Privacy policy

Draft document, pending legal review.

Last updated: October 17, 2026

1. Who is responsible

Flubyx is a business intelligence platform operated by Goenlace SAC (RUC 20613495925), with address at Calle Dona Cecilia 119, Peru ("Flubyx", "we"). For any question about your personal data, write to us at [email protected].

This policy explains which personal data we process when you use the Flubyx website, application and Complaints Book, why we use it, who we share it with, how long we keep it and how you can exercise your rights, in accordance with Peru's Personal Data Protection Law No. 29733 and its Regulation.

2. Data we process

User account: name, email, password (stored only as an irreversible Argon2id hash; nobody can read it), language, time zone and, if you enable two-step verification, your authenticator app secret (encrypted) and your recovery codes (stored as hashes).
Company (account): company name, what you will use Flubyx for, company size, country, time zone and team members with their role (owner, administrator, editor or viewer), including pending invitations.
Billing: receipt type, name or company name, DNI or RUC, address, city, country, phone, email for receipts and payment history. Cards are processed by our payment gateway (Culqi): we only store the brand and the last 4 digits, never the full number or the security code.
Usage and security: technical logs (date, IP address, browser, page, response times and errors), an audit log of important actions (sign-ins, team changes, payments, settings) and platform usage metrics. In public forms the IP is stored as a hash, not in plain text.
Support: the message you send us, the page you were on, your browser and, if you attach it, a screenshot.
Contact: name, email, company, phone and message from the contact form.
Complaints Book: the data on the complaint form (name, ID document, address, phone, email, parent or guardian details if you are a minor), the details of your claim or complaint and our reply.
Cookies and browser storage: as described in our Cookie policy.

3. Data from the databases you connect

Flubyx connects to the databases your company authorizes in order to generate KPIs, reports and dashboards.

What we store: the details of each connection (server, port, database, user and password, the latter encrypted), the structure you choose (tables, fields, relationships and estimated row counts), the approved data model, dashboards and their settings.
What we do NOT store: your business records. They are queried on demand, always in read-only mode; results are kept only in a temporary encrypted cache for a few minutes to avoid repeating the same query, and then deleted. Technical query logs do not include the queried values.
Public links: if you create a public link to a dashboard, anyone with the link will see those results while the link is valid. Deciding what to share is your company's responsibility.

Regarding any personal data that may exist in your databases, Flubyx acts as a data processor on behalf of your company, which owns the database and is responsible for having a legal basis for its processing.

4. Artificial intelligence

We use artificial intelligence providers to propose the data model and to turn written questions into queries:

To propose the model we send the structure of the tables you choose (table and field names, types and relationships), never the records.
For "Ask the AI" we send your question and the list of KPIs and dimensions of the approved model, not the data. The AI returns a structure that we validate; it never writes or runs queries on your database.
You can use your own provider key (in that case your company deals directly with the provider) or the Flubyx key. We log the number of tokens, the cost and the outcome of each use, never the content.

Providers may include OpenAI and Anthropic (United States), Google (United States) and DeepSeek (China); only those enabled on the platform or configured by you are used. Each provider handles information under its own terms.

5. Why we use your data

To provide the service you subscribe to: creating and managing your account and team, connecting your databases, showing KPIs, charging the subscription, sending receipts and service emails (verification, invitations, payment notices) and providing support. Basis: performance of the contract.
To comply with legal obligations: invoicing and tax obligations, handling the Complaints Book and requests from authorities. Basis: legal obligation.
To protect the platform: preventing fraud, abuse and unauthorized access (for example, with attempt limits and Cloudflare Turnstile) and keeping audit logs. Basis: legitimate interest.
To measure website usage with Google Analytics, only if you accept it in the cookie notice. Basis: your consent, which you can withdraw at any time.

We do not sell your data or use it for third-party advertising.

6. Who we share data with

Only with providers that help us deliver the service (processors), with appropriate safeguards and for the stated purposes:

Infrastructure and hosting for the server and the encrypted backups.
Culqi: card payment processing.
Email provider (SMTP): sending service emails.
Cloudflare: bot protection on forms (Turnstile) and network security.
Google Analytics: visit statistics, only with your consent.
Artificial intelligence providers: as described in section 4.

We may also disclose data to authorities when a law or an order requires it.

7. International transfers

Some of the providers above are located outside Peru (for example, in the United States or China). When you use Flubyx, your data may be transferred to those countries, only for the purposes described and to providers offering adequate levels of protection or contractual safeguards, in accordance with Peruvian law.

8. How long we keep data

Account and company: while the account is active and, afterwards, only as long as needed to meet legal obligations or handle claims.
Billing and payments: for the period required by tax and accounting rules.
Complaints Book: at least two (2) years from the date of the form, as required by consumer protection rules.
Support screenshots: deleted 15 days after the case is closed.
Technical metrics: 7 days; query log (without values): 90 days.
Query result cache: a few minutes (10 by default).
Backups: encrypted; the 14 most recent are kept and replaced automatically.
Invitations: expire after 7 days; the "Keep me signed in" option, after 30 days.

9. How we protect data

Encrypted connection (HTTPS); authenticated encryption of connection passwords, AI keys, secrets and backups; passwords stored with Argon2id; optional two-step verification; role-based permissions and isolation between companies; read-only connections to your databases, only to authorized public servers; attempt limits; and technical logs without sensitive data. No measure is infallible, but we continuously review and improve these protections.

10. Your rights

You can exercise your rights of access, rectification, cancellation (erasure) and objection, as well as any other rights recognized by law, by writing to [email protected] with your name, a copy of your ID document and the right you wish to exercise. We will reply within the legal deadlines. You can update your name, language, time zone and password directly in "My profile".

If you believe we did not handle your request properly, you can file a complaint with Peru's National Personal Data Protection Authority (Ministry of Justice and Human Rights).

11. Minors

Flubyx is a service for businesses and is not intended for people under 18. If you are a minor and wish to file a claim, you can do so in the Complaints Book with the details of your parent or guardian.

12. Changes to this policy

We may update this policy to reflect changes in the service or the law. We will publish the new version with its date and, if the changes are significant, we will notify you on the platform or by email.

Contact: [email protected]