Privacy
Where your data actually sits.
This page is meant to be readable by the person who has to sign off on it, not only by a lawyer. If something here is unclear, that is a bug and we would like to hear about it.
| What | Where | How |
|---|---|---|
| Submission contents | Supabase, eu-west-3 (Paris) | Encrypted disk, isolated per account |
| Account email | Supabase, eu-west-3 (Paris) | Used for login links only |
| Site analytics | Umami, self-hosted in the EU | No cookies, no visitor IDs |
| Notification emails | EU sending region | Contains no submission data |
Nothing leaves the EU
Storage, processing and email sending all happen inside the EU. We do not use a US processor for any part of the submission path, so there is no transfer to assess and no standard contractual clauses to file.
Contents are never emailed
A notification says a submission arrived. It carries no name, no address and no message body. This is a design decision, not a setting, so there is no way for anyone to switch it off by accident.
You can delete anything, at any time
Individual submissions, a whole form, or your entire account. Deleting removes the rows rather than hiding them, and deleting a form takes every submission it received with it.
Who we are
Flora is run by Serendipiware Ltd, company no. 17232380, registered in England & Wales. For anything involving personal data, write to hello@flora.sh .
Placeholder text pending legal review. Do not publish as written.