What this siteWhat this site collects, and why.collects, and why.

02 Who holds it

One company,One company, run by its founders.run by its founders.

• ControllerFluxaro LLC, a limited liability company registered in Connecticut, United States, for everything this website collects.
• Postal address11 Marlborough Rd., Norwalk, CT 06851, United States. Data protection correspondence can be sent here or to the address below.
• Contactadmin@fluxaro.tech reaches both founders directly: Mike Kvashchuk, who builds, and Lorenzo (Enzo) Zullo, who runs research, proposals and billing. There is no privacy inbox between you and them.
• Who this is forVisitors to this site, people who write to us, and the procurement, legal and compliance teams at firms deciding whether to engage us.
• Last updated10 October 2026. Material changes are posted here with a revised date, and active clients are told directly.

03 Two roles

Two roles,Two roles, kept apart.kept apart.

Privacy law treats the business that decides why data is collected differently from the business that handles it for someone else. We are in both positions, so we say which one applies where.

• On this websiteFluxaro decides what is collected here and why, so Fluxaro is the controller: the Connecticut Data Privacy Act's term for a person who, alone or jointly with others, determines the purpose and means of processing personal data. Sections 04 to 07 describe this role.
• In what we buildWhen a site or system we build collects data for your firm, your firm decides what is collected and why, and we handle it on your instructions. In the Connecticut Act's terms that makes us a processor, a person who processes personal data on behalf of a controller. California's term is a service provider: a person that processes personal information on behalf of a business under a written contract that limits what it may do with that information. Other state laws use similar terms.
• Your notice, not oursVisitors to a site we build for you are your visitors. Your firm's privacy notice speaks to them and is your firm's to approve. The scope records where their data is hosted, who can reach it and which providers process it, which that notice will need.
• Staying a processorThe Connecticut Act treats the role as a question of fact: a processor that starts deciding the purposes of processing becomes a controller for it. We keep to your written instructions and do not use data in a build for our own purposes.
• Which law appliesWhich state and federal rules govern your firm's data is a question for your counsel. This page describes what we do. It is not legal advice.

04 What is collected

What you give us,What you give us, and what the server sees.and what the server sees.

Sent by you:

• Quote requestName, work email, company, sector and the brief you write, when you send a quote request from these pages, together with any services you ticked on the services page. It arrives as email and is not written to a database.
• Guides waitlistYour email address and, if you pick one, what you do (for example procurement or compliance). It arrives as email and is not written to a database.
• If the form cannot sendWhen the site cannot deliver a request itself, it offers to open your own email app with the request written out to admin@fluxaro.tech, plus buttons that copy the address or the message. Nothing leaves until you press Send in your own app, and it then travels through your email provider, not ours.
• PaymentsClient invoicing runs through Stripe. Card details go to Stripe directly, are never stored by us and never reach our servers. No payment form runs on this site.
• CorrespondenceEmail you send us, including any request for proposal, security questionnaire or vendor form, kept with the enquiry it belongs to. Please send no confidential material before a mutual non-disclosure agreement is in place; one is signed on request.
• Nothing sensitiveThe forms ask for nothing sensitive and a brief needs nothing sensitive. Keep health information, account or card numbers, government identifiers and privileged material out of a form and out of a first email.
• Retired demo sitesUntil 10 October 2026, demonstration sites under /demo/ on this domain, sent to businesses as QR codes, recorded which demo was opened, the business it was made for, the page that linked to it and the browser's user-agent string, and stored what was sent through a demo's enquiry form: name, email, phone number, business and message. Those sites are retired and their old links now lead to this site's home page. The records already collected remain in our database (Supabase) until they are deleted, and you can ask us to delete yours.
• Dashboard sign-inAccounts on the dashboard at /login sign in with an email address and password, handled by Supabase. Signing in sets strictly necessary cookies that hold the session and nothing else.

Collected automatically:

• AnalyticsOur own counter, written for this site. No Google Analytics, no Umami, no third-party analytics product of any kind. On these pages, nothing about your visit leaves our own server.
• What it recordsThree fields per page view: the path you opened, with any query string removed; the hostname of the site that linked you, never the full address of the linking page; and which of four width bands your window falls in. Each view is one line in the hosting platform's log, stamped with the time it was written. There is no analytics database. That is the whole record.
• What it does not recordNo cookie, no device fingerprint, no user-agent string, no identifier of any kind, and the counter never writes down your IP address. Because nothing identifies the browser, two page views cannot be joined into a visit, which means we cannot tell you how many unique visitors we get, and we would rather lose the number than build the tracking that produces it.
• The one thing stored in your browserIf you tick items on the services page, that list is kept in your tab's session storage so it survives you reading something else before asking for a quote. It is not a cookie, it identifies nobody, it is never sent anywhere except inside an enquiry you choose to send, and closing the tab deletes it.
• Your IP addressVercel, which hosts the site, sees your IP address as any web server must in order to answer the request. Our own code reads it in one place: the endpoint behind the quote and waitlist forms counts recent sends per address, in the memory of the running function, to slow a flood of automated sends. We never write it to a log, file or database, and we do not pass it on. What Vercel itself records about requests, and for how long, is set by Vercel, not by us.
• The audit toolThe address you type into the free audit is fetched once by our server and then discarded. It is not written to a database, and no email is required to use it.
• Touch effectsOn phones, the water ripple under your finger and the motion as you scroll are drawn on your own device. They collect nothing and send nothing, and with a reduced-motion setting they do not run at all.

05 Email from us

One receipt,One receipt, then a person.then a person.

Sending a form on this site can send you exactly one automatic email, and only for a quote request.

• The receiptWhen a quote request reaches us, the address you gave receives one email from Fluxaro <site@fluxaro.tech> with the subject “We received your request”. It says the request reached both founders, that one of us will reply to you personally, and that you can reply to it to add anything. Replies to it go to admin@fluxaro.tech.
• Fixed wordingThe receipt does not repeat your brief or anything else you typed. It greets you by first name only when the name field reads as a name, and otherwise says hello. Fixed wording also means nobody can use our form to send their own words from our domain to someone else.
• When there is noneThe receipt is sent only from our own domain and only after the request itself has reached us. If the request had to travel another way, or the receipt fails, nothing is retried, and the founders' reply is your confirmation.
• Guides waitlistNo receipt. The waitlist promises one email, when the first guide is published, and nothing else.
• Everything afterReplies come from the founders at admin@fluxaro.tech. No newsletter, no automated sequence, no follow-up drip.

06 What it is used for

Six uses,Six uses, and no seventh.and no seventh.

• To replyTo confirm a quote request arrived, answer it, and talk to you about the work.
• To deliverTo build, maintain and improve what you engaged us to build.
• To send what you asked forGuides or resources you signed up for, which today means the one email the waitlist promises. You can unsubscribe at any time.
• Service noticesUpdates about work in progress. Never unsolicited marketing.
• Demo follow-upTo see which mailed demos were opened, and to reply to an enquiry sent from one.
• Legal obligationsWhere the law requires it.

07 Sharing and retention

Who elseWho else ever sees it.ever sees it.

• Service providersHosting, email, database and payments, under confidentiality, and only as far as they need it to run.
• Legal authoritiesIf required by law.
• Nobody elseNo data brokers, no advertising networks, no resale.
• Named sub-processorsFive, in full. Vercel (United States) serves the pages and runs the serverless functions: the free audit, our own page counter and the one that delivers an enquiry. Resend (United States) carries enquiry emails and the quote receipt, so it sees what you typed into a form and the address the receipt goes to; it is not loaded by these pages and sees nothing about a visit that does not send one. Google's mail service hosts the admin@fluxaro.tech mailbox, so every enquiry and every email you send us is held there. Supabase holds the dashboard accounts and the records kept from the retired demo sites. Stripe (United States) invoices clients and is not loaded by this site at all. There is no third-party analytics and no advertising network.
• RetentionFor as long as there is an active relationship, and a reasonable period after it for legal and accounting purposes. You can ask for deletion at any time.
• CookiesNone on these pages, from us or from anyone else, so nothing here asks for cookie consent. The dashboard sets only the strictly necessary sign-in cookies.

08 When we build for you

Client data,Client data, on your instructions.on your instructions.

For procurement, legal and compliance teams: how data inside a site or system we build for your firm is handled. The specifics for your engagement are written into the signed scope.

• InstructionsData a build stores for your firm is processed only on your instructions, for the purposes in the scope, and not for ours.
• Written firstWhere it is hosted, who can reach it and which providers process it are written into the scope before work begins. Like any change to the work, a change to them is quoted before it is built.
• ProvidersThe providers named in the scope are the ones used. Adding or changing a provider that would process your firm's data is put to you in writing first.
• AccessAccess is limited to the people and providers the scope names.
• ConfidentialityMutual. A mutual non-disclosure agreement is signed on request before confidential material is shared, and what you share is used only to deliver the work.
• Your materialsLogos, trademarks, photos, documents and data your firm supplied stay your firm's. You license them to us only to deliver the service.
• Requests from peopleIf someone asks your firm for their data and it sits in a system we run for you, we help you find, correct, export or delete it.
• Incident termsNotice periods for security incidents differ by sector and regulator. If your firm needs a specific notice term from its vendors, raise it before the scope is signed so it can be agreed in writing. This page promises no notice period.
• Your paperworkSend your firm's vendor or security questionnaire with the request for proposal and it comes back answered in the format you sent, with what is in place on the day. If your firm requires its own data processing addendum, send that too, so its terms are settled before the scope is signed.
• At the endWhen the service ends, the site goes offline. Personal data your customers submitted through the website is returned to your firm or deleted, at your choice, subject to any retention the law requires. The materials and data your firm supplied stay yours, and you receive the deliverables your signed agreement entitles you to. The site's code, designs and frameworks, and Fluxaro's other intellectual property, remain Fluxaro's unless a signed agreement expressly states otherwise, and no copy of them is handed over. The domain is transferred to you on request, and you pay any registrar or transfer fee that requires. The terms set this out in full.

09 By sector

Where your rulesWhere your rules are stricter than ours.are stricter than ours.

The firms we build for carry obligations of their own. These notes say where we meet them and where the decision stays with you. They are not legal advice.

• Medical and dental groupsFluxaro does not handle protected health information and does not sign business associate agreements. HIPAA lets a business associate, and its own subcontractors down the chain, create, receive, maintain or transmit protected health information for a covered entity only under satisfactory assurances documented in writing, and Fluxaro gives none. So forms on a site we build for a practice must not collect symptoms, diagnoses, treatment details or any other protected health information. Where a practice needs that information, it uses an appropriate third-party system it contracts with directly, and the site can link to it. Whether anything else a form collects is protected health information is the practice's call. Fluxaro holds no HIPAA attestation.
• Financial firmsRules made under the Gramm-Leach-Bliley Act require financial institutions to oversee their service providers: under the FTC's Safeguards Rule, by choosing providers capable of appropriate safeguards, requiring those safeguards by contract and assessing providers periodically. Regulation S-P, as amended by the SEC in 2024, requires broker-dealers, funding portals, investment companies, SEC-registered investment advisers and registered transfer agents to have policies requiring their service providers to report a breach of a customer information system the provider maintains within 72 hours of becoming aware of it. Larger firms have had to comply since 3 December 2025, smaller ones since 3 June 2026. Customer account information does not enter a build unless the scope says so, and any of these terms your firm needs in writing are raised before the scope is signed.
• Law firmsABA Formal Opinion 10-457 (2010) tells lawyers to expect that a website inquiry may come from a prospective client, whose information Model Rule 1.18 protects, and that warnings or disclaimers limit this only when they are reasonably understandable, properly placed and not misleading. What your form asks, the warning beside it and where enquiries go are your firm's decisions, approved before launch. We do not need privileged material to build a site and none should be sent to us; where a system must hold client matter information, that is scoped and covered by the mutual non-disclosure agreement first.
• Pharmaceutical and life sciencesA contact or medical information form on a product site can receive a report of a side effect. For an approved drug, FDA rules require the application holder to promptly review adverse drug experience information it receives from any source, and to report each one that is both serious and unexpected within 15 calendar days of first receiving it. Which rules apply to your products is your safety team's call. Fluxaro does not triage, assess or answer these messages. Before launch your firm decides where such messages go and approves the form's wording, and the build sends them to the team you name. If one ever reaches us by mistake, it is forwarded to your named contact without review.
• Manufacturing and professional servicesDrawings, specifications, pricing, client lists and engagement details are confidential material: share them after the mutual non-disclosure agreement is signed, and only what the build needs. If any of it carries handling rules of its own, such as export controls or a client's confidentiality terms, say so in the scope before anything is sent.

10 Security

What the code does,What the code does, and what we do not claim.and what we do not claim.

Described from the code that runs this site today, not from a certificate.

• In transitPages and forms are served over encrypted connections, with Vercel handling the encryption.
• KeysThe email provider's key lives in the server's environment and never in a page. Provider error messages, which can carry account detail, are logged for us and never shown to a visitor.
• Response headersThese pages send a content security policy that allows scripts and connections only from this site and refuses to let another site frame them, along with headers that stop content-type guessing, trim the referrer sent to other sites, and switch off camera, microphone and location access.
• FormsThe form endpoint refuses requests a browser sends from another site, quietly drops submissions caught by a hidden field, caps the length of every field, and slows repeated sends from one address. That last brake works per running instance, so it limits a flood rather than guaranteeing a ceiling.
• The audit toolIt refuses private and internal network addresses and re-checks every redirect it follows, so it cannot be turned into a probe of the network it runs on.
• Stored dataThe counter has no database, so there is no store of visits to leak. Enquiries from these pages go to the founders' inbox, not a database. Demo-site records are written by the server with a key that never appears in a page.
• AttestationsNone. Fluxaro holds no SOC 2, ISO 27001, HIPAA or GxP attestation. If your procurement process needs one, say so before the scope is signed.

11 Where and who

Where it goes,Where it goes, and who it is for.and who it is for.

• WhereFluxaro is in the United States, and Vercel, Resend and Stripe are United States companies. A request enters Vercel's network at the nearest of its points of presence, which span many countries, and is decrypted in the nearest Vercel region, so a visitor abroad may be served outside the United States. Vercel runs functions in Washington, D.C. by default, and this site's configuration file sets no other region. Where Supabase stores data and where Google holds the mailbox are not stated, because neither has been verified.
• Outside the United StatesIf you write to us from another country, what you send is handled by Fluxaro in the United States, using the providers named on this page, under United States law. Where the law of the place you live gives you rights over your data, write to us and the request is answered on the same terms as any other.
• ChildrenThis site and our services are for businesses. They are not directed to children under 13, the age the federal children's privacy rule uses, and we do not knowingly collect information from them. If you believe a child has sent us something, write to us and it is deleted.