What we collect, and why
Floviz collects the minimum needed to sell you a file, deliver it, and keep the catalog from being drained. There is no advertising network here, no data broker, and nothing sold on. This page describes what is actually in the database.
Last updated: July 27, 2026
Who is responsible
The data controller is Floviz. Headquarters: São Paulo, SP, Brazil. For any question about your data, or to exercise the rights described below, write to hello@floviz.live and a person will answer — within 48 hours, often faster.
This policy covers floviz.live and the Floviz marketplace application, and sits alongside the terms of service. It does not cover third-party sites an asset preview might link out to. Material changes to this policy are announced at least 14 days before they take effect.
- Account
Email, display name, avatar, role
Held in your profile record so you can sign in, so we can address you, and so the site knows whether you are a buyer or an administrator. Authentication is handled by Supabase; passwords are hashed by Supabase and are never visible to us.
- Orders
Purchase records and asset snapshots
For each purchase we store the amount, currency, status, the email used, Stripe checkout session and payment intent references, and a snapshot of the asset title, slug, version, license type, file size, and price at the moment of sale. The snapshot exists so your receipt stays accurate even if the listing changes later.
- Payment
A Stripe customer reference — never card details
Card numbers, expiry dates, and security codes are entered on Stripe's hosted checkout. They never reach Floviz servers and we cannot retrieve them. We keep a Stripe customer ID against your profile so repeat purchases do not create duplicate customer records.
- Downloads
IP address, user agent, asset version, timestamp
Every download is logged with the asset and version retrieved, the account or order it belongs to, the originating IP address, the browser user agent, and the time. This is how license terms are enforced and how bulk extraction is detected. It is the most sensitive thing we hold and it is not used for advertising or profiling.
- Guest access
Email and a hashed access token
If you buy without an account we store the email you supplied and a SHA-256 hash of your access token — not the token itself. The token in your email is the only copy. It expires 365 days after purchase.
Delivery records for the mail we send you
Receipts, download links, and guest access links are sent through Resend. We keep a record that a message was sent, to which address, and whether it was delivered, so a missing receipt can be traced. We do not use open or click tracking.
Why we hold it
To perform the contract. Account, order, entitlement, and delivery records exist because you asked us to sell you a file and give you continuing access to it. Without them there is no library and no re-download.
For our legitimate interests. Download logs, including IP and user agent, exist to enforce license terms, detect credential sharing and bulk extraction, and keep a small catalog viable. They are reviewed only when something looks wrong.
To meet legal obligations. Transaction records are retained for tax and accounting purposes under Brazilian law.
We do not build behavioural profiles, we do not run third-party advertising trackers, and we do not sell or rent personal data to anyone, ever.
No tracking
There are no analytics on this site. No third-party analytics service, no advertising cookies, no tracking pixels, no fingerprinting, no session recording, no cross-site tracking.
We do not know which pages you looked at before you bought something. We know what you bought, because we had to sell it to you, and we know what you downloaded, because licenses have to be enforceable. That is the whole of it.
There is no AI feature on Floviz and no AI processor in the list below. Nothing you do here trains a model — ours or anyone else's.
- Supabase
- PurposeDatabase, authentication, file storage
- Data sharedAll platform data
- LocationUS
- Stripe
- PurposePayment processing
- Data sharedBilling data
- LocationUS
- Resend
- PurposeTransactional email
- Data sharedEmail addresses, order metadata
- LocationUS
- Vercel
- PurposeHosting and delivery
- Data sharedRequest logs, IP addresses
- LocationUS / Global CDN
These are the only third parties that process your data on our behalf, each limited to the purpose listed. All third-party processors are bound by data processing agreements and comply with GDPR, LGPD, and applicable US law.
For users in the European Economic Area and the UK, transfers to the United States are made under the European Commission's Standard Contractual Clauses, as provided for by Article 46 of the GDPR, together with the additional safeguards each processor publishes.
- Supabase auth session
- What it doesKeeps you signed in and ties your library to your account
- Set byFloviz / Supabase
- CSRF and security tokens
- What it doesProtects form submissions and checkout from cross-site request forgery
- Set byFloviz
- Stripe checkout cookies
- What it doesCarries a payment session through Stripe's hosted checkout and screens fraud
- Set byStripe, on Stripe's pages
That is the complete list. Every cookie here is strictly necessary to sign you in or to take a payment, so there is no consent banner on this site and none is required. Blocking them will break sign-in and checkout. There are no advertising cookies and no tracking pixels to opt out of.
How long we keep it
- account data
- while your account is open
- order records
- 5 years (legal and tax obligation)
- download logs
- 12 months
- server / request logs
- 30 days
- guest access tokens
- 365 days from purchase
- email delivery records
- 12 months
Order records survive account deletion because tax law requires it. Download logs run longer than server logs because they are the evidence in a refund or license dispute.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete what we are not legally required to keep, ask for it in a portable format, or object to processing based on legitimate interests.
These rights come from the GDPR if you are in the EU or UK, from the LGPD in Brazil, and from state privacy law in the US. We apply the same standard to everyone rather than sorting people by passport.
If you are unhappy with how we handled a request you may complain to your supervisory authority: your local data protection authority in the EU, the ANPD in Brazil, or your state Attorney General in the US.
Making a request
Write to hello@floviz.live with the subject line "Privacy Request", from the address on the account where you can. Say which right you are exercising; you do not need to cite an article number.
We respond within 15 business days. Where a request is complex we will say so, and say how much longer it will take, rather than letting the clock run out quietly.
We may need to verify your identity before releasing or deleting data — usually by confirming control of the account email or an order reference. That step protects you, not us.
Security
Asset files are held in private storage. They are never served from a public URL. A download produces a signed link valid for 60 seconds, issued only after an entitlement check, and downloads are capped at 10 per account per hour.
Database access is governed by row-level security, so one account cannot read another's orders, entitlements, or download history.
Guest access tokens are stored only as SHA-256 hashes, so a database copy alone does not yield a working download link.
No system is perfect. If you find a vulnerability, report it to hello@floviz.live before disclosing it publicly and we will work with you.
If a breach affects your personal data we notify the relevant supervisory authority within 72 hours of becoming aware of it, as GDPR Article 33 requires, and we notify you directly without undue delay where the risk to you is high. The escalation runs to your local data protection authority if you are in the EU, to the ANPD in Brazil, and to the relevant state Attorney General in the US. You get the facts we have, when we have them.
If you want to know exactly what we hold on you, ask. Write to hello@floviz.live and you will get a straight answer.