Privacy Policy

Who we are

Flo (withflo.app) is a product of MRVL Technologies (“MRVL”, “we”). Flo lets a business take bookings and hold video meetings. For the personal data of a business’s own clients, that business is the controller and MRVL acts as its processor. For the people who hold a Flo account, MRVL is the controller. Contact: john.hammond@mrvltechnologies.com.

What we collect

• Account holders: name, email address, business name, and the service, availability and booking settings you choose.
• Clients who book: name, email address (and phone number and notes where the business asks for them), and the service and time booked.
• Billing: subscription payments are taken by Stripe. We receive the subscription status and a Stripe customer reference. We never see or store card numbers.
• Email delivery: we record whether our transactional emails were delivered or bounced. The delivery log keeps only a one-way hash of the recipient address and the address’s domain.
• Website: on our public pages an MRVL-operated script records, for visits that arrive from another website, the referring page, the landing page address and the browser’s user-agent string. It does not run on private links (setup, cancel, reschedule, guest-join and personal-meeting links). If you sign in, essential cookies keep you signed in.

Google Calendar access

If you choose to connect Google Calendar, Flo asks for two permissions:

• See when you are busy (calendar.freebusy). Flo asks Google for your busy time slots only, so it never offers a time that clashes with your calendar. Flo does not read the titles, attendees, locations or descriptions of your other events.
• Create and manage Flo’s own appointment events(calendar.events). When someone books, Flo creates an event on your primary calendar with the title “<service> — <client name>” and a description containing the client’s name and email address, a link to the Flo meeting (for Flo Meet) and a link to manage the booking in Flo. If the booking is rescheduled or cancelled in Flo, Flo updates or deletes that same event. Flo does not currently add your client to the event as an attendee.

What we keep and what we don’t.

• Busy times are used only to answer the question “is this slot free?”. They are held in short-lived server memory (about 30 seconds) and are not saved to our database.
• We store your Google authorisation tokens, encrypted at rest (AES-256-GCM), together with the permissions Google granted and a connection-health status. Tokens are used only on our servers and are never sent to your browser.
• For each event Flo creates we store Google’s event ID so Flo can update or delete it later.
• Flo does not request or read your email, contacts, files or Google profile.

Use of Google data.Google user data is used only to provide these booking features. It is not sold, not used for advertising, not shared with third parties other than to provide the service, not used to train AI or machine-learning models, and no person at MRVL reads your calendar data unless you ask us for support. Flo’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting.You can disconnect Google Calendar from Flo’s settings, or by emailing us. This deletes the tokens we hold, after which Flo can no longer access your calendar. Events Flo already created stay on your calendar unless the booking is cancelled in Flo. To also revoke Flo’s access inside Google, visit myaccount.google.com/permissions.

Microsoft Outlook calendar

Connecting an Outlook calendar is in preparation and is not currently available. When it is, it will work in the same limited way as Google Calendar: busy times used only to check availability and not stored, only Flo’s own appointment events created and managed, and tokens stored encrypted and removed when you disconnect.

Video meetings, recording and AI

Flo Booking and Flo Meet do not record or transcribe meetings, and use no AI on meeting content. Workspaces on earlier Flo plans may be able to enable meeting recording, transcription and AI-written summaries, which ask participants for consent first; where those are used, the audio, transcripts and summaries are processed by our video provider (Daily) and AI provider (OpenAI). None of these features is applied to Google Calendar data.

How we use data

To provide bookings, reminders and meetings; to take and manage subscription payments; to keep the service secure; and to contact you about your account. We do not sell personal data.

Service providers and where data is processed

Flo is an MRVL product. To run it we use specialist providers for hosting (Vercel), database and sign-in (Supabase), payments (Stripe), email (Resend), video (Daily), calendars (Google, Microsoft) and, where you enable them, messaging channels. They process data only to provide those services to us. Our database and application servers run in the UK (London); some providers, for example email and video, may process data outside the UK.

Retention and your rights

We keep your data while your workspace exists. If a subscription lapses, Flo pauses new bookings but does not delete your data. You may ask us to access, correct, export or delete your personal data by emailing us, and we will respond within one month. If you are in the UK or EEA you also have the right to complain to your data protection authority (in the UK, the ICO).

Changes

We will update this page if our practices change and revise the date above.