Privacy Policy

The controller is LPP Media Influence Corporation, a Florida corporation doing business as Floxu ("Floxu", "we", "us"), with its principal place of business at 8400 NW 33rd St, Ste 310, PMB 2038, Doral, FL 33122 and operations in Miami · Ciudad de México · Bogotá.

This policy covers the floxu.app site, the product at floxu.app/app, the waitlist, the emails we send, and any communication you have with us.

Floxu is the rebrand of LPP Media Influence. If you signed up under that name, your data and history are the same and are now handled under this policy, by the same company. There was no sale or transfer of data to a third party: the name changed, the company did not.

• Visitors to the site.
• People on the waitlist, in any of the three roles: brand, creator or artist.
• Account holders: creators, brands, agencies, artists and administrators.
• Creators we contact for the first time based on public information, before they have an account. How we reach them is section 5.

• We do not sell personal data, and we do not share it for cross-context behavioral advertising.
• Your postal address is visible only to the parties to that one shipment. No query on the platform returns addresses in bulk — not even for an administrator.
• A brand sees your profile, your metrics and what you deliver. It does not see your banking details or your tax documentation.
• Payments are processed by Stripe. Floxu does not store card numbers or banking credentials.
• If we email you without you having signed up, every message carries a one-click unsubscribe that we honor permanently.

From the public site:

• Technical data: IP address, browser, operating system, language, device type and approximate country derived from IP.
• Usage data: pages viewed, sections reached, traffic source.

From the waitlist:

• Email address and the role you chose (brand, creator or artist).
• Where the visit came from: utm_* parameters, gclid, fbclid, referral code, referrer and the path you signed up from. We keep these because a lead whose origin you do not know is a lead you cannot make decisions about.
• Your referral code, how many people you brought, and your position on the list.
• Whether the confirmation email was delivered.

From any account:

• Identity and contact: name, email, phone, country and city.
• Authentication handled by Firebase Authentication, and the role assigned to the account.
• Product activity: which campaigns you see, which you apply to, deliveries, approvals, rejections, and messages with our team.

From creators, additionally:

• Professional profile: handle on each network, niche, country, language, stated audience and rates.
• Metrics on posts tied to a campaign: views, likes, comments and when they were measured.
• Full postal address, recipient name and contact phone, when a campaign involves shipping product.
• Payment and tax data: Stripe Connect account, W-9, W-8BEN or W-8BEN-E forms, tax identification and payment history.
• Live sessions: date, duration, sales you report and sales we verify, the resulting commission and payment status.
• The content you deliver: drafts, video, images and the link to the live post.
• Your media kit: photo, cover, bio, sample photos and videos, brands you have worked with and your social metrics. Every metric records where it came from — stated by you, read from your public profile or, if you connect your account, from the network's official API.
• If you connect a social account through that network's official authorization, the data that authorization allows: profile, posts, and reach and audience statistics (age and country, aggregated). Never your password.

From brands and agencies, additionally:

• Company data and the people representing it: legal name, website, sector, country, tax identification, name, job title and email.
• Campaigns: brief, product, commission offered, fee, slots and budget.
• Billing and payment-method data, processed by Stripe.
• For agencies, the relationship with each creator they manage.

From artists, additionally:

• The works and audio you upload, their metadata and the ownership representations you give us.
• Sound-campaign performance: participations, slots used, and metrics on posts that used your audio.

From the email we send:

• Whether a message was delivered, whether it was opened — via an image pixel — and whether you unsubscribed. We use this only to stop writing to people who do not want to hear from us and to spot delivery problems.

Part of our work is finding creators who fit a campaign and offering them the work. To do that we build profiles from information that is already public: your handle, your bio, your niche, your country and the visible metrics on your posts, gathered with third-party analysis tools. If your email is public on your profile, we write to that address.

• We use no credentials, access no private data, and buy no contact databases.
• The first email says who we are, why we are writing and how to get out. Unsubscribing takes one click and is permanent: we keep your address on a suppression list precisely so we never contact you again.
• You can ask us to delete your prospecting profile at any time, even if you never had an account, by writing to privacidad@floxu.app.
• Prospecting emails carry an open pixel. If you would rather it did not load, your email client can block remote images.

• Running the marketplace: creating accounts, showing campaigns to people who qualify, managing applications, slots, deliveries and approvals.
• Matching creators and campaigns by country, niche, platform and audience. Matching is automated; applying is your decision and choosing is the brand's.
• Putting you forward for campaigns published on other creator marketplaces when you have authorized us to represent you, as the Terms explain. For that we share your professional profile and media kit with that marketplace — never your address, phone or payment data.
• Using artificial-intelligence models to read and structure the text of campaigns and listings — budget, slots, requirements, contact — so we can price and match them. These models make no decision with a financial effect on you (see the note below), and we do not use your data to train our own or third-party models.
• Coordinating the product shipment and its tracking.
• Verifying the sales from a live and calculating the resulting commission and payout.
• Processing charges and payouts, and meeting the tax and reporting obligations that apply to us.
• Preventing fraud: inflated metrics, duplicate accounts, impersonation, simulated sales and platform circumvention.
• Supporting you and telling you what is happening in your account and your campaigns.
• Measuring which acquisition campaigns work, using the origin parameters described above.
• Sending you commercial communications where appropriate, always with an unsubscribe.
• Complying with law, answering valid requests and defending our rights.

No decision with a financial effect on you is made by an algorithm alone. Approving a delivery, verifying a live and restricting an account are all reviewed by a person, and you can ask for a second review.

When a campaign means product reaches you, we need a real address. It is the most sensitive thing we hold, and the system is built accordingly:

• The address is stored against one shipment, not against a public profile.
• Only the parties to that shipment can read it: you, whoever dispatches it, and the administration team.
• No bulk response includes addresses. A shipment list returns status and tracking, never home addresses, even for an administrator. There is no way to obtain several creators' addresses in a single request.
• Courier and tracking number are logistics, not personal data, and are edited by whoever ships.
• We share your address with the courier, and with the brand only where the brand is the one dispatching the product.

Commissions are calculated on the sales figure Floxu verifies, not on what is self-reported. To verify it we use TikTok Shop reports, the brand's data and the post's public metrics. We store both what you reported and what was verified, along with who confirmed it and when, because a payment with no audit trail cannot be defended to either side.

• Necessary: session, authentication, security and rate limiting. Without them the product does not work.
• Preference: settings we keep in your browser.
• Measurement: aggregate use of the site and the product.
• Campaign: the origin parameters in section 4, which travel in the URL you arrive on.
• Open pixel in the emails we send.

If we ever add third-party advertising pixels, you will see them in the cookie panel and they will load only if you accept them. We honor the browser's Global Privacy Control signal as a valid opt-out.

• The other side of a campaign: the brand sees your profile, your metrics and your delivery; you see who the brand is and what it offers.
• The courier, to get the product to you.
• Stripe, to charge and to pay.
• Google Cloud and Firebase, where the database lives, and Vercel, where the application is served.
• Resend, which delivers our transactional email.
• Our CRM, GoHighLevel, where commercial follow-up is managed.
• Social analysis tools, such as Apify, that return public metrics for posts and profiles.
• Artificial-intelligence providers, such as kie.ai, that process campaign and listing text on our behalf and have no right to use it for their own purposes.
• Other creator marketplaces, only when you authorize us to put you forward for one of their campaigns, and only your professional profile and media kit.
• Meta or the relevant network, when you connect your account through its official authorization.
• TikTok, strictly as needed to reconcile the sales from a live.
• Legal, accounting and audit advisors, under confidentiality.
• Authorities, on a valid request or where necessary to investigate fraud.
• An acquirer, in a corporate transaction, with notice before your data falls under a different policy.

We do not sell personal data for money, and we do not share it for advertising based on your behavior across third-party sites, as those terms are defined by California law and the other state privacy laws.

We operate from the United States and our primary servers are there, while we work with creators and brands in Mexico, Colombia and the rest of Latin America. If you connect from outside the United States, your data is transferred there and to the countries where our providers operate. For transfers originating in the European Union or the United Kingdom we apply the Standard Contractual Clauses; for those from Latin America, equivalent contractual safeguards with each provider.

• Waitlist: until you ask to be removed, or up to 24 months without activity.
• Account and profile: while the account is active and up to 12 months after closure.
• Campaigns, deliveries, shipments, sales and payments: 7 years, for accounting and tax obligations.
• Postal addresses: up to 12 months after the shipment closes, unless needed for an open dispute.
• Email suppression list: indefinitely, because it is the only thing that guarantees we never write to you again.
• Technical and security logs: up to 24 months.
• Aggregate data that no longer identifies you: indefinitely.

We encrypt in transit and at rest, delegate authentication to Firebase, enforce access rules in the database itself — not only in the application — and limit internal access to what each role needs. Operations that create money run inside a transaction and leave an audit line, so a repeated request does not pay twice. No system is perfect: if a breach affects your data we will notify you and the competent authorities within the timeframes applicable law requires.

Floxu is for people 18 and over. We do not allow accounts held by minors, or minors receiving product or payment, and we do not knowingly collect data from children under 13. If we find an underage account we close it and delete the data.

Wherever you live, you can ask us for:

• Access: what data of yours we hold, and a copy in a portable format.
• Correction of anything wrong or incomplete.
• Deletion, except what we must keep for legal, accounting or tax reasons.
• Objection to or restriction of a particular processing, including commercial prospecting.
• Withdrawal of a consent, without effect on what was processed beforehand.
• Freedom from retaliation for exercising any of these rights.

Write to privacidad@floxu.app from your account email. We respond within 45 calendar days, extendable by a further 45 for complex requests with prior notice. We may ask for extra information to confirm it is you. A representative may act on your behalf with adequate proof of authority.

If you live in California, Virginia, Colorado, Texas or another state with a consumer privacy law, those rights include knowing the categories of data, their purposes and the third parties we share them with — all described above — and opting out of sale or of sharing for behavioral advertising, which we do not do. You may appeal a denial by writing with the subject "Appeal", and then contact your state attorney general.

Connected accounts: you can disconnect a social network from your profile or from that network's settings, and we stop reading it at that moment. To have us also delete the data we obtained from it, write to privacidad@floxu.app with the subject "Delete social data"; we do it within 30 days and confirm by email once done.

If you live in Mexico you may contact INAI. In Colombia, the Superintendencia de Industria y Comercio. In the European Union or the United Kingdom, your supervisory authority.

Every commercial email we send identifies the sender, includes a valid postal address and an unsubscribe link we action within 10 business days, in line with the CAN-SPAM Act. Strictly operational messages — a shipment status, a live verification, a payment — cannot be unsubscribed from while you have an active campaign, because they are part of the service you signed up for. Our email comes from hola@floxu.app.

We may update it. Where a change is material we will tell you by email or with a prominent notice on the site at least 15 days in advance. The last-updated date is always at the top of this page.

Privacy: privacidad@floxu.app · Legal: legal@floxu.app · General: hola@floxu.app

LPP Media Influence Corporation — 8400 NW 33rd St, Ste 310, PMB 2038, Doral, FL 33122