Legal

Privacy Policy
How we handle your data

Fluctus collects very little, keeps it only as long as it is useful to you, and never sells it. This page says exactly what we hold, why, and how to ask us about it.

Last updated 3 November 2026

1. Who Is Responsible for Your Data

The controller of the personal data described here is Adam Worrell, co-founder, acting on behalf of Fluctus, a Barbadian company being registered by its co-founders. When the company is incorporated it becomes the controller, and this page will be updated to say so. You can reach us at admin@fluctus.cloud.

2. What We Collect, and Why

We only collect what each thing you do on the site needs.

Registering interest

When you leave your email to be told when backing, partnerships or API access open, we store the email address, which of those you asked about, and the page or button you used. We use it for one purpose: to tell you when that thing opens.

Backing a phase

When backing opens and you back a phase, we store your name (unless you choose to stay anonymous), your email address, the amount, the phase, the campaign link you arrived from (for example WhatsApp or Instagram), and whether you asked to be listed on the backer wall. Stripe processes the payment and receives your card details; we never see your card number. From Stripe we keep the payment reference, the amount, the payment status, the card brand and its last four digits, and we issue a numbered receipt. We use this to deliver your perks, send your receipt and updates, and keep accounts.

Partner listings

If your organisation backs a buoy, we store the organisation name, the contact email, and the logo, link and message you choose to publish on the partners wall. We publish only what you enter on the setup page, and you can change or remove it by emailing us.

Emails we send

We keep a copy of each email we send you (receipts, partner setup and campaign updates), the address it went to and whether it was delivered. Our email provider is Resend. Every mailing carries a one-click unsubscribe link, and we stop campaign updates the moment you use it. Receipts for payments you make are still sent, because you are entitled to them.

Analytics

If you accept analytics, we use PostHog to see which pages are read and which buttons are used, so we can improve the site. PostHog sets a cookie or local-storage entry to recognise a return visit. We do not store your IP address in analytics, and we do not use analytics data for advertising. If you decline, nothing is loaded and nothing is recorded.

Server logs and security

Our host, Vercel, keeps standard server logs (addresses, pages requested, times) for security and fault-finding. To stop abuse, our forms count requests from an address for a few minutes in memory; that count is never written to a database.

3. Our Grounds for Using It

In the plain words of the Data Protection Act 2019 of Barbados: we process your interest registration because you asked us to; your backing details because we have a contract with you to deliver what you paid for; server logs and anti-abuse counts because we have a legitimate interest in running a safe and working site; and analytics only with your consent, which you can withdraw at any time.

4. Where Your Data Is Processed

The site is hosted by Vercel and the database is run by Supabase, both in the United States. Payments are processed by Stripe, email is sent by Resend, and analytics, if accepted, runs on PostHog in the United States. Each of these companies acts on our instructions under its own data-processing terms. Because they are outside Barbados, your data is transferred abroad; we choose providers that publish their security practices and we send them only what the service needs.

5. How Long We Keep It

Interest registrations

Until the thing you registered for opens, plus 12 months, or until you ask us to delete it, whichever comes first.

Backing and partner records

Seven years from the payment, because accounting and tax rules require it.

Email logs

24 months from sending.

Analytics

12 months, then deleted or made anonymous.

6. Your Rights

Under the Data Protection Act 2019 you can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, object to how we use it, and withdraw any consent you gave. Email admin@fluctus.cloud with the address you used on the site and we answer within 30 days. If you are not satisfied with our answer, you can complain to the Data Protection Commissioner of Barbados.

7. Cookies and Local Storage

Admin session cookie

Set only when a member of our team signs in to the admin area. Visitors never receive it.

Your analytics choice

Whether you accepted or declined analytics is kept in your browser's local storage so we do not ask again. It holds no personal data.

Analytics cookies

Set by PostHog only after you accept analytics.

Payment form

When backing opens, the card form is provided by Stripe, which sets its own cookies inside the form to prevent fraud.

Campaign link

The link you arrived from (its source, medium and campaign tags) is kept in your browser's session storage until you close the tab, so a backing can be credited to the right channel.

8. The Camera at Soup Bowl

Fluctus plans a camera above the Soup Bowl break to measure the waves as they break. It will film the sea surface at the break, not the beach or the people on it. Any face that does enter the frame will be blurred before a clip is stored, clips will be kept for 30 days and then deleted, and only wave measurements will be kept longer. Before the camera goes live we will publish a full notice and a data protection impact assessment on this page, and register with the Data Protection Commissioner.

9. Changes to This Policy

When this page changes we update the date at the top and, for any change that affects how we use data you have already given us, we email you first. Earlier versions are available on request.

10. Contact

Questions about this policy or your data: email admin@fluctus.cloud. See also our Terms of Use and Founding Backer Terms.