At Flux, we value your privacy and are committed to safeguarding the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and protect your information when you visit our website, use our services, or interact with us as a shopper or vendor partner.

Flux is operated by FLUXAI GROUP HOLDINGS LTD ("Flux", "we", "us"), the data controller responsible for your information. We are registered with the UK Information Commissioner's Office (ICO) under registration reference ZC173568. For any privacy query, contact us at privacy@withflux.co.uk .

1. Information We Collect

From shoppers:

• Negotiation activity: the conversations that take place through the Flux widget on vendor product pages, including offers made and deals agreed.

• Negotiation session identifier – a random ID we generate to link the rounds of a single negotiation together. It is not derived from your identity and carries no personal information on its own.

• Discount codes generated through successful negotiations.

• Basic usage data such as IP address, device type, browser, and the time and date of your interaction.

• Device and security signals, including a device fingerprint and the referring page. Because Flux involves discounts and real money, we use these signals to recognise repeat sessions and to detect and prevent fraud, abuse, and attempts to game or manipulate negotiations – protecting both vendors and genuine shoppers.

• Email address – voluntarily provided when a deal is agreed, used solely to (a) deliver your discount code, and (b) where you sign in with Flux ID, link your deals across sessions so they can be honoured together at checkout. We do not use your email for marketing and we do not sell it. You'll only get marketing emails from us if you separately subscribe to our newsletter.

• Account identifiers where you choose to sign in with Flux ID, including via a third-party sign-in provider – limited to what is needed to recognise you across sessions.

• Order information including order number, products purchased, and transaction value, received via Shopify webhook when a shopper completes a purchase using a Flux discount code.

From AI shopping assistants (e.g. ChatGPT). Where you negotiate through an AI assistant, Flux operates as a connected app. We receive only what is needed to price a deal: the store domain, the product name or handle, its listed price, the price you are offering, the currency, a negotiation session identifier, the round number, and – if you have signed in – your Flux ID.

We return to the assistant: the outcome (a quote or a decline), a quote identifier, the negotiated and listed prices, the currency, an expiry time, the product name, the product page link, the merchant's public product image, a plain-language message, the session identifier, a suggested next step, and an optional invitation to sign in to a Flux ID. That invitation is a link carrying the session identifier and the deal being saved (store, product, prices and product image) so the sign-in page can show you what you are claiming. When a deal is committed we additionally return a redemption link. Product searches return public catalogue listings: store name, storefront URL, product name, category, price and product image.

If you need to sign in to continue, we return a single-use sign-in link and its associated sign-in token to the assistant so it can pass the link to you. These are short-lived, are used only to complete sign-in, and grant no access to your account on their own.

What we never return to the assistant: your discount code (released only after you click the redemption link), your email address, your IP address, your device signals, and the merchant's confidential pricing rules.

Product images are also sent to the assistant as embedded copies so the result card can display them without contacting the merchant's servers.

From vendor partners:

• Business information: store name, website domain, contact name, and work email address provided during the application process.

• Pricing rules: floor prices, maximum discount limits, product names, and negotiation preferences you set for your store. This information is stored securely and is never shared with shoppers.

• Platform and traffic information provided during onboarding.

• Campaign details including start and end dates where applicable.

From all users: Usage data (pages viewed, time spent) and cookies / similar technologies used to enhance your experience and understand how our site is used.

From newsletter subscribers: The email address you enter in the sign-up form on our website, and a record of when you subscribed.

2. How We Use Your Information

We use the information we collect to:

• Operate the Flux negotiation widget and deliver conversations between shoppers (or the AI agents acting for them) and vendor stores. To do this, conversation content is processed by trusted third-party AI model providers that power the negotiation.

• Generate and validate unique discount codes when deals are agreed.

• Manage vendor partner accounts, pricing rules, and campaign settings, and review vendor applications.

• Detect, prevent, and investigate fraud, abuse, and attempts to game or manipulate negotiations, and otherwise keep the service and our vendors' pricing secure.

• Analyse usage to improve the performance and quality of our service.

• Measure how well our advertising works, where you have consented to marketing cookies on our website.

• Communicate with vendor partners about their account, setup, and service updates.

• Send discount codes to shoppers who request email delivery, and track completed orders where a Flux code was used, for commission calculation.

• Send our newsletter (product updates, negotiation insights and playbooks, at most once a month) to people who subscribe. Every email includes an unsubscribe link.

• Comply with legal obligations and enforce our terms and policies.

• Operate Flux as a connected app inside third-party AI assistants, so you can negotiate without leaving the conversation.

• We do not use your conversations to train AI models, and our AI model providers do not use them to train theirs. Content is sent to them only to generate a response in the moment. They may keep limited, time-bounded logs to detect abuse of their own services — see section 6.
  
  

Negotiation is AI-assisted, but we do not make decisions that produce legal or similarly significant effects about you solely by automated means without a route to human review.

Legal bases. Where UK/EU data protection law applies, we rely on: performance of a contract (delivering deals and codes you request); our legitimate interests (operating, securing, and improving the service, and preventing fraud and abuse); consent (our newsletter and, where required, certain cookies; you can withdraw consent at any time, for example by unsubscribing); and compliance with legal obligations.

3. Sharing of Your Information

We do not sell your personal data. We share information only with trusted parties that help us operate Flux, under appropriate confidentiality and data-processing terms, including:

• Hosting and database infrastructure (e.g. our cloud hosting and database providers).

• AI model providers that process negotiation content to generate responses.

• Payment and billing providers used to collect commission and process transactions.

• Email delivery providers used to send discount codes, account communications and our newsletter.

• Authentication providers where you choose to sign in.

• E-commerce platform providers (e.g. Shopify) that supply order data and mint discount codes.

• Bot and abuse protection providers. We use Cloudflare Turnstile to tell real shoppers from automated traffic. When a check runs, Cloudflare receives your IP address, browser user-agent, TLS fingerprint, and the identifier of the page you are on. Cloudflare processes these on our behalf to detect bots, and separately uses them for its own purpose of improving its bot-detection systems. See the Cloudflare Turnstile Privacy Addendum.

• Advertising and measurement partners, on our website only and only where you have consented to marketing cookies. See section 9.

A current list of our sub-processors is available on request at privacy@withflux.co.uk . We may also disclose information for legal compliance, or in connection with a merger, acquisition, or sale of assets (subject to the same privacy commitments).

Vendor stores can see the negotiations that took place on their own store – the conversation itself, the offers made, and whether a deal was agreed. They do not receive your name, your email address, or your Flux ID account details. Because the store can read the conversation, please don’t type personal details into the chat that you wouldn’t want them to see.

4. Vendor Pricing Rules – Confidentiality

Vendor pricing rules – floor prices, maximum discounts, and negotiation style – are strictly confidential commercial information. They are stored securely, never displayed to shoppers, and never shared with third parties outside the operation of the Flux service.

5. International Data Transfers

The database holding negotiation records is hosted in the EU, in Stockholm. Some of our processing takes place outside the UK and EEA: our serverless hosting currently runs in the United States, our bot protection operates across a global network, and our email delivery and AI model providers are US-based. Our database provider contracts through a Singapore entity.

Where personal data leaves the UK, we rely on one of two safeguards. For providers covered by the UK’s adequacy regulations — including the UK Extension to the EU–US Data Privacy Framework, where that provider is certified under it — we rely on those regulations. For everyone else, we rely on the European Commission’s standard contractual clauses together with the UK Addendum to those clauses, issued by the Information Commissioner. We keep a record of which mechanism applies to each provider and will share it on request at privacy@withflux.co.uk.

6. Data Retention

We keep personal data only as long as we need it. Negotiation records that did not result in a deal are stripped of IP address, device signals and chat content after 90 days. Where a deal was agreed, those fields are removed after 12 months, and only non-identifying deal economics are kept. Expired sign-in tokens are deleted within 30 days. Order and commission records are kept for 6 years to meet UK accounting requirements. If you subscribe to our newsletter, we keep your email address until you unsubscribe; after that we keep it only on a suppression list, so we don't email you again. You can request deletion at any time.

The periods above describe our own systems. Our providers keep their own limited records: our AI model providers do not retain negotiation content by default, but may keep time-bounded logs to detect abuse of their services, and where a provider’s automated safety systems flag a session it may be retained for longer — up to two years in one provider’s case. Our email delivery provider retains the content of emails we send you, including your discount code, for 30 days.

7. Data Security

We implement appropriate technical and organisational measures to protect your information. All data is transmitted over encrypted connections. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

You have the right to access, correct, delete, or port your data; to object to or restrict certain processing; and, where processing is based on consent, to withdraw it at any time. If you are in the UK, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk, where our registration (reference ZC173568) can also be verified on the public register. To exercise any of these rights, email privacy@withflux.co.uk with the email address or discount code linked to your deal or newsletter subscription. We respond within one month.

9. Cookies

We use strictly necessary cookies and similar storage and, only with your consent, marketing cookies. Strictly necessary: when you claim a deal we set a scoped flux_deal cookie so the store recognises your agreed price rather than reopening the negotiation; we use browser local storage to keep your negotiation state on a product page; and on our website withflux.co.uk we store your cookie choice so we do not ask again on every visit.

Marketing cookies (withflux.co.uk only, off by default): if you click Accept on our cookie banner, we enable the Meta Pixel, provided by Meta Platforms. It sets cookies such as _fbp and shares page views, button clicks and device and browser information with Meta so we can measure how well our advertising works. Meta may combine this with other information it holds about you and may process it outside the UK; see Meta's privacy policy for details. If you click Reject, or make no choice, the pixel sends nothing to Meta.

For the collection of this information on our website and its transmission to Meta, Flux and Meta Platforms, Inc. act as joint controllers under Article 26 UK GDPR, under the terms of Meta’s UK Controller Addendum. In practice: we are responsible for telling you about it and for obtaining your consent before the pixel loads; Meta is responsible for what it does with the data once transmitted, which it does for its own purposes and which falls outside the joint arrangement. You can exercise your data protection rights against either of us, and you can contact us at privacy@withflux.co.uk to do so.

You can withdraw your consent at any time by clearing this site's cookies and site data in your browser, after which the banner will ask again, or by emailing privacy@withflux.co.uk.

10. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for their privacy practices and encourage you to review the privacy policies of any external sites you visit.

11. Children's Privacy

Flux does not knowingly collect personal information from individuals under the age of 13. If we become aware that such data has been provided, we will delete it promptly.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with the effective date clearly stated. Continued use of our services after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us

FLUXAI GROUP HOLDINGS LTD, privacy@withflux.co.uk

ICO registration reference: ZC173568