Privacy Policy
How we collect, use, share, and retain data — including current ChatGPT, MCP, and AI wizard tool inputs and outputs — and the controls you have.
This Privacy Policy explains how InspireUI Ltd (“InspireUI”, “FluxBuilder”, “we”, “us”, or “our”) collects, uses, discloses, retains, and lets you control personal data when you use FluxBuilder.
It covers every FluxBuilder surface that can receive or return data, including:
- fluxbuilder.com and localized marketing pages
- FluxBuilder Cloud (web.fluxbuilder.com), the desktop builder, and related APIs
- The on-site AI wizard and chat-to-build flow
- The FluxBuilder MCP server at https://ai.fluxbuilder.com/mcp
- The FluxBuilder ChatGPT connector, Custom GPT, and any other AI assistant that calls our tools
- Cloud test builds, account, billing, support, and analytics
Effective date: August 17, 2026. This version replaces the May 15, 2024 policy.
If you do not agree with this policy, do not use the Services. Questions: [email protected].
Contents
- Who we are
- Data we collect
- ChatGPT, MCP, and other AI tools — current inputs and outputs
- Purposes
- Recipients
- Retention
- User controls
- Cookies and similar technologies
- Apps you build with FluxBuilder
- International transfers
- Legal bases (GDPR)
- Your rights (GDPR, UK GDPR, CCPA/CPRA, and similar laws)
- Children
- Security
- Changes
- Contact
Who we are
Controller: InspireUI Ltd
Product: FluxBuilder
Address: SBI Building, District 12, Ho Chi Minh City, Vietnam
Privacy email: [email protected]
Support email: [email protected]
Phone: +84 989 908 854
When you connect FluxBuilder from ChatGPT, Claude, Cursor, or another assistant, you choose that assistant. That provider is an independent controller of the chat you type there. FluxBuilder is the controller of the account, project, store-connection, and build data we process after a tool runs.
Data we collect
We collect only what is needed to run FluxBuilder. Categories:
Information you provide
| Category | Examples |
|---|---|
| Account | Name, email, password or SSO token, company, phone, country, plan |
| Billing | Name, email, tax/VAT ID, country, and payment-method tokens handled by our payment processors. We do not store full card numbers. |
| Project and app config | App name, bundle ID, icon and splash images, colors, fonts, navigation, template, language, theme.json / design JSON |
| Store connection | Website URL, detected or selected platform (WooCommerce, Shopify, WordPress, Magento, OpenCart, PrestaShop, BigCommerce, Notion, Strapi, and similar), API base URL, consumer key / consumer secret, Storefront or Admin tokens, key permissions (read, write, read_write) |
| AI prompts | Text you type in the FluxBuilder wizard or that an assistant sends as a tool argument (store URL, “build my app”, design instructions, feature requests) |
| Support | Emails, chat transcripts, attachments, meeting bookings |
| Marketing preferences | Newsletter opt-in, cookie and advertising consent |
Information collected automatically
| Category | Examples |
|---|---|
| Device and log | IP address, user-agent, OS, browser, language, approximate location from IP, Cloudflare country code |
| Session | thread_id, device_id, FluxBuilder user ID, session cookies, first-touch referrer and UTM parameters |
| Usage | Pages viewed, clicks (including download and pricing events), wizard steps, build requests, feature use |
| Diagnostics | Error messages, build logs, scope-check results for the AI wizard |
Information from other sources
- Google sign-in / One Tap: email, name, Google subject ID, and ID token. Sign-in is not consent to advertising.
- Your store, after you authorize it: public catalog structure (platform, categories, product counts, sample titles/images needed to design the app). We do not scrape customer PII from your store to market FluxBuilder.
- Payment processors (Paddle, and Lemon Squeezy where still used): payment success/failure, subscription status, refunds.
- AI clients you connect (ChatGPT, Claude, Cursor, and others): OAuth identity, tool-call arguments, and the fact that a tool was invoked.
We do not sell personal information. We do not use store customer lists, order PII, or payment-card data from your store to train models or to advertise FluxBuilder.
ChatGPT, MCP, and other AI tools
This section is the current disclosure of tool inputs and outputs for:
- the FluxBuilder ChatGPT connector and Custom GPT
- the FluxBuilder MCP server (
https://ai.fluxbuilder.com/mcp) - the on-site AI wizard (
/api/wizard, GenAI gateway)
Your AI client shows the live tool names and JSON schemas when you connect. The rows below are every category of input those tools currently accept and every category of output they currently return. If we add a tool that collects a new data type, we will update this policy first.
How a tool call moves data
- You sign in to FluxBuilder with OAuth (ChatGPT / MCP) or Google / email (website and builder).
- The assistant may send tool inputs (arguments) through the AI client to our server.
- Our server runs the tool against your workspace only.
- We return tool outputs to the assistant so it can continue the conversation.
- Store credentials are stored on FluxBuilder servers. They are not required in the chat. If you paste a key into ChatGPT or a tool argument, that AI provider also processes it.
FluxBuilder does not use tool inputs or outputs to train third-party foundation models. The AI client you chose (for example OpenAI for ChatGPT) processes the conversation and tool payloads under that provider’s privacy policy. In ChatGPT, use Settings → Data controls to manage chat history and whether OpenAI may use your content to improve models.
Current tools — inputs and outputs
| Tool (what it does) | Inputs we receive | Outputs we return | Why |
|---|---|---|---|
| Read / detect store | Website URL; optional platform hint | Detected platform; reachability; catalog summary (categories, product counts, sample titles/images); compatibility notes | Identify the stack and design a matching app |
| Get account / workspace | OAuth access token (after you sign in) | Your name, email, user ID, plan, and whether the workspace can create or build apps | Authorize the assistant and apply plan limits |
| List / open projects | Account scope; optional project ID | Project IDs, names, platforms, store URLs, and editor links you own | Let the assistant work only on your apps |
| Create project | App name, template/category, icon or branding hints, bundle ID, website URL, your email | Project ID, app name, FluxBuilder Cloud editor URL (web.fluxbuilder.com/app/{id}) |
Create the app record |
| Connect store API | Store URL, platform, consumer key / secret or platform token, key permissions, optional user/app IDs | Connection status; store metadata (name, currency, locale). Raw secrets are not echoed back | Sync catalog, cart, and checkout into the app |
| WooCommerce (and similar) OAuth | Store URL, requested scope (read / read_write), callback state |
Authorization URL; success/failure after you approve in wp-admin | Connect without pasting keys into chat |
| Shape layout / design | Natural-language design request; selected template; colors, fonts, navigation, home sections | Updated design/theme JSON summary; template label; preview description | Customize the app UI |
| Create-app confirmation | Your approval, email, and the design payload | Success flag and the created app object (id, name, config reference) | Persist the project on our builder API |
| Ship a test build | Platform (android or ios); email; theme/config JSON; store connection fields; language code |
Job accepted/rejected; later an email with APK, QR, or iOS preview link (Appetize). No binary is returned inside the ChatGPT message | Deliver a testable build |
| Wizard / chat turn | thread_id, device_id, user email/name/plan, the user message (max 3,000 characters), optional resume fields (selected option, credentials, cancel/success) |
Streamed assistant text; tool status; connection checks; design steps; choice prompts; app_id when ready |
Drive the chat-to-build flow |
| Scope check (website wizard only) | The latest user message | Internal allow/deny. The message is sent to Google Gemini solely to decide if it is about FluxBuilder | Keep the public chat on-product |
Tools cannot see other customers’ workspaces. They cannot download your full customer or order database into the chat.
What we do not do with tool data
- We do not sell ChatGPT, MCP, or wizard data.
- We do not use it for third-party advertising.
- We do not use it to train a public FluxBuilder or third-party foundation model.
- We do not retain raw payment-card numbers (those stay with Paddle / the card network).
- We do not require you to paste store admin passwords into ChatGPT.
Purposes
| Purpose | Data used |
|---|---|
| Create and operate your account, projects, and sessions | Account, session IDs, SSO |
| Detect your store, connect its API, and generate app config | Store URL, credentials, catalog summary, design JSON |
| Run ChatGPT / MCP / wizard tools and return results | Tool inputs and outputs listed above |
| Create cloud test builds and email APK / iOS preview links | Email, theme JSON, platform, store connection |
| Process subscriptions, invoices, taxes, and refunds | Billing and processor events |
| Customer support and onboarding (email, optional live chat, Cal.com) | Contact and support content |
| Secure the service, prevent abuse, and keep the wizard on-scope | Logs, IP, device, prompts |
| Measure product use and advertising performance | Usage events, cookies, consent record, Google Ads / GTM signals where allowed |
| Comply with law, enforce terms, and keep tax/accounting records | Account, billing, logs |
We do not use store customer PII, order contents, or tool secrets for marketing.
Recipients
We share personal data only with the parties below, and only as needed for the purposes above.
| Recipient | Role | Data they may receive |
|---|---|---|
InspireUI infrastructure — server2.inspireui.com, fluxbuilder.inspireui.com, ai.fluxbuilder.com, gen-ai.fluxbuilder.com |
Operate accounts, projects, MCP, wizard, and builds | Account, projects, credentials, builds, tool I/O |
| Cloudflare | Hosting, CDN, TLS, bot protection | IP, request logs, cached assets |
| OpenAI | ChatGPT connector / Custom GPT, if you use ChatGPT | Prompts you type in ChatGPT; tool inputs and outputs for that session |
| Anthropic, Cursor, and other MCP clients | Only if you connect them | Same tool I/O for that client |
One Tap / Google sign-in; Gemini for the public wizard scope check and optional on-site chat; Google Ads (AW-1021634780) and Tag Manager (GTM-KRMNSMB) |
SSO token; wizard message for allow/deny; advertising/analytics signals after consent where required | |
| Paddle (and Lemon Squeezy on legacy checkouts) | Payments and tax invoicing | Name, email, plan, payment tokens |
| Appetize | iOS web preview for test builds | Preview token and the iOS build needed to stream the preview |
Umami (umami-inspireui.vercel.app) |
First-party product analytics | Page views and named events, IP truncated per Umami settings |
| Cal.com | Optional sales / onboarding booking | Name, email, meeting notes you submit |
| Chatwoot / FluxChat | Optional support widget, only when that widget is enabled | Messages you send in support chat |
| Email delivery | Transactional mail (account, build-ready, receipts) | Email and message content |
| Professional advisers and authorities | Legal, tax, or compulsory process | The minimum required |
Affiliates under common control with InspireUI may access the same data to operate FluxBuilder.
We do not sell personal information and we do not share it for cross-context behavioral advertising in the CCPA/CPRA “sale/share” sense except for advertising cookies you can refuse in our consent banner (EEA/UK/Switzerland/Brazil) or via your browser / Global Privacy Control where we honor it.
Each recipient’s own policy also applies when they are an independent controller (notably OpenAI, Google, and the AI client you pick).
Retention
We keep data only as long as needed for the purpose, then delete or irreversibly anonymize it.
| Data | Retention |
|---|---|
| Account profile | Life of the account + 30 days after deletion |
| Projects, design JSON, store connection metadata | Until you delete the project or the account, then up to 30 days in backups |
| Store API secrets | Until you disconnect the store, rotate the key, or delete the project/account |
ChatGPT / MCP / wizard tool logs (inputs, outputs, thread_id, device_id) |
90 days, unless needed longer for an active abuse or support case |
| On-site wizard scope-check payload sent to Gemini | Not stored by us beyond the request, other than ordinary server logs (90 days) |
| Test-build artifacts (APK, preview links, build logs) | 30 days after the job finishes |
| Payment and invoice records | 7 years (tax and accounting) |
| Support tickets and email | 3 years after the last reply |
| Analytics events (Umami / first-party events) | 13 months |
| Cookie / advertising consent record | 13 months, or until you change it |
| Security and access logs | 90 days (longer if an incident is open) |
You can ask us to delete sooner; see User controls. We may keep a minimal record of the request and any data the law requires us to keep.
User controls
You can:
- Access, correct, or export your account and project data from FluxBuilder Cloud or by emailing [email protected].
- Delete a project in the builder, which removes that app’s config and stored store credentials.
- Disconnect a store so API keys are dropped from our servers.
- Delete your account by requesting it at [email protected] or [email protected]. We complete verified deletion requests within 30 days.
- Revoke ChatGPT / MCP access in the AI client (ChatGPT: Settings → Connectors / Apps; Claude, Cursor, and others have an equivalent disconnect) and in your FluxBuilder connected-apps / security settings. Revoking stops new tool calls. Data already written into a project stays until you delete that project.
- Opt out of marketing email via the unsubscribe link. We still send transactional mail (receipts, build-ready, security).
- Refuse or change advertising cookies via Cookie settings in the footer, or the consent banner where it is shown.
- Control ChatGPT training / history in ChatGPT’s own Data controls. That setting is between you and OpenAI; we cannot flip it for you.
We will not discriminate against you for exercising these rights. We may need to verify your email before fulfilling a request.
Cookies and similar technologies
| Type | Examples | Control |
|---|---|---|
| Strictly necessary | Login session, CSRF, consent cookie (fb_consent), first-party fb_aid event cookie |
Required for the site to work |
| Analytics | Umami first-party analytics | Limited identifiers; not used to sell your data |
| Advertising | Google Ads / Tag Manager (AW-1021634780, GTM-KRMNSMB) |
Off by default in the EEA, UK, Switzerland, and Brazil until you accept. Change anytime via Cookie settings |
Google sign-in cookies are set by Google when you use One Tap. That is authentication, not ad consent.
Apps you build with FluxBuilder
If you publish an app with FluxBuilder, you are the controller of that app’s end users (your shoppers). You must publish your own privacy policy in App Store / Google Play and collect only what your store and plugins require.
FluxBuilder does not automatically become the controller of your shoppers. We process store data on your behalf solely to build, preview, and update your app. End-user account deletion, GDPR, and COPPA obligations for that app are yours, except where a FluxBuilder-hosted feature we operate is the processor — in which case we follow this policy and your documented instructions.
International transfers
We are based in Vietnam. We and our processors also operate in the United States, the European Economic Area, and other countries (for example Cloudflare, Google, OpenAI, Paddle). Those countries may not provide the same legal protections as your home country. Where required, we use appropriate safeguards such as Standard Contractual Clauses and processor terms.
Legal bases (GDPR)
If EU/UK GDPR applies, we process data on these bases:
- Contract — account, builder, MCP/ChatGPT tools, builds, billing
- Legitimate interests — product analytics, security, abuse prevention, limited B2B marketing to existing customers
- Consent — advertising cookies in consent-required regions; optional newsletters
- Legal obligation — tax, accounting, and compulsory requests
Your rights
GDPR / UK GDPR
You may request access, rectification, erasure, restriction, objection, and portability, and you may withdraw consent at any time. You may complain to your local supervisory authority. We respond within one month.
CCPA / CPRA (California) and similar US state laws
You have the right to know, access, correct, delete, and opt out of sale/share of personal information, and not to be discriminated against for exercising those rights. We do not sell personal information. To opt out of advertising cookies, use Cookie settings. Authorized agents may email [email protected] with proof of authority.
Categories collected in the last 12 months match Data we collect. Categories disclosed match Recipients. We do not use or disclose sensitive personal information (such as store API secrets) for purposes other than providing the Services.
Children
The Services are for people 16 or older. We do not knowingly collect personal data from children under 16. If you believe we have, contact [email protected] and we will delete it.
Security
We use TLS in transit, access-controlled servers, hashed passwords, scoped OAuth tokens, and least-privilege access to store secrets. No method of transmission or storage is 100% secure. If a breach affecting your personal data occurs, we will investigate and notify you and regulators when the law requires it.
Changes
We will change the date at the top of this page when we update the policy. If we add a tool that collects a new category of personal data, or if we change recipients or retention in a material way, we will post the update here before that tool ships and, where required, email account holders or ask for consent.
Review this page when you connect ChatGPT or another assistant so it always matches current tool inputs and outputs.
Contact
InspireUI Ltd
SBI Building
District 12, Ho Chi Minh City, Vietnam
Email: [email protected] or [email protected]
Phone: +84 989 908 854
Related: Terms of Service · Support policies · MCP server