.png)
This Security Policy is incorporated into and made a part of the written agreement between Fluincy and Customer that references this document (the “Agreement”) and any capitalized terms used but not defined herein shall have the meaning set forth in the Agreement. In the event of any conflict between the terms of the Agreement and this Security Policy, this Security Policy shall govern.
Risk Management
Until Fluincy obtains its SOC 2 Type II audit, Fluincy will adopt or maintain a substantially equivalent, industry-recognized framework. Fluency is not obligated to conduct security reviews or assessments through any platform (including customer or third party platforms).
Access Controls
Authentication
Overview: Fluincy requires authentication for access to all application pages on the Service, except for those intended to be public.
Secure Communication of Credentials: Fluincy currently uses encrypted requests to transmit authentication credentials to the Service.
Auth0 and Google Social Login:
In our commitment to maintain the highest level of privacy and security for our users, we utilize Auth0 as our identity provider to facilitate a seamless and secure login process. As part of this process, we offer the option to sign in using Google Social Login, leveraging Google user data to enhance your user experience. You access this by going through the sign in process at https://dashboard.getfluincy.com and clicking Sign In
Google Data Access and Usage
When you choose to log in using your Google account, we request access to specific information from your Google profile to authenticate you and provide a personalized experience on our platform. We strictly access and use this information in accordance with this privacy policy and Google's privacy standards.
The scope of the data access includes:
Email Address: We access your primary Google Account email address. This information is used to create or associate your user account on our platform, verify your identity, and facilitate communication with you regarding your account and our services.
Profile Information: We access your personal information, including any details you have made publicly available, such as your name and profile picture. This data helps us to personalize your experience on our platform.
Purpose and Consent
By choosing to log in with Google, you consent to allow us to access and use your Google user data as specified above. The purpose of accessing this information is to ensure a secure login process, improve your user experience by personalizing our services, and communicate with you effectively about your account and our services.
Data Privacy and Security
We take your privacy and data security seriously. We implement robust security measures to protect your information from unauthorized access, disclosure, alteration, or destruction. Your data is only used as outlined in this privacy policy and in accordance with our data protection practices.
Data Sharing
We do not share your Google user data with third parties without your explicit consent, except as necessary to provide our services or as required by law.
Data Retention
We retain your Google user data only for as long as necessary to provide our services to you, comply with our legal obligations, resolve disputes, and enforce our agreements.
Your Rights
You have the right to access, correct, or delete your personal information held by us. You can manage your data through your account settings or by contacting us directly. Additionally, you can revoke our access to your data via Google's security settings at any time.
Google Drive Data (Optional)
Optional Use of Google Drive API: Our application offers enhanced features and functionality through the integration of the Google Drive API. However, it is important to note that connecting with Google Data is entirely optional and not necessary for the core functionality of our application.
Access (If Opted-In): Should you choose to enable this feature, our application will request permission to access your Google Drive account. This includes the ability to view files and folders within your Drive, which is necessary for the application to perform the additional functions related to Google Data.
Use of Google Data (If Opted-In): If you grant access, the data from your Google Drive will be used solely for the purposes of enabling specific features within our application. This includes tasks such as reading file metadata and analyzing Google Meet transcripts automatically created in Google Drive. Rest assured, we do not access or use any data beyond what is required for these functions.
No Mandatory Storage or Sharing: Our application does not store your Google data on our own servers. All data used is processed in real-time within the Google Drive environment, and we do not maintain a copy of your data outside of Google Drive. Furthermore, we do not share any Google user data with third parties or external services, unless explicitly authorized by you.
Security and Privacy Commitment: We are committed to safeguarding your data's privacy and security, adhering to industry-standard security measures. However, please be aware that we cannot completely guarantee the security of data transmitted over the internet or stored within Google Drive.
User Consent and Agreement: By opting to connect your Google Drive account with our application, you acknowledge and agree to the access, use, storage, and sharing practices described herein.Additional Information: For details on how Google handles user data, please refer to Google's Privacy Policy.
Our use and transfer of information received from Google APIs to other apps adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Zoom Data (Optional)
Our application integrates with the Zoom API to provide certain features and functionality to our users. In order to deliver these services, our application requires access to and use of Zoom user data, specifically data associated with Zoom meetings and recordings.
Access: Our application will request permission to access your Zoom account, including the ability to view your recorded meetings and associated data. This access is necessary for our application to perform the intended functions and provide the requested services.
Use: The data accessed from your Zoom account will only be used for the purposes of enabling specific features and functionality within our application. This may include, but is not limited to, transcript reading and analyzing Zoom meeting recordings that are stored within your Zoom account. We do not use or access any data outside the scope of our application's functionality.
Storage: Our application does not store or retain any Zoom user data on our own servers or systems. All data accessed and used by our application is processed in real-time and directly within the Zoom environment. We do not maintain a separate copy of your data outside of Zoom.
Sharing: Our application does not share any Zoom user data with third parties or external services. We do not transfer, sell, or disclose any user data accessed from Zoom to any external entities unless explicitly authorized and initiated by the user for the purpose of integrations with other services.
We are committed to safeguarding the privacy and security of your data. We adhere to industry-standard security measures to protect against unauthorized access, loss, or alteration of data. However, please note that the security of data transmitted over the internet or stored within Zoom cannot be guaranteed completely.
By using our application and granting access to your Zoom account, you acknowledge and agree to the access, use, storage, and sharing practices described in this privacy policy. For more information about how Zoom handles user data, please refer to Zoom's Privacy Policy.
Password Management
Fluincy has processes designed to enforce minimum password requirements for the Service.
Password Storage. User account passwords are not stored on the Service.
Session Management
Overview
Each time a User signs in, the Service assigns them a new, unique session identifier.
Session Timeout. All sessions are designed to have a hard timeout.
Sign Out
When signing out, the Service is designed to delete the session cookie from the User’s system and to invalidate the session identifier on Fluincy servers.
Network and Transmission Controls
Fluincy monitors and updates its communication technologies periodically with the goal of providing network security.
Network Security
Fluincy regularly updates network architecture schema and maintains an understanding of the data flows between its systems. Firewall rules and access restrictions are reviewed for appropriateness on a regular basis.
Infrastructure Security
Fluincy uses security monitoring tools on the production servers hosting the Service.
Data Flow via the Paragon Integration Platform as a Service (iPaaS)
Usage of Paragon iPaaS: When utilizing our services, data may flow through or be processed by the Paragon Integration Platform as a Service ("Paragon iPaaS"). Paragon iPaaS is a third-party service that we utilize for seamless integration and data exchange among various platforms and systems.
Data Security: While data is being transmitted or processed through the Paragon iPaaS, we will take all reasonable precautions to ensure its security and confidentiality. This includes the application of security protocols and standards recommended by Paragon and additional measures that we deem necessary.
Data Retention: Data transmitted through the Paragon iPaaS will not be stored longer than necessary for the intended purpose. We will adhere to our established data retention policies and practices, which are designed to protect user information and comply with applicable laws and regulations.
Third-party Responsibilities: While we strive to ensure the safety and security of your data, it's essential to understand that Paragon iPaaS is a third-party service. As such, while we select only reputable services, we cannot assume liability for any breaches or data losses that occur solely within their infrastructure. We recommend users review Paragon's own terms of service and privacy policies to understand their data handling practices.
Data Transfer: Users acknowledge that data processed by Paragon iPaaS may flow through various servers and data centers, possibly spanning multiple jurisdictions. We assure users that we endeavor to select infrastructure that adheres to globally recognized standards and regulations concerning data protection.
Notification: In the unlikely event of a breach or vulnerability being detected in relation to data flow through Paragon iPaaS, we will notify affected users as required by applicable laws and take all reasonable steps to mitigate any potential harm.
Use of OpenAI API for Data Processing
In our pursuit to provide top-notch services, we incorporate the use of advanced artificial intelligence technologies, including the OpenAI API. This section details how the OpenAI API is utilized in processing customer-provided data, specifically for the analysis and contextual understanding of transcripts received from our customers.
2. Purpose of Data Processing
The OpenAI API is employed to enhance our capabilities in interpreting the transcripts you provide. This AI technology assists us in identifying key intents and contextual elements within these transcripts, enabling us to tailor our responses and services more effectively to meet your specific needs.
3. Nature of the Data Processed
The data processed through the OpenAI API may include textual content from transcripts and other related communications provided by you, the customer. This data is utilized exclusively for the purpose of extracting relevant insights and understanding pertinent to your inquiries or service requirements
4. Data Confidentiality and Security
We place utmost importance on the confidentiality and security of your data. Robust measures are in place to ensure that data processed through the OpenAI API is managed in line with our rigorous data protection policies. We strictly control access to this data and monitor its use, ensuring it is not employed for any purposes other than those explicitly outlined in this policy.
5. Compliance with Data Protection Laws
Our application of the OpenAI API for data processing is in strict compliance with applicable data protection laws and regulations. We are committed to maintaining the highest standards of data privacy and ensuring that our utilization of AI technologies aligns with legal and ethical standards.
6. Customer Consent
By using our services and providing us with your transcripts, you consent to the processing of your data through the OpenAI API as described in this policy. You retain the right to withdraw your consent at any time, as stipulated in our general privacy policy.
7. Changes to the Policy
We reserve the right to amend this section of the privacy policy as necessary, particularly to reflect technological advancements, evolving data protection practices, or changes in legal requirements. Customers will be informed of any significant modifications that impact the processing of their data.
Data Subject Access Rights
At Fluincy, we recognize and respect your data protection rights. Depending on where you reside, you may have the following rights:
Right to Access: You have the right to request details about the specific data we hold about you and how we process it.
Right to Rectification: If you believe that personal data we hold about you is inaccurate or incomplete, you have the right to request its correction.
Right to Erasure (‘Right to be Forgotten’): In certain circumstances, you can request the deletion of your personal data from our records.
Right to Data Portability: You have the right to receive your personal data in a structured, commonly-used, and machine-readable format, and you have the right to transmit that data to another data controller.
Right to Object: In specific situations, you have the right to object to the processing of your personal data.
Right to Restrict Processing: You can ask us to suspend the processing of your personal data in certain scenarios, e.g., if you want us to establish its accuracy or the reason for processing it.
Right to Withdraw Consent: If we're processing your personal data based on your consent, you have the right to withdraw that consent at any time.
If you wish to exercise any of these rights or have questions about them, please contact us using the contact details provided in this policy. We're committed to responding to your requests in a timely manner.
Please note that these rights may be limited, for instance, where fulfilling your request would adversely affect the rights and freedoms of others, where there are overriding public interest reasons, or if we're legally required to retain your data.
Data Confidentiality and Job Controls
Internal Access to Data
Access to Customer Data is restricted within Fluincy to employees and contractors who have a need to know this information to perform their job function, for example, to provide Support, to maintain infrastructure, or for product enhancements (for instance, to understand how an engineering change affects a group of customers).
Job Controls
Fluincy has implemented several employee job controls designed to help protect Customer Data stored on the Service.
Availability Controls
Disaster Recovery
The infrastructure for the Service is designed to minimize service interruption due to hardware failure, natural disaster, or other catastrophes.
Features include:
Data replication: To help ensure availability in the event of a disaster, Fluincy replicates Customer Data across multiple data centers.
Backups: Fluincy performs backups of Customer Data stored on the Service.
Incident Response
Fluincy has an Incident Response Plan designed to promptly and systematically respond to security and availability incidents that may arise. The incident response plan is tested and refined on a regular basis.
Segregation Controls
Data SegregationThe Service is designed to logically separate Customer’s Customer Data from that of other customers. Fluincy’s application logic is designed to enforce this segmentation by permitting each User access only to accounts to which that User has been granted access.
User Roles
User roles specify different levels of permissions that Customer can use to manage its Users. Customer can invite Users to its Service account without giving all Users the same levels of permissions.