Privacy Policy

Last updated: January 2025 · Flow Mfg Ops Platform

Back to LoginTerms of Service

1. Introduction

This Privacy Policy describes how Lucaxis ("we", "us") collects, uses, and protects information when you use the Flow Mfg Ops Platform. By using the Platform, you consent to the practices described here.

2. Information We Collect

We collect: (a) account information (name, email, role, organization); (b) operational data you submit (work orders, OEE records, quality records, supplier records); (c) integration credentials for external systems (encrypted at rest); and (d) audit-trail metadata (IP, user-agent, timestamp) for security and compliance.

3. How We Use Your Information

We use your information to: (a) provide and operate the Platform; (b) process sync jobs and webhook events; (c) compute analytics and AI insights; (d) maintain an immutable audit trail; (e) communicate critical service notifications; and (f) detect, prevent, and address technical issues, fraud, or security threats.

4. Lawful Basis for Processing

For users in the European Economic Area, our lawful bases for processing are: (a) performance of the contract (providing the Platform); (b) compliance with legal obligations (e.g., audit retention); and (c) our legitimate interests in securing the Platform and detecting abuse.

5. Data Retention

We retain your data for as long as your account is active. After termination, we retain operational data for 60 days for export, audit logs for 7 years (or as required by regulation), and integration credentials are purged within 24 hours of account closure.

6. Data Sharing

We do not sell your data. We share data with: (a) cloud infrastructure providers hosting the Platform; (b) subprocessors listed in our DPA; and (c) law enforcement when compelled by valid legal process. Connector vendors (e.g., SAP, Microsoft, Siemens) only receive data when you initiate an outbound sync.

7. Data Security

We employ industry-standard security controls: encryption at rest and in transit, HMAC-signed webhook payloads, rate limiting on all API endpoints, role-based access control (admin / operator / viewer), feature-flag gating for sensitive modules, and continuous audit logging via the AuditTimeline table.

8. International Transfers

Your data may be processed in countries other than your own, including the United States and European Union. We rely on Standard Contractual Clauses and adequacy decisions for lawful cross-border transfers.

9. Your Rights

Subject to applicable law, you have the right to: (a) access your data; (b) correct inaccuracies; (c) request deletion of personal data; (d) restrict or object to processing; (e) data portability; and (f) withdraw consent. Submit requests via your account settings or by contacting privacy@lucaxis.test.

10. Cookies & Tracking

We use essential cookies for authentication (next-auth.session-token). The historical auth-bypass toggle cookie was removed in v8.56 and is proactively cleared on your next visit. We do not use third-party tracking or advertising cookies.

11. Children's Privacy

The Platform is not directed at individuals under 16. We do not knowingly collect personal information from children. If you believe we have done so inadvertently, contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification or email at least 30 days before taking effect. Continued use of the Platform after the effective date constitutes acceptance of the updated policy.