Privacy policy

The controller of the data collected on this website and through the tool described in section 9 is Flloat’s, Lda., with registered office at Rua do Picoto, 193, 4415-613 Crestuma, Portugal, trading as Flloat’s. The company registration details are in the Portuguese version.

For any question about your data, write to privacy@flloats.net.

We only collect the data you give us and what any web server logs:

• Contact form: name, email, company, phone, service of interest and your message. Company, phone and service are optional.
• Newsletter: email and, if you provide it, your name.
• Emails and calls: what you send or tell us when you contact us directly.
• Server logs: IP address, date and time, requested page and browser type, as on any website.

To know how many people visit the website and which pages they read, we use Cloudflare Web Analytics: it counts visits without cookies, without identifying visitors and without usage profiles. We do not use advertising.

• To answer your request and prepare a proposal, where applicable. Legal basis: pre-contractual steps at your request (Article 6(1)(b) GDPR).
• To send the newsletter. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time.
• To protect the website against abuse and attacks, using server logs. Legal basis: legitimate interest in security (Article 6(1)(f)).
• To comply with legal obligations, such as tax obligations, when there is a business relationship. Legal basis: legal obligation (Article 6(1)(c)).

We do not sell or share your data for third-party marketing, and we do not make automated decisions about you.

• Contact requests: up to 3 years after the last contact, unless you become a client; in that case the contract and legal retention periods apply.
• Newsletter: while you are subscribed. When you unsubscribe, we stop emailing you.
• Server logs: up to 14 days. Security alerts derived from them are kept for up to 90 days.
• Backups: up to 35 days, encrypted.

We use these providers, all under a data processing agreement under Article 28 GDPR:

• Hetzner Online (Germany and Finland): hosting of the website and servers.
• DigitalOcean (Frankfurt data centre, Germany): database.
• Microsoft (Microsoft 365): company email.
• Resend (United States): newsletter and automated emails.

Data is hosted in the European Union, except security logs (for example, the IP address of website visitors), which our SOC analyses in London, United Kingdom, a country with an EU adequacy decision. Sending email through Resend involves a transfer to the United States, under the EU-US Data Privacy Framework or standard contractual clauses approved by the European Commission.

The website only works over an encrypted connection (HTTPS). Access to data is limited to those who need it, with strong authentication, and our systems are monitored by our SOC. Backups are encrypted.

You can ask us, at any time and free of charge, for:

• access to the data we hold about you and a copy of it;
• correction of inaccurate or incomplete data;
• erasure of your data;
• restriction of or objection to processing, including processing based on legitimate interest;
• portability of the data you gave us;
• withdrawal of consent, without affecting what was done before.

Write to privacy@flloats.net. We reply within one month. To unsubscribe from the newsletter, use the link in every email.

If you believe your data was not handled properly, you can complain to the Portuguese data protection authority, CNPD (cnpd.pt).

This website does not use cookies. Details are in the cookie policy (in Portuguese).

To publish our own content to the TikTok accounts of Flloat’s brands (for example @flloats_ and the Flloat’s Academy account), we use an internal scheduling tool (Postiz, installed and run by us at postiz.santoscore.com), connected to TikTok through TikTok’s official API (Login Kit and Content Posting API). The tool is not open to the public: only our team can sign in, and it only connects our own brand accounts. It does not access client accounts or anyone else’s account.

Only after we authorise the connection on TikTok’s own consent screen, the tool receives, from our own accounts only:

• Profile: the account identifier (open ID), display name, profile picture, username, profile link, bio and verification status.
• Account statistics: followers, following, likes and video count.
• Videos: the list of the account’s public videos, with each video’s statistics.
• Access: the access tokens TikTok issues for the connection.
• What we publish: the video or photos, caption and post settings (who can view, comments, Duet, Stitch and commercial content disclosure).

Why: to publish, or send to the TikTok app inbox, the content we have approved; to show in the tool which account each post goes to; and to measure how our own posts perform. We do not use this data for advertising, we do not sell or share it with third parties, and we do not collect data about other TikTok users. Legal basis: Flloat’s legitimate interest in managing its own social media accounts (Article 6(1)(f) GDPR).

Where and for how long: the data is stored on our Hetzner server in Finland (European Union). Profile data, statistics and tokens are kept while the account is connected; when we disconnect it, we delete the tokens and profile data within 30 days. Metrics of our own posts are kept in our marketing history for up to 3 years. Backups are deleted after 35 days.

How to revoke access: in the TikTok app, go to Settings and privacy → Security and permissions → App and services permissions, choose the app and remove access (menu names may vary with the app version). The token stops working immediately. You can also disconnect the account in the tool itself, or ask us to delete the data at privacy@flloats.net.

What happens to content and data inside TikTok is governed by TikTok’s privacy policy.

If we change this policy, we publish the new version here with the update date. If the change is significant and we have your email, we will let you know.