1. Controller and contact
STUFFIG, s.r.o., IČO 53811844, Ivana Houdeka 1876, 034 01 Ružomberok, Slovakia is controller for operation of this website and the information described below. Contact fluritheme@gmail.com for privacy questions or to exercise rights. František’s separate website-design enquiries are handled at frantisekgejdos@gmail.com; do not send payment credentials to either address.
2. Customer accounts and website configurations
My Fluri now creates real server-backed accounts using your name, email address and a password. Passwords are hashed by the authentication system; the browser does not retain them in local storage. Secure necessary session cookies maintain sign-in. We store your registered website domains, names, theme choices, page rules, intensity, delivery state, legal acceptance record, recovery-code hash and evaluation or order records. Email ownership is not currently verified by email; a recovery code lets you reset a forgotten password without email. Keep it private. Public browsing and demos do not require an account, and opening an account does not require buying a plan.
The payment checkout is still simulated and collects no card details. Completing it creates a server-recorded 14-day evaluation so that installation can actually be tested. This is not a paid purchase or real revenue. Old browser-only demo data is not imported as account credentials or paid rights; you can remove old local keys through browser settings.
3. Website traffic and request measurements
Our hosting provider processes IP addresses and technical request data to deliver and secure the website. Our application-level public traffic tables store aggregate date, site or route, referral category, page-view count, country code, device category and defined interaction counts. Country is derived from the hosting edge’s coarse country result; we do not store a visitor’s raw IP address in these aggregate tables. We do not use fingerprinting or a persistent visitor identifier for this measurement. A request, page view and person are different metrics, and we do not equate them.
4. Events and checkout measurement
We aggregate defined actions such as opening pricing, trying a demo, successful account creation/sign-in, checkout initiation and successful website/configuration saves, with theme, route and test/live mode. Simulation events are never recorded as real revenue or production entitlements. Public event endpoints accept bounded categories, not arbitrary form content. Aggregate stage counts are not individual tracking histories or proof that a particular person abandoned a purchase. Respecting Do Not Track and Global Privacy Control, we omit optional public view and interaction measurements when those signals are present.
5. Legal bases
Delivering requested pages and maintaining reasonable security rely on legitimate interests in operating and protecting the service, with proportional safeguards. Account administration, requested installation and configuration rely on steps requested before a contract and contract performance; proportionate account security relies on legitimate interests. A future real purchase would also involve applicable accounting obligations. We do not rely on these bases for unrelated advertising. Where a feature legally requires consent, it must remain disabled until appropriate consent is obtained.
6. Owner dashboard and package data
The private owner dashboard uses a necessary authenticated session cookie. It shows aggregate website measurements and public npm package download and version information. npm download counts can include repeat automated downloads and are not unique users. Live request charts aggregate requests reaching our application; they do not reveal visitor identities or include requests blocked before the Worker executes. Owner access is restricted, and dashboard responses are not public or cacheable.
7. Recipients and infrastructure
The current website runs on Cloudflare Workers and uses Cloudflare storage for aggregate analytics and service operation. Dependencies delivered with the site are served from the Fluri origin. Opening an external npm, social or documentation link shares ordinary request data with that external service. Stripe is intended for future payments but is not connected in this preview. We do not currently send your preview form entries to Stripe. Cloudflare provides the active account and hosted-delivery infrastructure; Stripe disclosures will be updated before live billing.
8. International transfers
Cloudflare and external services may process data outside the EEA. Where we use a processor involving a restricted international transfer, appropriate safeguards such as the relevant standard contractual clauses or an applicable adequacy framework must be in place. Provider privacy and data-processing documentation explains their current arrangements. You may contact us for information about safeguards relevant to your data.
9. Retention
Our application-level public traffic and interaction aggregates are kept on a rolling 90-day basis. Short-window request buckets used for live charts expire after approximately fifteen minutes. Persistent daily request totals are subject to the same 90-day aggregate window. Historical local demo data remains in your browser until you remove it; current account data is server-backed as described below. Security-provider logs and necessary owner sessions have their own operational retention. Future real order and tax records will have a defined statutory retention schedule before sales open; we do not invent a paid-order history during preview.
10. Your rights
Depending on applicable conditions, you may request access, rectification, erasure, restriction, portability or object to processing based on legitimate interests. You may withdraw consent for consent-based processing without affecting its prior lawfulness. We may need proportionate information to verify a request; do not send identity documents unless necessary and requested securely. We ordinarily respond within one month, subject to lawful extensions. You can complain to the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR) or another competent supervisory authority.
11. Security and incidents
We use restricted dashboard access, origin checks, input validation, bounded event fields and separate test/live states. No security measure makes a public demonstration impossible to copy. If a personal-data breach occurs, we will assess and meet applicable notification duties. Please report suspected incidents to fluritheme@gmail.com without including passwords or live card details.
12. Hosted delivery and installed website metrics
The hosted loader requests configuration and the theme runtime from Fluri. This necessarily gives the hosting edge ordinary delivery information such as visitor IP, request time, origin/referrer and user agent. Connection acknowledgements store the registered website, first and latest successful runtime startup and generic startup-error status. They are installation diagnostics, not a count of people or proof of domain ownership.
The setup form preselects optional installation analytics for newly created websites. The customer can uncheck it before saving and disable it later; existing saved opt-outs are retained. This account setting is a customer processing instruction, not consent from the website’s visitors. When reporting is enabled, a per-event random ID prevents duplicate submissions and the edge derives coarse country and device class; the browser sends only a broad referrer category. Application aggregates contain date, registered website, country, device category, referrer category and theme page views. They exclude raw visitor IPs, full page/referrer URLs, persistent visitor identifiers and visitor cookies. DNT and Global Privacy Control suppress optional view events. Recognised bots are excluded, but filtering and client reporting have limits. Counts are not unique people or a complete measure of customer traffic.
For customer-directed visitor processing Fluri acts as processor under the shared Hosted installations and data processing agreement. Customers must have authority to install themes and determine their visitor notices, lawful basis and any required prior consent. Customers must turn off the preselected analytics setting before saving or deploying if those requirements are not satisfied. Where prior visitor consent is required, the embed supports initial `data-analytics="false"` and the in-memory `window.Fluri.setAnalytics(true/false)` control for the customer’s consent manager. Do not enable reporting until the relevant conditions are met. This control neither creates visitor consent nor stores a consent record. For Fluri's own security, account administration and proportionate service-level performance analysis, STUFFIG is controller. Our restricted owner dashboard can show aggregate views and top registered websites across customers. This helps operate and improve delivery; we do not publicly publish those customer rankings, sell visitor profiles or add advertising to themes.
13. Account rights, retention and service providers
Customer sessions ordinarily expire after seven days, with renewal during use. Password changes can revoke other sessions. Profile correction, password change, recovery-code rotation, account export, website deletion and evaluation-account deletion are available in My Fluri. Recovery codes are stored as hashes and are single use. Deleting an account stops its installations and removes associated evaluation data; accounts with future real statutory order records may require an assisted deletion process with lawful retention of those records. Deleting an account is not automatically a refund request.
Installation-view aggregates are retained for 90 days, duplicate-event IDs for about one day and configuration activity for 30 days. Connection state remains with the website until removal. Short-lived rate-limit keys are hashed technical identifiers and cleaned by the service; necessary security processing is distinct from optional analytics. Cloudflare Workers and D1 provide delivery and storage. Provider backups and logs follow operational retention and lawful security requirements. No routine recovery or verification email is sent. Google sign-in is offered only if configured; Fluri never receives your Google password. Stripe remains disconnected and receives no payment or installed-site visitor data in the sandbox.
14. Updates
This account-flow revision is dated 15 November 2026 (2026-11-15-customisation-analytics). Material changes to actual processing will be explained when introduced. Earlier legal and licence records are retained where necessary to show which terms applied.