Privacy Policy

Last updated: 29 May 2026

Who we are

Flostac (operated by MarkOne Media — markone-media.com, India) is a customer-relationship and ad-management platform built for digital marketing agencies. This policy explains what data we collect, why we collect it, how we store it, and how you can remove it.

For any privacy question, write to team.flostac@gmail.com.

Data we collect

We collect data in three categories.

1. Account data

When you sign up we store your name, email address, password (hashed), and the workspace you belong to. This is required to give you access to your workspace.

2. Customer data you import

You can import contacts into Flostac from Google Sheets, CSV uploads, manual entry, or connected ad platforms. The contact rows you import (names, phone numbers, email addresses, locations, social handles) are stored in your private workspace and visible only to members of your organization.

3. Connected platform data

When you connect a Facebook Business Account, Google account, or other ad platform, we store:

An encrypted access token allowing us to call the platform on your behalf
Identifiers (ad account IDs, page IDs, campaign IDs) for the assets you authorize us to manage
Performance metrics such as spend, impressions, clicks, and lead counts
Lead form submissions you choose to ingest, including the customer fields each form collects

We never store your Facebook password or any other credential you use to log into a third-party platform. The token can be revoked at any time from inside Flostac or from your Facebook security settings.

How we use your data

To operate the product features you signed up for: contact management, ad performance dashboards, lead routing, and team collaboration
To execute the actions you take inside the app: pausing or resuming campaigns, adjusting budgets, syncing leads
To send essential transactional notifications about your account (billing, security, breaking changes)
To investigate bugs and improve performance, using aggregated, non-identifying telemetry

We do not sell your data. We do not use customer data to train machine-learning models. We do not share data with advertisers.

Where data is stored

Data is stored in Supabase (which runs on AWS infrastructure). The application is served from Vercel's global edge network. Encrypted backups are retained for 30 days. Tokens for connected platforms are encrypted at rest with AES-256-GCM using a key held outside the database.

Who can see your data

Inside your organization, members can see contacts, campaigns, and metrics belonging to that organization. Administrators can manage members.

Outside your organization, no one. Engineering staff at Flostac can access database systems for debugging only when explicitly authorized by you, and only the minimum data required to resolve the issue.

Third-party services

Flostac relies on the following sub-processors to operate. Each handles a specific function and only the data needed for that function. A live list is maintained on our Subprocessors page.

Supabase — database, authentication, file storage. Subject to Supabase's privacy policy.
Vercel — application hosting and edge delivery. Every request you make to Flostac passes through Vercel. Subject to Vercel's privacy policy.
Nylas — email integration when you connect a mailbox to Flostac. Subject to Nylas's privacy policy.
Meta (Facebook, Instagram) — when you connect a Facebook Business account, for ad management and lead retrieval. Subject to Meta's Data Policy.
Google Sheets — when you choose to import contacts from a sheet you have shared with our app.

Your rights

You can:

Export your contact data from the app at any time
Disconnect any third-party integration from the Growth tab
Request deletion of your account and all associated data — see our Data Deletion page
Email us with any access, correction, or portability request at team.flostac@gmail.com

Cookies and tracking

We use a single first-party session cookie to keep you logged in. We do not use third-party advertising or analytics trackers on the Flostac web app. See our Cookie Policy for the marketing website.

Changes to this policy

If we make a material change we will email all account holders before the change takes effect, and revise the “Last updated” date above.