Floorline Privacy Policy

Effective date: Oct 8, 2026 Last updated: Oct 23, 2026

This Privacy Policy explains how Floorline collects, uses, shares, and protects personal information when you use the Floorline website and web app at https://floorline.live and the Floorline iPhone app (together, the "Service"). It replaces our earlier privacy policy, which covered the iPhone app only.

Floorline is operated by Michael Strange, sole proprietor, d/b/a Floorline, based in Pennsylvania, USA ("Floorline," "we," "us"). Questions: support@floorline.live.

1. Two roles: our data and your organization's data#

Floorline is used by organizations, such as live-event production companies, to manage their people, events, and gear. That means we handle personal information in two different roles:

• Organization Data (we act for the organization). When an organization or its admins enter information about employees, crew, clients, or venues, the organization controls that information and decides how it is used. We process it on the organization's behalf, as its processor or service provider, under our Data Processing Agreement (floorline.live/dpa). If you are a crew member or client contact and have questions about information an organization holds about you, please contact that organization first. We will help it respond.
• Account and Service Data (we decide). We are responsible for the information we collect to run the Service itself, such as your login details, security logs, analytics, and support emails.

2. What we collect and why#

What we do not do: We do not sell personal information. We do not share it for cross-context behavioral advertising. We show no ads, and we do not use your data to build advertising profiles.

Sensitive information. Some fields can reveal sensitive details. For example, dietary notes may reveal health or religious information, and emergency contacts identify other people. Organizations should enter only what is needed, and we use this information only to provide the Service.

iPhone app. The iPhone app (currently in TestFlight) gives access to the same Service and the same data described above. The iPhone shell is a WebView of this website. The site can ask the browser for the camera when you scan a barcode or upload a paperwork photo, and for the microphone during event voice. The browser asks first, and you can change that in iOS Settings. Apple may share crash reports and usage data from TestFlight builds with us when you have agreed to share them with developers. The iPhone app does not include a separate native crash-reporting SDK. Errors on the website it displays are reported to Sentry, as described in Section 4.

3. Legal bases (for users in the EEA, UK, and similar jurisdictions)#

Where the law requires a legal basis, we rely on:

• Contract: to provide the Service you or your organization signed up for (account, sign-in, alerts, core features).
• Legitimate interests: to keep the Service secure, prevent abuse, measure performance in aggregate, and improve features. We balance these interests against your rights.
• Consent: where we ask for it, such as for optional device permissions in the iPhone app. You can withdraw consent at any time.
• Legal obligation: where we must keep or disclose information to comply with law.

For Organization Data, the organization is responsible for having a legal basis to collect and use it.

4. Who we share information with#

We share personal information only as follows:

• Within your organization. Organization Data is visible to that organization's users, according to the roles and permissions the admins set. For example, admins can see pay rates; other users may not.
• Service providers (subprocessors) that host and operate the Service for us, bound by contract to protect the data and use it only to provide their services to us:

- Vercel: website and app hosting, serverless functions (United States, Cleveland, Ohio region), and Web Analytics and Speed Insights. - Neon: Postgres database hosting (AWS us-east-2, Ohio, USA). - Resend: sending transactional email from alerts@floorline.live (United States). The application posts to api.resend.com and does not set a Resend region. - Mapbox: address autocomplete. - PostHog, Inc.: product analytics (United States, PostHog US Cloud). Session recording is off, and PostHog is not loaded inside the iPhone app shell. - Sentry (Functional Software, Inc.): error monitoring (United States, Sentry US region). PII scrubbing is on, IP addresses are not stored, and performance tracing and session replay are off. - Intuit Inc.: QuickBooks Online, only when an organization connects it. - xAI Corp.: model processing for features such as advance-email import, at https://api.x.ai/v1. Zero Data Retention is enabled for Floorline's xAI team, so xAI does not store the request or the model's reply after returning the result. Before any text is sent, Floorline masks Wi-Fi passwords and pay or day rates. The usage log stores the organization, model, token counts, duration, and status. It does not store the prompt or the model's reply. xAI does not receive Organization Data for training. Each organization has a monthly token quota. - OpenAI, L.L.C.: the email importer's hot backup, used only if the xAI call fails. Its default model is gpt-6-luna. The same model processing and the same masking apply.

The current list is at floorline.live/subprocessors.

### Model providers

When an organization uses a model feature, Floorline sends only the text that feature needs, after the masking described above. xAI is the model subprocessor, and Zero Data Retention is enabled for Floorline's xAI team. OpenAI, L.L.C. is the email importer's hot backup, used only if the xAI call fails, and its default model is gpt-6-luna. Model providers process that text to return a structured result to Floorline. They do not decide how the organization uses the result. One organization's text is not sent as another organization's prompt. If no model key is configured, the feature runs on the file parse alone and nothing is sent to xAI or OpenAI.

If our primary AI provider (xAI) is unavailable, imported email content may instead be processed by OpenAI as a backup; OpenAI does not use API data to train its models, and may retain prompts and responses for up to 30 days solely for abuse monitoring before deletion, unless longer retention is required by law (see https://platform.openai.com/docs/guides/your-data). Floorline does not currently have Zero Data Retention with OpenAI.

### QuickBooks Online

An organization can connect its own QuickBooks Online company. Floorline then accesses only the QuickBooks data needed to sync that organization's invoices, customers, payments, and sales tax. We use that data to create and update those records in that company's books. We do not sell QuickBooks data, and we do not use it for advertising. One organization's QuickBooks data is not shown to another organization.

OAuth tokens and the QuickBooks company id (realmId) are stored encrypted. Disconnecting QuickBooks, or deleting the organization, revokes that access at Intuit and deletes the stored tokens.

• Legal and safety. If required by law, subpoena, or court order, or if we reasonably believe disclosure is necessary to protect someone's safety, the security of the Service, or our rights. Where the law allows, we will notify the affected organization first.
• Business change. If Floorline is transferred to a company or new owner, such as an LLC formed to operate it, personal information may transfer as part of that change, still subject to this Policy.

Floorline staff. Administrative access to production systems is limited to the operator, Michael Strange, and the automated development tools he operates. A platform-owner account can open the platform desk. That desk shows counts of organizations, people, signed-in accounts, events, and assets, and it shows feedback notes, including the submitter's name. It does not open an organization's events, crew, pay, or warehouse records.

A management portal is planned, not live yet. When it is live, Floorline staff will be able to open an organization's data to operate and support the Service. Read-only view-as is planned, not live yet: staff would see the Service as a chosen user sees it, and that user is not notified while the view is open. A staff audit log kept for two years is planned, not live yet. It would record staff actions in the portal. The portal, view-as, and that audit log are not in the Service today.

5. How long we keep information#

• Organization Data: for as long as the organization keeps its workspace, or until an admin deletes it. After an organization cancels, it has 30 days to request an export, and we then delete the data from active systems within 30 days.
• Account information: while your account is active. You can delete your own login in Profile. If you ask us to delete your account, we delete it within 30 days, except for data that is part of an organization's records (see Section 7).
• Backups: deleted data may stay in encrypted database backups until they are overwritten, for up to 7 days.
• Email and notification logs: 90 days.
• Anonymous feedback: 24 months.
• Server and security logs: for a limited period set by our hosting provider.
• Model usage logs: organization, model, token counts, duration, and status only. No prompt or reply text. Kept for 13 months so monthly quotas can be checked, then deleted.
• Invite and password-reset links: password reset links expire after 1 hour, and invite links expire after about 14 days.

We may keep information longer if the law requires it or if it is needed to resolve a dispute.

6. How we protect information#

Our security measures include:

• encryption in transit (HTTPS/TLS) for the website, app, and API;
• encryption at rest provided by our database and hosting providers;
• passwords stored only as one-way hashes, never in plain text;
• strict logical separation between organizations, with every data request limited to the organizations the signed-in user belongs to;
• role-based permissions within each organization;
• password reset links that expire after 1 hour, and invite links that expire after about 14 days;
• limited administrative access to production systems; and
• reputable infrastructure providers (see Section 4).

No system is perfectly secure. If a breach affects your personal information, we will notify the affected organization, and where required, you, as the law requires.

7. Your rights and choices#

Depending on where you live, you may have the right to:

• Access the personal information we hold about you;
• Correct inaccurate information;
• Delete your information;
• Export your information in a portable format;
• Object to or restrict certain processing; and
• Withdraw consent where we rely on it.

How to make a request:

• For your account: you can update much of your profile and your alert preferences and quiet hours in your settings. For anything else, email support@floorline.live with the subject "Privacy request." We may need to verify your identity, for example by confirming the request from your account email.
• For Organization Data (for example, your crew profile or pay rate held by a production company): please contact that organization. If you contact us, we will forward your request to the organization and help it respond, as described in the DPA.

We will respond within 30 days, or sooner if the law requires it. We will not discriminate against you for exercising your rights. If you are in the EEA or UK, you may also complain to your local data protection authority.

Email choices: you control which alerts you receive and your quiet hours in your settings. Account and security emails, such as password resets, cannot be turned off.

8. Children#

The Service is a workplace tool and is not intended for anyone under 16. We do not knowingly collect personal information from children under 16, and organizations must not add them. If you believe a child's information has been entered, contact support@floorline.live and we will work with the organization to delete it.

9. US state privacy rights (including California)#

Some US states, such as California, give residents rights over their personal information. These include the right to know what is collected, to delete or correct it, and to opt out of "sale" or "sharing." To the extent those laws apply to Floorline:

• The categories of personal information we collect, their sources, and our purposes are described in Section 2. The categories of recipients are in Section 4.
• We do not sell personal information and do not "share" it for cross-context behavioral advertising. We have no actual knowledge of selling or sharing information about anyone under 16.
• We use sensitive personal information, if any, only to provide the Service.
• You can exercise your rights as described in Section 7. An authorized agent may submit a request for you with your written permission.
• We do not respond to "Do Not Track" signals differently, because we do not track you across other sites. We honor Global Privacy Control signals to the extent required by law.

10. Cookies and local storage#

We keep these to a minimum:

We do not use advertising or cross-site tracking cookies.

11. International users#

Floorline is operated from the United States, and our data is stored and processed in the United States, mainly in Ohio, with a separate testing database in Virginia (aws-us-east-1). If you use the Service from outside the US, your information will be transferred to and processed in the US, where data protection laws may differ from those in your country. Where required, we rely on appropriate safeguards for these transfers, such as our providers' Standard Contractual Clauses or Data Privacy Framework commitments.

12. Changes to this Policy#

We may update this Policy. If a change is material, we will notify organization owners and admins by email or through a notice in the Service at least 14 days before it takes effect, unless a faster change is required by law. The "Last updated" date shows the latest version.

13. Contact#

• Privacy questions and requests: Michael Strange, support@floorline.live
• General help: support@floorline.live
• Location: 660 Kinderhook Rd., Columbia, PA 17512

Changes to this page#

• Oct 23, 2026: Public contact on this page is support@floorline.live. Subprocessors may change at any time without notice. This replaces the 14-day advance-notice commitment (see floorline.live/subprocessors and DPA §7.3). A management portal, read-only view-as without notice to the user, and a two-year staff audit log are planned, not live yet.
• Oct 14, 2026: Added PostHog (product analytics, US) as a subprocessor. Added a separate testing database in Virginia (aws-us-east-1) as a secondary data location. Updated the privacy contact. Clarified that xAI Zero Data Retention is enabled for Floorline's xAI team.
• Oct 2026: Added Sentry (error monitoring, US).
• Oct 10, 2026: Previous version.
• Oct 8, 2026: First published.