Status: Public transparency notice. Review with counsel before treating as final.
Effective date: 26 July 2026 Last updated: 31 October 2026
FluxeHRa is a registered brand of Foil Envie SAS, a société par actions simplifiée (SAS) registered in France (“we”, “us”, “Provider”).
This Privacy Policy explains how we process personal data when you visit our public website (including /, /trust, /privacy, and related pages) and when you use the FluxeHRa SaaS application (the “Service”).
For a contractual Data Processing Agreement (DPA) between FluxeHRa and a customer organization, see /legal/dpa.md and our Trust Center.
Contact for privacy questions: contact@fluxehra.ai
| Item | Detail |
|---|---|
| Controller / Provider | Foil Envie SAS (brand: FluxeHRa) |
| Contact | contact@fluxehra.ai |
| Product | FluxeHRa — multi-tenant HRIS / people platform |
If we appoint a Data Protection Officer (DPO), contact details will be published here and on the Trust Center.
This Policy covers:
It applies regardless of language UI (English, French, Spanish, German, etc.).
We typically act as controller for:
For HR and employee personal data stored in a customer organization’s FluxeHRa tenant (employee records, documents, performance content, etc.), the customer organization is the controller. FluxeHRa processes that data on the customer’s documented instructions under a DPA.
If you are an employee using FluxeHRa for your employer:
Depending on how you use the site, we may process:
| Data | Examples | Source |
|---|---|---|
| Contact form | First name, last name, email, message title and body | You |
| Technical | IP address, browser type, request metadata (standard hosting/security logs) | Your device / our hosts |
| Preferences | Selected marketing language (localStorage) |
Your browser |
| Security challenge | Cloudflare Turnstile token/outcome when Turnstile is enabled | Cloudflare / your browser |
| Performance analytics | Aggregated page performance / vitals (Vercel Analytics / Speed Insights) | Runtime (aggregated) |
| Data | Examples | Source |
|---|---|---|
| Account identity | Email, role, organization membership | You / your organization / IdP |
| Session | Supabase Auth session cookies (sb-* / auth-token cookies) |
Auth service |
| Browser session aids | sessionStorage keys (e.g. browser-session lock; proxy overlay state) |
Your browser |
| Audit / security | Access and action audit events as configured | System |
| Support | Bug reports (page URL, description, optional stack, org context) | You |
| Documents | Files uploaded to Storage under your organization’s tenant | You / your organization |
| HR domain data | Employee master data, events, performance, learning, etc. | Customer (we process as processor) |
SSO (OIDC/SAML) users: your identity provider shares identity claims (typically email and related identifiers) with FluxeHRa to create or match your session. We do not receive your IdP password.
We process personal data to:
| Purpose | Typical legal basis (GDPR) |
|---|---|
| Operate and secure the website and Service | Legitimate interests / contract |
| Respond to contact-form messages | Legitimate interests / pre-contract |
| Authenticate users and maintain sessions | Contract / legitimate interests |
| Provide the HRIS to customers (processor activities) | Contract (DPA) with customer; customer’s legal bases apply to data subjects |
| Prevent abuse (e.g. Turnstile when enabled) | Legitimate interests / security |
| Improve reliability (aggregated analytics/vitals) | Legitimate interests |
| Comply with law and defend legal claims | Legal obligation / legitimate interests |
When you sign in, FluxeHRa uses Supabase Auth cookies (names typically starting with sb- or containing auth-token) to keep your session across requests. These are essential for signed-in use of the Service.
Closing all browser tabs may require you to sign in again due to an additional browser-session lock stored in sessionStorage (not an HTTP cookie).
Marketing language preference may be stored in localStorage (marketing-locale / related keys). This is not an HTTP cookie.
When enabled by platform or organization configuration, a challenge may load from Cloudflare. That may involve third-party cookies or similar storage on Cloudflare’s domain for the challenge. It is used to reduce bots and account enumeration—not for advertising.
Surfaces that may use Turnstile: SU Admin /login, organization sign-in pages, optional employee data-request flows, and e-sign self-serve signup (/esign → /api/public/esign-signup). Production signup fails closed if platform Turnstile is required but not configured.
The application may load Vercel Analytics and Speed Insights for aggregated performance and usage insights. These are intended to be privacy-oriented and not classic advertising trackers; they still constitute third-party telemetry. See also our sub-processors list.
The homepage cookie notice explains essential session cookies. Accepting dismisses the notice for that visit; refusing clears cookies visible to JavaScript on our host and signs you out of Supabase if signed in. The notice does not itself set a long-lived “consent” cookie.
For full transparency, see this Policy and the Trust Center.
Production hosting and core sub-processors (as of the date of this Policy):
eu-west-1, Ireland)dub1, Dublin)Optional / configuration-dependent: Cloudflare Turnstile, Vercel Analytics / Speed Insights, Sentry (if configured), DocuSign (customer-configured), customer SMTP, customer IdP, customer export endpoints. Native Fluxehra e-signature (SES) uses the same FluxeHRa hosting stack and is not a separate sub-processor.
Full list: /legal/subprocessors.md · Trust Center
| Context | Retention approach |
|---|---|
| Contact messages | Retained as needed to handle your request and related follow-up, then deleted or archived according to our internal retention practices |
| Auth sessions | Until logout, cookie expiry, or browser-session controls revoke local session |
| Customer HR data | Controlled by the customer’s configuration and instructions (retention matrix / purge tools where enabled); we do not independently decide HR retention |
| Audit / security logs | Retained as needed for security, accountability, and legal obligations |
| Bug reports | Retained as needed to investigate and improve the Service |
Primary production processing for the core platform is designed in the European Union (Supabase Ireland; Vercel Dublin).
If optional tools or customer-configured integrations process data outside the EEA/UK, appropriate transfer safeguards (e.g. SCCs) are addressed in the DPA / customer configuration and the sub-processors note.
Under applicable law (including the GDPR where it applies), you may have rights to:
HR data in a customer tenant: please contact your employer (controller) first. We support customers under the DPA.
Website contact data / our controller processing: contact contact@fluxehra.ai.
We may need to verify your identity before fulfilling a request.
We apply technical and organizational measures appropriate to the risk (access control, encryption in transit, tenant isolation via RLS, audit capabilities, EU hosting for core services). Details for due diligence are published in the Trust Center (security white paper, ISO alignment pack, AIPD/DPIA support materials).
No method of transmission or storage is 100% secure; we continuously improve controls.
FluxeHRa is a business/HR platform and is not directed at children. We do not knowingly collect personal data from children through the marketing site or Service.
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may also be highlighted on the Trust Center or by notice to customers.
Privacy and data-protection inquiries: contact@fluxehra.ai
Trust Center: /trust DPA templates: /legal/dpa.md Sub-processors: /legal/subprocessors.md Terms of Use: /legal/terms-of-use.md
This document is a transparency notice. It does not replace the DPA between FluxeHRa and a customer, nor an employer’s own employee privacy notice.