Signed version: Privacy Notice (PDF)

Privacy Notice

Last updated: 6 August 2025

This Privacy Notice explains how Flux Search Ltd. (“Flux,” “we,” “us,” or “our”) collects, uses, discloses and safeguards personal data in connection with our website at https://fluxsearch.io, our search and AI features, and our developer APIs, together with related content, tools and services that link to this Notice (collectively, the “Services”). It also describes your rights under the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, and how to contact us or the Information Commissioner’s Office (ICO).

If you do not agree with this Notice, please do not access or use the Services.

1) Who we are; role under data protection law

• Controller. For personal data we process in connection with the Services, Flux Search Ltd. is the data controller.
• Company Number (Companies House): 16629567
• Nature of Business (SIC): 62012 - Business and domestic software development; 63120 - Web portals
• Registered office: Dryden Enterprise Centre, Dryden Street, Nottingham, Nottinghamshire NG1 4FQ, United Kingdom
• Email: hello@fluxsearch.io | Tel: +44 7366 995440

For business customers: where we process personal data on your documented instructions (e.g., via our APIs) we act as a processor and will enter into a Data Processing Agreement (DPA). If this Notice conflicts with a DPA regarding processing on your behalf, the DPA prevails.

2) Personal data we collect

(A) Data you provide directly

• Account and profile data (e.g., name, email).
• Billing and transaction data (processed via our payment processor).
• Communications with us (support requests, feedback).
• User Input (prompts, queries, instructions, uploaded files).
• Preferences (marketing consents, opt-outs).

You are not required to provide data; however, some features may not function without it.

(B) Data collected automatically

• Device and technical data (IP address, device identifiers, browser type, OS, language).
• Usage and diagnostic data (pages viewed, timestamps, referring URLs, feature usage, crash/error logs).
• Approximate location (inferred from IP).

We use cookies and similar technologies (see Section 10 and our Cookie Notice).

(C) Data from the public web and third parties

• Search indexing: We index and process information publicly available on the web to provide search results and related features.
• Third-party sources (e.g., sign-in via Google), where you authorise this.

3) How and why we use personal data (legal bases)

We process personal data only where a lawful basis applies:

• Contract (UK GDPR Art. 6(1)(b)): to provide, administer and support the Services; create and manage accounts; process payments; deliver customer support.
• Legitimate interests (Art. 6(1)(f)): to operate and secure the Services; prevent abuse; perform analytics; improve relevance and quality of search and AI features; index publicly available content; measure and improve performance; send non-marketing service communications. We conduct and record legitimate-interest assessments where required.
• Consent (Art. 6(1)(a)): for direct marketing emails/SMS where required by PECR, for certain cookies/telemetry, and for any processing where we specifically seek your consent. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): to comply with law, court orders, regulatory requests, tax/accounting rules.
• Vital interests/Public task: only if applicable in a given scenario.

AI model improvement. We may use User Input and Output to develop and improve the Services (e.g., to enhance model quality and safety). Opt-out: where your plan or agreement permits, you may request exclusion from model/feature improvement by contacting hello@fluxsearch.io. This does not affect processing necessary to provide the Services.

High-risk uses. You must not rely on the Services to make solely automated decisions producing legal or similarly significant effects on individuals unless you implement safeguards required by UK GDPR (e.g., meaningful human review).

4) Search-specific transparency

• Indexing sources. We index information that is publicly available. We respect standard publisher controls such as robots.txt and meta directives where technically feasible.
• Delisting/erasure requests. If you are the data subject, you may request delisting of search results that reference your personal data by emailing hello@fluxsearch.io with enough detail to identify the result(s). We assess requests under UK GDPR Article 17 and will respond within one month (or explain any permitted extension), applying the required balancing test. Appeal routes are available.
• We cannot delete content from third-party websites. For removal at source, contact the website owner/host directly.

5) Marketing communications (PECR)

We send service/transactional emails (e.g., account notices). We send direct marketing by email or SMS only with your consent or as otherwise permitted by PECR (e.g., soft opt-in). You can opt out at any time (unsubscribe link or replying STOP). We keep records of consent and preference changes.

6) Disclosure of personal data

We may disclose personal data to:

• Service providers/processors (e.g., hosting, payment processing, security, support, analytics) under contract and confidentiality.
• Affiliates (for administration, support, and product improvement) under this Notice.
• Publishers/rights-holders (when you submit a complaint or delisting request, we may share relevant information to assess or action your request).
• Law enforcement/regulators (where required by law or to protect rights, safety and security).
• Professional advisers and insurers.
• Business transferees (in connection with a merger, acquisition, financing or sale of assets).
• Others with your direction or consent.

We do not sell personal data. If we engage in interest-based advertising in future, we will update this Notice and provide choices.

7) International transfers

Your personal data may be transferred to and processed in countries outside the UK. Where we do so, we rely on:

• a UK adequacy regulation (where available), or
• appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, plus additional measures where appropriate.

You can request details of relevant transfer safeguards at hello@fluxsearch.io.

8) Data retention

We retain personal data only for as long as necessary for the purposes set out in this Notice (e.g., account life cycle, legal/financial record-keeping, security and dispute resolution), and then delete or anonymise it unless we must keep it longer (e.g., to comply with law, enforce rights, or resolve claims). High-level examples:

• Account data: retained while your account is active, then for a reasonable period for record-keeping/dispute resolution.
• Logs/telemetry: retained for short operational periods unless required longer for security/abuse investigations.
• Payment records: retained per tax/accounting rules. We maintain internal retention schedules and review periods.

9) Security

We implement technical and organisational measures appropriate to risk, including access controls, encryption in transit (and at rest where applicable), key management and regular monitoring. No internet-based service is 100% secure; please keep credentials/API keys safe and notify us promptly of suspected compromise.

10) Cookies, analytics and “Do Not Track”

We use cookies and similar technologies for essential functions, analytics, and (where enabled) preferences/marketing. Where required, we seek consent via our cookie banner. You can change preferences in your browser and via our banner/settings (where provided). We currently do not respond to browser-initiated Do Not Track signals.

(See our Cookie Notice for details of categories, purposes and third-party providers.)

11) Your rights (UK GDPR)

Subject to conditions and exemptions, you have the right to:

• Access your personal data and receive a copy;
• Rectify inaccurate or incomplete data;
• Erase data (right to be forgotten);
• Restrict processing;
• Data portability (where technically feasible and lawful);
• Object to processing based on legitimate interests, including profiling, and to direct marketing at any time;
• Not be subject to a solely automated decision with legal or similarly significant effects, unless permitted by law with safeguards;
• Withdraw consent where processing relies on consent.

We may request information to verify your identity and will respond within one month (extendable by two months for complex requests, with notice). To exercise rights, contact hello@fluxsearch.io.

You also have the right to lodge a complaint with the ICO: ico.org.uk | Tel: 0303 123 1113.

We encourage you to contact us first so we can try to resolve your concern.

(If you are in the EEA and we target or monitor you there, we may appoint an EU representative; details will be provided in an updated Notice if/when applicable.)

12) Children’s data

The Services are intended for individuals 18+. We do not knowingly collect personal data from children. If you believe a child has provided personal data, please contact us so we can take appropriate action.

13) Changes to this Notice

We may update this Notice to reflect changes in our processing or the law. We will post the updated version with a new “Last updated” date and, where appropriate, provide additional notice. Your continued use of the Services after an update constitutes acknowledgement of the revised Notice.

14) Contact us

Flux Search Ltd.
Dryden Enterprise Centre, Dryden Street, Nottingham, Nottinghamshire NG1 4FQ, United Kingdom
Email: hello@fluxsearch.io | Tel: +44 7366 995440

For security/privacy requests, please include sufficient information to identify your account and the scope of your request.

Annex: summary of purposes and legal bases (indicative)