected GoHighLevel account.

We do not sell your personal information to anyone.

5. Data Retention

We retain your account and business data for as long as your account is active. Collected post data and opportunities are retained until you delete them or they are removed by an automated cleanup you configure. You can request deletion of your account and associated data at any time.

6. Data Security

Your data is isolated at the database level — every table enforces row-level security scoped to your account, so no other customer can read it through the application. Data is encrypted in transit. Sensitive credentials (API keys, service tokens) are never exposed to the browser.

Two exceptions, stated plainly. First, our own staff can access account data where it is necessary to operate the service — for support, billing, debugging, or to meet a legal obligation. Second, if you have turned on the Shared Opportunity Pool, the opportunities your agents find are readable by us and by the limited number of accounts we have authorised. See section 7.

7. The Shared Opportunity Pool (optional)

The Shared Opportunity Pool is off unless you switch it on, and you can switch it off at any time in Settings. Nothing here applies to you while it is off.

While it is on, the opportunities your agents find are added to a shared pool that we, and a small number of accounts we have specifically authorised, can read. Those accounts may include businesses we work with directly, and they may contact the people in those opportunities. In practice this means a business other than yours may act on an opportunity your agent found, including a business that competes with you. That is the trade: a larger pool covers more communities than your own account can reach on its own.

Turning the pool off stops your future opportunities being shared immediately. It does not retract opportunities already viewed or acted on, because we cannot recall a message someone has already sent. If you want previously pooled opportunities deleted, contact us and we will remove them.

Every read of pooled data is logged with the account that performed it and the time. We do not sell pooled data.

8. Your Rights

You may access, correct, or request deletion of your personal information at any time by contacting us. If you are located in a jurisdiction with additional statutory privacy rights (such as the EU/UK GDPR or Canada's PIPEDA), those rights apply to you in addition to what's described here.

9. Cookies

We use essential cookies to keep you signed in. We do not use third-party advertising or tracking cookies.

10. Children's Privacy

The Service is intended for business use by adults and is not directed at children under 18.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to active subscribers before they take effect.