Privacy Policy

1. Who we are and who is responsible for your data

Fluye is a platform that structures the commercial and financial flow between companies: quotes, orders, invoicing, collections, payments and the coverage and financing enabled by our partners. This policy explains what data we process, for what purpose and what rights you have. It is deliberately written in plain language; if anything is unclear, write to us.

The company responsible for your data depends on the country from which you contract or use Fluye:

Both companies are part of the myservy group and share the same technology platform, so they may process data jointly to operate the service. Towards you, the company for your country is responsible.

2. Scope and who it applies to

This policy covers the Fluye website (usefluye.com) (in all its country and language pages), the Fluye platform and its applications for selling, buying and operating companies, and any support channel we use to provide the service.

We process data about four types of people:

Client companies are legal entities and most of what Fluye processes is company data, not personal data. This policy applies to the personal data that appears in those operations: names, contacts, roles and, when a company collects from individuals, their collection data.

3. What data we process

We only collect what is necessary to operate the service, comply with the law and improve it. We never ask for data we do not use.

We do not process sensitive data (health, religion, ethnic origin, sexual orientation, biometric data) and we ask you not to load it into Fluye. We do not store full card numbers: they are processed directly by payment providers.

4. What we use the data for

Each use has a specific purpose and a legal basis that allows it. In Venezuela the basis is the informed consent you give when accepting the Terms and Conditions, the performance of the contract and legal obligations. In Qatar the rules of the Qatar Annex also apply.

We do not sell personal data or use it for third-party advertising. We do not make automated decisions that legally affect you without human involvement: the score informs our partners, but the decision to cover or finance is theirs.

5. Your history in Fluye and the ecosystem score

Fluye calculates for each client company an operational indicator, the ecosystem score, based on how it meets its commitments within the platform. You accept this calculation when you accept the Terms and Conditions; we do not ask for an additional authorisation because it is part of the service.

What we use to calculate it:

• Payment behaviour: whether your collections are paid on time and whether you pay your suppliers on time within Fluye.
• Operational compliance: whether you deliver what was quoted, whether your invoices are issued and reconciled correctly, and the tenure and continuity of your activity on the platform.
• Context: volume and recurrence of operations, always in relation to your own activity.

What it is not:

• It is not a credit report or a credit bureau. We do not consult credit bureaus or receive information about you from other platforms to calculate it.
• It does not use data from outside Fluye: only what happens in transactions operated on the platform.
• It is not sold or published. It is seen by you and, under section 6, by the partners assessing whether to cover or finance you.

What happens with counterparties: when your customer pays a payment link or your supplier quotes through Fluye without having an account, that event feeds your score, not one of their own. If that counterparty registers later, its history in Fluye starts from its registration.

You can ask us to correct any underlying score data that is wrong.

6. Who we share your data with

We share data only with those who need it to provide the service. Each recipient receives the minimum for its function and is contractually bound to protect it.

Partner insurers and banks. They are Fluye's reason for being: the insurer covers the collection risk and the bank finances or processes payments. So that they can assess you, we share with them your transaction history in Fluye and your ecosystem score. This is authorised when you accept the Terms and Conditions. If you do not want us to share your history, you can ask the privacy contact at any time; in that case you will continue to use Fluye, but without access to coverage or financing from partners. Partners are insurers and banks authorised in each country with an agreement with Fluye; you will know the specific partner when you contract coverage or financing with it.

We do not share your history with companies that are not Fluye partners, or with other clients of the platform.

7. People without a Fluye account and individuals

If you receive a payment link or an invitation to quote without having an account, Fluye processes your data on behalf of the company that sent it to you: your name, contact and tax ID to issue the document, and the record of the payment or quote. That company is the one that has the relationship with you and must inform you that it uses Fluye; it undertakes to do so in its Terms and Conditions. Your data does not create a profile or score of your own in Fluye as long as you do not register.

If you are an individual whom a company collects from through Fluye, the personal data protection rules of your country apply in full. We process only the data that company loads to manage your collection (identification, contact, amount, due date and payments) and only for that purpose. We do not use it to assess you or share it with insurers or banks as information about you; it is used in the score of the company collecting from you, in aggregated form. You can exercise the rights in section 10 against Fluye, and also against the creditor company.

If you are a representative, employee or contact of a client company or counterparty, your identification and contact data is processed as part of the relationship with that company, to communicate with you and execute the operations you manage on its behalf.

8. Where data is stored and international transfers

Fluye operates with cloud infrastructure from international providers, so your data may be stored and processed outside your country, including in the United States and the European Union. The partners and providers in section 6 may also be in other countries.

When we transfer data outside your country, we contractually require measures equivalent to those in this policy: confidentiality, security, use limited to the agreed purpose and deletion when the service ends. The infrastructure providers we use and their country of operation are listed in the Security Policy.

Data of clients in Qatar is subject to the transfer rules of the Qatar Financial Centre data protection regime (Qatar Annex).

9. Retention, security, cookies and minors

Retention. We keep data while your account is active and for as long as the law requires afterwards. Transaction, tax and accounting records are kept for the periods set by each country's commercial and tax legislation (in Venezuela, at least those required by the Commercial Code and SENIAT rules). Data of counterparties without an account is kept for the duration of the client company's relationship with them and the legal periods. Afterwards, we delete or anonymise the data; anonymised information may continue to be used for statistics and service improvement.

Security. We protect data with encryption in transit and at rest, role-based access control, strong authentication, audit logs and backups. Details are in the Security Policy. If an incident affects your data, we will notify you without undue delay and notify the authority when the law requires it.

Cookies. The website uses cookies necessary for it to work and measures visits anonymously and without cookies (pages viewed, market, language and clicks on the main buttons), without identifying you or tracking you across visits. Only with your consent does it also use analytics cookies and session recordings, with text fields hidden, to better understand how it is used. You can manage them from the cookie notice or your browser. The platform uses only the cookies and technical storage needed to keep your session.

Minors. Fluye is a service for companies. It is not aimed at people under 18 and we do not knowingly collect their data. If we detect data of a minor, we delete it.

10. Your rights and how to exercise them

You have the right to:

• Access the data we hold about you and know how we use it.
• Correct inaccurate or incomplete data, including the underlying data of your score.
• Delete your data when it is no longer needed, except what we must keep by law.
• Object to specific uses, such as marketing or sharing your history with partners (section 6).
• Withdraw your consent for processing based on it, without affecting what has already been done.
• Receive a copy of your transaction data in a machine-readable format when you close your account.

To exercise them, write to the privacy contact for your country (section 1) from the email registered in your account, or from the platform. We respond within a maximum of 15 business days; if the request is complex we will let you know and may extend the period once. We do not charge for handling these requests unless they are repetitive or manifestly unfounded.

If your data was loaded by a client company (you are its counterparty or debtor), we may ask you to confirm the request with it, because it decides on that data in its operation. If you are not satisfied with our response, you can go to the authority or court indicated in your country's annex.

Venezuela Annex

Applies to clients, counterparties and visitors who contract or use Fluye from Venezuela. The controller is Sbcompanies C.A.

• Legal framework. Venezuela does not have a general data protection law. This policy follows the rights of access and rectification (habeas data) in Article 28 and the right to privacy in Article 60 of the Constitution, the principles set by the Constitutional Chamber of the Supreme Court of Justice in judgment 1318 of 2011 (consent, purpose, quality, security, confidentiality and ARCO rights), the Law on Data Messages and Electronic Signatures and the Special Law against Computer Crimes.
• Consent. By accepting the Terms and Conditions of Fluye Venezuela you give informed consent to the processing described in this policy, including the ecosystem score and sharing your history with partner insurers and banks. You can revoke it as set out in section 10.
• Banking and financial data. Account and payment operation data is also processed in accordance with the rules of the Superintendency of Banking Sector Institutions (SUDEBAN) and the agreements with partner banks, including banking secrecy.
• Tax data. Invoicing data is kept and shared as required by SENIAT and the electronic invoicing rules in force.
• Complaints. If we do not resolve your request, you may go to the competent courts of the Bolivarian Republic of Venezuela, including the habeas data action.
• Language. For Venezuela, the Spanish version of this policy prevails.

Qatar Annex

Applies to clients, counterparties and visitors who contract or use Fluye from the State of Qatar, and to international enquiries received through the website. The controller is myservy LLC, an entity registered in the Qatar Financial Centre (QFC No. 05314) and incubated at Qatar Science & Technology Park. The Fluye service in Qatar will be commercially available when we announce it on that market's page; in the meantime, this annex covers interest-registration and contact data.

• Legal framework. As it is registered in the QFC, myservy LLC is governed by the QFC Data Protection Regulations 2021 and the Data Protection Rules 2021, supervised by the QFC Data Protection Office, which follow a standard equivalent to the European one. Law No. 13 of 2016 of the State of Qatar applies to processing outside the scope of the QFC. If Fluye's operation in Qatar were transferred to an entity outside the QFC, we would update this annex.
• Principles. We process data lawfully, fairly and transparently, for explicit and legitimate purposes, limited to what is necessary, accurate, for the time needed and with appropriate security measures, and we are accountable for demonstrating this.
• Legal bases. We use performance of the contract and compliance with legal obligations to operate the service, legitimate interest for security and improvement, and consent for marketing. For the ecosystem score and sharing with partners, acceptance of the Terms and Conditions of Fluye Qatar constitutes your consent; for data of individuals in collections we will also request specific consent, revocable at any time.
• Transfers outside the QFC and Qatar. We transfer data to providers and partners in other countries only with adequate contractual safeguards or to jurisdictions with a recognised level of protection, and we document the basis for each transfer.
• Incidents. We will notify the QFC Data Protection Office of security breaches that may affect data subjects' rights, within the deadlines set by the QFC rules, and the affected data subjects when the risk requires it.
• Additional rights. In addition to those in section 10, you can request restriction of processing and portability of your data, and not to be subject to decisions based solely on automated processing with legal effects.
• Complaints. You can lodge a complaint with the QFC Data Protection Office if you consider that we have not respected your rights.
• Language. For Qatar, the English version of this policy prevails.

Changes, language and contact

We may update this policy when the service, partners or the law change. We will publish the new version on the website with its date, and if the change materially affects how we use your data we will notify you by email or on the platform at least 15 days in advance. Continuing to use Fluye after that date means accepting the updated version.

This policy is published in Spanish and English. If there are differences between versions, the one indicated in your country's annex prevails.

Privacy contact for all countries: privacy@usefluye.com. Last updated: 2 November 2026.