1. Who we are and how to reach us
flo.space is a product of Pickr Wholesale LLC, a New York limited liability company ("Company," "we," "us," or "our"). This Privacy Policy explains how the Company handles personal information in connection with the flo.space marketing website (the "Site"). It covers information we receive through the Site and, where noted, information we will collect when the flo.space product and paid accounts go live.
You can contact us about privacy at hello@flo.space, or by post at Pickr Wholesale LLC, 2405 Avenue T, Brooklyn, NY 11229.
- Where we operate. flo.space is offered to businesses in the United States.
- Scope. This policy applies to the flo.space application (covered in the section immediately below) and to the Site, including the early-access signup form at flo.space/signup, which is covered by Section 3a below. It does not apply to any other third-party website or service that links to or from the Site.
The flo.space Application
When you create a flo.space account and connect your tools, we access and store the following, only with your permission through each provider's official sign in:
- Gmail: we read your messages to prepare action cards, and we create drafts and replies for your review. Email leaves your account only when you approve it. Nothing is ever sent automatically.
- Google Drive and Google Sheets: read only access, used to open files and sheets that arrive as links in your email.
- QuickBooks: read only access to your accounting data to prepare actions.
- Your account email address, used to identify your connection.
How we use this information: message and file content is processed by AI models (Google's Gemini API) to classify incoming items and prepare drafts for your approval. We store your connection credentials, the actions flo prepares, the decisions you make, and the business facts flo learns for your workspace so it improves for you over time. Our AI provider processes your content under terms that do not permit using it to train their models, and we never use your data to train AI models ourselves.
What we never do: we do not sell your personal information. We do not share your data with data brokers or advertisers. No action prepared by flo.space is executed without a human approving it.
flo.space's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Data deletion: email hello@flo.space from your account email and we will delete your workspace data and confirm within 30 days, except where we are legally required to retain something.
Retention: we keep your workspace data while your account is active. Data is encrypted in transit.
The sections that follow cover the flo.space marketing website.
2. Categories of personal information we collect
The Site itself is a marketing brochure with no application backend: it has no account system, takes no payments, and stores nothing about you. The information we actually receive comes from two places: the contact form and the early-access signup form. Using the categories defined by California law (CCPA/CPRA):
| Category | Examples on this Site | Do we receive it? |
|---|---|---|
| Identifiers | Full name and work email from the contact form; first and last name, company name, company address, work email and phone number from the early-access signup form. | Contact form: only if you send it (see Section 3b). Signup form: yes, when you submit it (see Section 3a). |
| Commercial information | The industry you select for your company on the early-access signup form. | Yes, from the signup form. |
| Financial information | Payment card or bank details. | No. No payment processor is connected and we accept no payment before launch. We never ask for card details. |
| Internet / network activity | Your IP address and browser user-agent, transmitted to Google when — and only when — you have accepted the consent banner and the Site loads its webfonts. | Google receives it; we do not log it ourselves. |
| Professional / employment information | Your company name, company address, team size, and the industry your company operates in. | Contact form: only what you choose to tell us. Signup form: company name, company address and industry are required to submit it. |
| Account credentials | Passwords. | No. There is no account system, so there is nothing to log in to and no password to collect. |
We do not intentionally collect special-category or "sensitive" personal information (such as health, race, religion, precise geolocation, or government identifiers). Please do not include such information in free-text fields like the contact-form message.
3. Where the information comes from
- The contact form. Described in Section 3b. Submitting it sends your message to us directly.
- The early-access signup form. Described in full immediately below. It is a page on this Site, not a separate service.
- Automatically, to our font host. If you accept the consent banner, your browser fetches webfonts from Google, and that request includes your IP address and user-agent. If you decline, no such request is made. See Section 5 and our Cookie Policy.
3a. The early-access signup form
Every "Get early access" and "Join early access" button on this Site opens our signup form at flo.space/signup. The form is a page on this Site. Submitting it does not send you to another company's website.
What we collect there: your first and last name, your company name, your company address (street, city, state, ZIP or postal code, and country), your work email address, your phone number with its country calling code, and the industry you select for your company. All of these are required to submit the form, as is ticking the box confirming you agree to this Policy and to our Terms of Service; we record that agreement and its exact wording with your submission. If you tick the separate, optional consent box for calls and texts, we also record that consent, the exact wording you agreed to, the date and time, and the IP address the submission came from. Those last four exist so we can evidence that you gave permission before we ever call or text you; we record them only when you tick the box, and not otherwise.
Address suggestions. As you type in the street address field, what you have typed is sent to our own server, which asks an address-lookup service for matching addresses and returns them to you. That service is the Google Places API, or the Photon service operated by komoot GmbH over OpenStreetMap data where Google is not configured. Either way your browser never contacts them, so they receive the address text and our server's network address, not yours, and set no cookie on your device. No other field on the form is sent. The lookup is a convenience only: you can ignore the suggestions and type every address field yourself, and the form works identically if you do.
Why: to assess whether flo.space is a good fit for your business, to prepare setup recommendations for you, and to contact you about early access and about our public launch. We contact you by email. Where you ticked the optional consent box beside the phone field, we may also contact you by call or text message, including by automated dialing technology. Ticking it is never a condition of joining, and if you leave it unticked we use your phone number only so that a person can follow up about your submission.
Where it goes: your submission is recorded as a row in a private Google Sheet in our own Google Workspace account. The website that collects it is hosted by Vercel, Inc. The sheet is not published or shared, and is reachable only by authorized personnel. We do not sell this information or share it for advertising.
How long we keep it: up to 24 months from your submission, or less if you ask us to delete it sooner.
How to opt out or have it deleted: reply STOP to any text message to stop texts; use the unsubscribe link in any email we send you to stop emails; or email hello@flo.space to be removed from the list entirely or to request deletion of your submission. We respond within 30 days.
3b. The contact form
What we collect: your name, work email, company, team size, your message, and a source tag identifying which page the message came from.
Why: to respond to your inquiry. Nothing else — we do not add contact-form senders to a marketing list.
Where it goes: the message is stored as a row in a private spreadsheet in Google Workspace, reached through hosting provided by Vercel, Inc., and a notification email is delivered to our own inbox through Google Workspace (Gmail). It is reachable only by authorized personnel.
How long we keep it: up to 24 months, or less if you ask us to delete it sooner.
Deletion: email hello@flo.space and we will remove your message and confirm within 30 days.
3c. The Operator Tax assessment (/scan-me)
This page is reached by scanning a QR code. It asks five questions about how your working week is spent and shows you the result. It asks for no contact details of any kind, and you are never identified by name or email.
What we collect: a random identifier generated in your browser for that visit, the date and time, how far through the five questions you got, the answers you gave (hours a day, days a week, the percentage you estimated, what you selected as the causes, what you would do with the time, and the revenue range you picked), and whether you tapped through to book a call. We also record the IP address the visit came from, the referring page if there is one, and your browser user-agent.
Why: to count how many people scan the code, see where in the five questions people stop, and understand the range of answers given, so we can improve the assessment. Our legal basis is legitimate interests (measuring and improving our own marketing). The random identifier is not linked to any account or signup, and we do not use it to build a profile of you or to advertise to you.
Where it goes: a row in the same private spreadsheet in Google Workspace described above, reached through hosting provided by Vercel, Inc. It is reachable only by authorized personnel.
How long we keep it: up to 24 months.
Deletion: because the record carries no contact details, we cannot find your row from your name or email alone. If you want it removed, email hello@flo.space with the approximate date and time you used the assessment and we will locate and delete it, and confirm within 30 days.
4. Why we process your information, and our legal bases
Where the EU or UK GDPR applies, we rely on the legal bases noted below for each purpose.
| Purpose | GDPR legal basis |
|---|---|
| Responding to your contact-form or sales enquiry. | Our legitimate interest in answering people who contact us, and taking steps at your request prior to any contract. |
| Assessing fit, preparing setup recommendations, and contacting you about early access and launch by email. | Steps taken at your request prior to a contract, and our legitimate interest in building the product with the businesses that will use it. |
| Contacting you by call or text message about early access. | Your consent, given by ticking the optional box beside the phone field on the signup form. You can withdraw it at any time by replying STOP. |
| Loading webfonts so the Site renders correctly, and keeping the Site secure and functional. | Your consent for the webfont load, given through the consent banner; and our legitimate interest in operating a working, secure website. |
| Complying with law and defending legal claims. | Compliance with a legal obligation, and our legitimate interests. |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can object to that processing at any time (see Section 8).
5. Third parties we disclose to (subprocessors)
We keep the list short. These are the only third parties your data reaches through the Site today, and we disclose the minimum necessary for each to do its job:
| Recipient | What it receives | Purpose |
|---|---|---|
| Google LLC (Google Ads) | Your IP address, user-agent, the pages you view on this Site, and any Google advertising identifiers already in your browser — only after you accept the consent banner. If you decline, this tag is never requested and none of it is sent. We do not send Google your name, email address, or phone number. | measuring which advertisements lead to signups, so we do not keep paying for ones that do not |
| Google LLC (Google Fonts) | Your IP address and user-agent, only after you accept the consent banner. | serving web fonts so the site renders correctly |
| Vercel, Inc. | Your signup-form submission and your contact-form message pass through it, as the host of this website. It does not retain either. | website hosting |
| Google LLC (Google Workspace) | Your early-access signup and your contact-form message, each stored as a row in a private Google Sheet; and, for the contact form, a notification email containing your message, delivered to our own inbox through Gmail. | storing early-access signups, and contact-form email delivery |
| Google LLC (Google Places API), or komoot GmbH (Photon) | The text you type into the street address field on the signup form, sent from our server as you type so we can offer matching addresses. One service is used at a time. Your browser does not contact either of them, and no other field is sent. | address suggestions on the signup form |
We may also disclose information to professional advisers, or to authorities and other parties where required by law or to protect our rights. When the product goes live we expect to add subprocessors such as an application hosting provider and a payment processor; we will update this list before doing so.
We do not sell your personal information, and we work with no data brokers. We do run Google Ads conversion measurement, and only if you accept the consent banner. Depending on how California and other US state privacy laws are applied, that may count as "sharing" for cross-context behavioral advertising — so treat the banner as your control: decline it, or reopen it from the footer and change your answer, and the tag is never loaded.
6. International data transfers
Our providers process data in the United States. You can ask us for more detail using the contact details in Section 1.
7. How long we keep information
Early-access signup submissions are kept for 24 months, or less if you ask us to delete them sooner (Section 3a). Contact-form messages are kept for 24 months (Section 3b). Account and billing data: not applicable until accounts launch. We keep information only as long as needed for the purposes in Section 4 or to meet legal obligations, and then delete or anonymize it.
8. Your privacy rights
8a. US state privacy rights
Depending on where you live (for example California, Colorado, Connecticut, Virginia, Utah and other states with comprehensive privacy laws), you may have the right to:
- Know about and access the personal information we hold about you;
- Delete your personal information;
- Correct inaccurate personal information;
- Opt out of the sale or sharing of your personal information and of targeted advertising;
- Limit the use of sensitive personal information;
- Not be discriminated against for exercising your rights; and
- Appeal a decision we make about your request.
Do Not Sell or Share My Personal Information. We do not sell your personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of. You may still exercise your other rights above.
8b. EU / UK (GDPR) rights
If the GDPR or UK GDPR applies to you, you have the right to:
- Access a copy of your personal data;
- Have inaccurate data rectified;
- Have your data erased ("right to be forgotten");
- Restrict our processing of your data;
- Receive your data in a portable format and have it transmitted to another controller;
- Object to processing based on our legitimate interests;
- Withdraw any consent you have given, without affecting prior processing; and
- Lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office).
8c. How to make a request
Send your request to hello@flo.space. To protect your data we will verify your identity before acting — usually by confirming you control the email address associated with your request and asking you to confirm details we already hold. You may use an authorized agent where the law allows. We will respond within the timeframe required by the applicable law and will not charge a fee except where permitted.
9. Deleting your data
There are no accounts today. What we do hold is early-access signup submissions and contact-form messages. To have yours deleted, email hello@flo.space — we will remove it from our database and confirm within 30 days, except where we must keep something to meet a legal obligation. When accounts go live you will also be able to delete an account and its data from within account settings.
10. Children's privacy
The Site is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16, and we do not knowingly sell or share such information. If you believe a child has provided us information, contact us at hello@flo.space and we will delete it. This reflects our obligations under COPPA and Article 8 of the GDPR.
11. Security
We aim to protect personal information with reasonable technical and organizational measures. The Site has no account system, so there are no credentials to compromise, and it takes no payments, so there is no card data to hold. What we do store — early-access signups and contact-form messages, is transmitted over HTTPS, held in an access-restricted database, and reachable only by authorized personnel. When the product and accounts go live, we intend to encrypt data in transit and at rest, store passwords only as salted hashes, and use a reputable payment processor so card details are handled by that processor rather than by us.
No method of transmission or storage is completely secure, and we do not claim any formal security certification (such as SOC 2) that we have not actually achieved. We will describe our certifications here only once they are in place.
12. Cookies and tracking
The Site sets no cookies of its own, and nothing third-party runs until you accept the consent banner. Decline, and the only thing stored in your browser is that choice itself, so we can honour it without asking again. Accept, and two things load: Google Ads conversion measurement, which sets Google's own _gcl_* cookies, and webfonts from Google — both receive your IP address and user-agent, as described in Section 5. We run no session-recording tools and no chat widget. For the full picture, see our Cookie Policy.
13. Changes to this policy
We will update this policy when our practices change — in particular when the product and paid accounts go live. When we do, we will revise the "Last updated" date at the top of this page. The effective date of this version is September 7, 2026. Please review it periodically.
14. Contact and complaints
Questions, requests or complaints about privacy can be sent to hello@flo.space, or by post to Pickr Wholesale LLC, 2405 Avenue T, Brooklyn, NY 11229. If you are in the EU or UK you also have the right to complain to your local supervisory authority, but we would appreciate the chance to address your concern first.
See also our Terms of Service, Early Access Terms, and Accessibility Statement.
Related: Privacy Policy · Terms of Service · Cookie Policy · Early Access Terms · Accessibility Statement