Privacy Policy

Flooray is provided by Vicodr AB (reg. no. 559438-5824), a company registered in Sweden.

We are the data controller for the personal data described in this policy. If you have any questions about how we handle your data, or if you want to exercise your rights, contact us at the email above.

Flooray is not directed at children under 16. We do not knowingly collect personal data from anyone under 16.

We only collect personal data that is necessary to provide you with the service. Here is what we collect, why, and how long we keep it:

We measure how the Service is used with analytics software we run ourselves, on the same servers in Paris as the rest of your data. No third party receives it, it sets no cookies, and it does not identify you.

Separately, and only if you agree, we record app sessions to find bugs and improve how the app works. Recordings are not linked to your name or email, but they are only made while you are signed in, and they show the pages you visited. Recording is off until you turn it on, you can turn it off in your settings, and sensitive information is masked.

You can sign in with an email and password, or with Google. If you choose Google, your sign-in is also covered by Google's own privacy policy.

All data is stored on servers operated by Scaleway, located in Paris, France (EU). The database is encrypted at rest and accessible only through a private network.

The following third-party data processors are engaged by Flooray and may process personal data on our behalf. Each operates under a data processing agreement.

All data processing occurs within the EU. We do not transfer your personal data outside the EU.

Plans are public by default. Public does not currently mean listed or searchable. It means anyone you give the link to can open and view the plan, and can save their own copy to change.

If you browse Flooray without an account, we set no cookies at all. Signing in sets the cookies below. Every one of them is strictly necessary for the service to work, so we do not ask for consent to them, and we use no analytics cookies, advertising cookies, or any other tracking cookies.

Cookies are not the only way a site can store things in your browser. We also use your browser's own storage to hold work in progress, such as a plan you are copying or an email change you have started, to remember your scroll position, and to let your other open tabs know when you sign out. Nothing there is shared with anyone.

Under the GDPR, you have the following rights. You can exercise any of them by contacting us at support@vicodr.com. We will respond within 30 days of receiving your request.

Access

You have the right to request information about which personal data we process about you, and to receive a copy of that data.

Data portability

You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.

Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected.

Erasure

You have the right to request that we delete your personal data. We will do so unless we have a legal obligation or other compelling reason to retain it. Deleting your account will erase your personal data within 30 days, apart from the two things set out below.

You can delete your account yourself, from your settings. We will send a confirmation link to your email address, and nothing is deleted until you open it.

Two things outlast the deletion. We keep receipts and invoices for anything you paid, because Swedish accounting law requires it. And we keep your floor plan drawings, including any photos in them, with your account details and everything you typed removed: no account name, no plan or room names you wrote, no labels, no captions. We keep the drawing, its floor area, and your country if you gave one. A plan you delete on its own is kept in the same way. They stop being reachable by the links you shared. We may use them to understand what people build, and may show them, or a modified version of them, as an example plan. We will not show a plan you have marked private.

Restriction of processing

You have the right to request that we temporarily restrict the processing of your personal data, for example while we verify the accuracy of your data or assess an objection you have raised.

Objection

You have the right to object to processing based on legitimate interest. If you do, we will only continue the processing if we have a compelling reason that overrides your interests, or if the processing is necessary for the establishment, exercise, or defence of a legal claim.

Complaints

If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with a supervisory authority. In Sweden, this is Integritetsskyddsmyndigheten (IMY). You can find more information on their website.

We protect your personal data against unauthorized access, alteration, and erasure. All data is encrypted at rest and in transit. Access to production systems is restricted and authenticated. In the event of a security breach that may significantly affect you, we will contact you and inform you of what steps we are taking. Where required by law, we will notify the relevant supervisory authority within 72 hours.

We may update this policy from time to time to reflect changes in how we process your data. If we make material changes, we will notify you by email or through a notice in the application. The latest version is always available at this page.