Privacy Policy

Who we are

Flux AIO is a Wyoming LLC that provides sealed Pokémon product sourcing for independent card shops, with a per-order fee invoiced only for confirmed orders.

Flux AIO LLC operates hireflux.org from California, United States. For privacy questions or requests, contact support@hireflux.org.

This policy covers our public website, client portal and service operations. Retailers and payment, identity or communication providers also have their own policies.

Information we handle

• Account and contact information: your name, email, Google sign-in identifier, account status and contact preferences; a phone number if you provide one.
• Service information: business, financial and fulfillment information you submit to authorize sourcing requests, addresses, product selections, quantities and your acceptance of published prices.
• Orders and billing: retailer emails and order information, confirmations, cancellations, tracking, retail amounts and taxes, invoices, Flux fees, payment status and disputes.
• Service and security information: sessions, authentication and recovery information, consent records, operator audit events, request timestamps, IP addresses and browser/device information available to us or our providers.
• Communications: messages you send to support and retailer messages forwarded or collected for order reconciliation.

Only provide information you are authorized to use for your shop's requests. This policy describes information categories and purposes rather than internal technical procedures.

How we use information

We use information to create and secure accounts; carry out sourcing requests you authorize; match retailer messages to orders; apply confirmation holds; reconcile prices and taxes; calculate accepted Flux fees; invoice and collect payments; provide support; detect fraud and misuse; and meet legal, accounting and dispute obligations.

Drop-reminder and billing-reminder SMS choices are separate. You can change them in Settings. Service, security and legally required communications may still be necessary. Where applicable law requires consent for a purpose, we must obtain it; otherwise processing may be necessary for the service, legal obligations or legitimate operational and security interests.

Who receives information

We limit sharing to what is needed for the service, your instructions or applicable law. Providers include:

• Google and Clerk: sign-in, identity and authentication. Google Privacy Policy; Clerk Privacy Policy.
• Stripe: Flux fee billing, receipts, fraud prevention and disputes. Stripe Privacy Policy.
• Replit and its infrastructure providers: website and API hosting, application database and encrypted file storage. Replit Privacy Policy.
• Retailers and authorized service personnel: information needed to carry out sourcing, delivery and order reconciliation you request.
• Email, mailbox and messaging providers: support correspondence, forwarded retailer emails and reminders you request. The provider depends on the mailbox or communication channel in use.

We may disclose information to professional advisers, to comply with law, to protect rights or safety, or in a business transfer subject to applicable safeguards. We do not operate advertising pixels or sell personal information or share it for cross-context behavioral advertising through this site's current setup.

Security and retention

We use access restrictions and security safeguards appropriate to the service. No system is risk-free. Please do not send sensitive financial information to the support mailbox.

We retain service information as needed for its purpose, account operation, dispute resolution and legal obligations. Account metadata, order history, invoices, consent and audit records can have different retention needs. Deletion requests do not necessarily erase records that must be retained for those purposes or remove provider backups immediately. Contact us about the records associated with your shop.

Cookies and browser storage

The public marketing pages do not load our sign-in or payment SDKs and do not add analytics or advertising trackers. The signed-in service uses authentication and security cookies, payment/fraud-prevention technology and browser storage for preferences and navigation. See Cookies & storage for the current inventory and controls.

Your choices and privacy requests

You can update profile information, manage addresses and cards, and change reminder preferences in the portal. Contact support@hireflux.org to request access, correction, a copy, deletion or closure, or to raise a privacy concern. We may need to verify your identity without requesting full payment details. Some records must be retained for legal, security, accounting or dispute reasons.

Depending on your location and applicable law, you may also have rights to restrict or object to processing, withdraw consent, appeal a decision, complain to a regulator, or opt out of sale or sharing. We do not assume every privacy law applies to every request; we assess and respond under the law that applies, without unlawful discrimination. Our current setup does not use cross-context advertising to opt out of, including when a browser sends Global Privacy Control.

Location and intended users

The service is intended for independent card-shop owners and managers able to authorize business transactions, not children. Contact us if you believe a child has supplied personal information. Our providers may process information in the United States or other countries. Applicable legal protections and transfer requirements still apply; provider locations and terms should be reviewed before sending information subject to special restrictions.

Policy changes and contact

We will update the date above when this policy changes and provide any additional notice or choice required by law for material changes. For privacy or service questions, use support@hireflux.org. See also our Terms of Service.