Privacy Policy

Last updated: October 1, 2026

Service: Flocara web, PWA, Android, and iOS applications

Contact: Flocara LLC

Email: support@flocara.com

Mailing address: 5636 Johnson Street #1208, Hollywood, FL 33021, United States

The short version

Flocara collects the information needed to run an automotive-service marketplace and Lifestyle clubs and events, secure accounts, communicate, process uploads, and improve reliability. The Service is currently free, does not process payments, does not sell personal information, and does not use personal information for targeted advertising.

This Privacy Policy explains how Flocara LLC ("Flocara," "we," "us," or "our") handles personal information when you use the Service. It applies to clients, businesses, business-workspace members, Lifestyle organizers, club members, event participants, administrators, and visitors.

1. Who may use Flocara

You must be at least 18 years old to create an account or use the marketplace. Flocara is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided information to Flocara, contact support@flocara.com.

2. Information we collect

• Account and security. Name, username, email address, US phone number when provided, password hash, email/phone confirmation status, MFA and recovery information, legal-document acceptances, the AI-consent agreement flag and its last agreement date/time and version, organizer-rules acceptance, account type, workspace membership and permissions, invite history, sessions, refresh-token records, and security events.
• Profiles and business details. Profile and business names, photos, descriptions, service categories and tags, business approval/application information, contact and social links, work schedule, time zone, service area, favorites, ratings, and profile-completeness status.
• Vehicles, addresses, and location. Saved vehicle details and photos; saved or request-related addresses; city, state, ZIP code, coordinates, search radius, and location-derived distance. If you use current-location features, we process the location supplied by your device.
• Marketplace content. Request text, AI-generated request titles and classifications, timing and estimates, offers and prices, status history, chats, reviews, reports, support tickets, internal business notes, administrative actions, calendar entries, and related photos or videos.
• Business client connections and sharing choices. Connections between a servicing business and a personal or business customer; invitation, acceptance, decline and archive state; service-history summaries derived from that business's existing requests; the vehicles and optional contact email/US phone expressly selected for ongoing sharing; grant actor/time and the latest sharing-choice actor/time and disclosure version. Sign-in and account-recovery contacts are not automatically supplied as client contacts.
• Lifestyle activity. Organizer and club profiles, contact details, club photos, membership and join requests, invitations, organizer follows, event descriptions, dates and time zones, venues and routes, participant rules, public/private visibility, external ticket links and displayed prices, RSVP choices, vehicle participation applications and selected vehicle details/photos, event chats, review decisions, cancellations, and related notifications.
• Device and diagnostic information. IP address, user agent, browser and operating-system details, device and app identifiers, app version, push token or browser subscription, notification preferences, last activity, approximate session location, network/lifecycle events, error details, and sanitized diagnostic logs.
• Information from others. Other users may provide information about you in requests, chats, reviews, reports, invites, workspace records, or support communications.

If you confirm vehicle sharing with a business, we create or update a connection between your selected personal or business workspace and that business, together with the selected vehicle permissions and the account, time and disclosure-version details of your choice. The optional prompt after saving a favorite does not itself share garage or contact details, and its vehicle-only confirmation does not copy your sign-in email or recovery phone.

Flocara does not currently collect payment-card or bank-account information because the Service does not process payments or paid memberships. We do not intentionally collect Social Security numbers, government identification numbers, health records, or biometric templates. Please do not include unnecessary sensitive information in free-text fields, messages, uploads, or reports.

If you choose Sign in with Apple or Google, we receive the provider's account identifier and the identity information it supplies, which can include your email address, email-verification status and name. Apple may supply a private relay address instead of your usual address. We store the connection to your Flocara account and encrypted Apple authorization information needed to revoke that connection. We do not receive your Apple or Google password.

If you add a passkey, we store its public key, credential identifier, chosen name and creation/usage information. Your device or credential provider manages the private key and any biometric or device-unlock verification; Flocara does not receive biometric templates or the passkey's private key.

3. How we use information

• Operate the marketplace. Create accounts and profiles; manage workspaces; publish and match requests; deliver offers, chats, reviews, calendars, favorites, notifications, and support.
• Operate Clients and optional business sharing. Organize a business's customers and its own permitted service history, deliver connection invitations and notices, display expressly shared vehicle/contact information, enforce workspace permissions, and record changes or withdrawal of sharing choices. This module does not introduce a new AI-processing purpose, advertising use, or new service provider.
• Operate Lifestyle. Review organizers and events; manage clubs, memberships and invitations; show events and participation; provide event chats, calendar entries, updates, and cancellations.
• Process requests with AI after your explicit permission. Summarize request text, extract vehicle/timing/location details, classify categories and tags, and detect directed abuse, hate, or threats.
• Protect Flocara. Authenticate users, manage sessions, prevent fraud and abuse, enforce permissions, investigate reports, preserve evidence, and maintain platform integrity.
• Communicate. Send verification codes, account and workspace notices, service updates, push notifications, support replies, and legal-policy updates.
• Maintain and improve. Process diagnostics, monitor reliability, fix errors, measure aggregate service activity, and improve matching and user experience.
• Meet legal obligations. Respond to lawful requests, protect rights and safety, maintain required records, and provide legally required security-incident notices.

You can choose to share selected vehicles with a business to help it prepare quotes and plan prospective automotive services, even before accepting an offer. Favoriting is not separate sharing consent, and neither action guarantees a quote, faster service or a completed booking.

We may use a protected, separate testing environment to investigate errors and check changes before release. A limited copy of existing account and service records may be used for this purpose. Testing records and actions are separate from the live marketplace and do not update live requests, conversations or account settings. Existing authentication and content-access controls apply.

4. When information is shared

• Other Flocara users. Profile information and marketplace content are shared with the people and businesses involved in the relevant profile, request, offer, chat, review, calendar entry, or workspace. Request location and vehicle information may be shown to matched or selected businesses as needed to provide the requested service.
• Business client visibility. A servicing business may see the customer identity and service information already associated with its permitted requests. Ongoing access to a customer's other saved vehicles or optional contact details requires that customer's separate selection. The shared garage displays selected vehicle make, model, year, color and photo, not unrelated garage vehicles, VIN, or history with other businesses. Shared information is available to the business's current owner and authorized workspace members; request and chat access restrictions still apply. Public business contact information may remain visible independently of optional sharing. Business connections and business-scoped sharing continue when the relevant business changes owners; personal account data is not transferred. Selecting specific vehicles or accepting updated Terms/Privacy documents does not automatically authorize future garage additions or unrelated disclosures.
• Lifestyle visibility. Public event and club pages may show names, descriptions, photos, organizer/club contact details, event locations and routes, schedules, and participation counts. An event's public setting makes its content discoverable; private event details are restricted to authorized club members, the organizer, and administrators. A private event does not make the club's public profile private. Organizers can see RSVP participants' names and profile photos and review vehicle applications. Approved vehicle participants' selected vehicle details/photos may be displayed to people allowed to view the event. Do not include sensitive details in public descriptions, contact fields, routes, or photos.
• Lifestyle messages and external links. Event-chat messages are shared with authorized chat participants and may be accessed by authorized Flocara personnel for support or moderation. Following an organizer or joining a club enables the relevant in-app features; it does not authorize unrelated use of your information. External registration and payment websites collect information under their own policies. Flocara does not receive your payment-card details from those websites.
• Flocara personnel and administrators. Authorized personnel may access information when needed for support, business review, moderation, reports, security, legal compliance, or system administration.
• Service providers. We use providers to host the Service, process AI requests, deliver messages and notifications, resolve addresses and approximate session locations, and store media. They receive only the data used for those functions.

For customer-initiated vehicle sharing, only the selected make, model, year, color and current vehicle photo are made available through this sharing feature to the business's authorized team. VIN, unrelated service history and future garage additions are not included.

• Legal, safety, or organizational events. We may disclose information when reasonably necessary to comply with law, respond to lawful process, protect people or Flocara, investigate fraud or abuse, or complete a merger, financing, acquisition, reorganization, or sale of assets subject to appropriate protections.

We do not sell personal information, share it for cross-context behavioral advertising, or use third-party advertising trackers. If Flocara later adds paid memberships, payment processing, advertising, or materially different providers, we will update this policy before those changes apply.

5. AI processing and your permission

Before sending the information described above to OpenAI for a new request analysis or business-description analysis, Flocara asks you to agree explicitly. Accepting this Privacy Policy or the Terms is not a substitute for that separate permission. AI helps suggest request titles, extract relevant details, and classify categories and tags before the applicable review process. It can make mistakes; you should check the resulting information. It does not provide professional automotive, legal, financial, insurance, medical, or safety advice.

Flocara stores whether you agreed, the last agreement date/time in UTC, and the disclosure version. This choice applies to your account across devices. You can withdraw permission in Settings > Security for future analysis. Cancelling the prompt keeps your input without starting analysis. Because these request and business-analysis features depend on AI, you cannot complete those AI-dependent steps without permission; other available features remain accessible. There is currently no alternative manual-only submission path for these steps.

Withdrawing permission prevents future authorized analysis; it cannot recall information already transmitted to OpenAI or erase processing already completed. The last agreement date and version remain with the consent record when you withdraw. OpenAI processes transmitted information under its applicable API data controls, including retention for service operation and abuse prevention. We do not promise zero provider retention. See OpenAI's API data controls for the provider's current practices.

Email and notification choices

Optional email notification categories start unchecked. You can enable or disable them in notification settings, including available request, review, chat, and Lifestyle updates. Push delivery also requires the applicable device/browser permission and channel preference. Essential verification, security, account-deletion, and legal communications may still be sent without opting into optional activity emails. Email delivery records may include recipient addresses, timestamps, message identifiers, delivery results, and failure details so we can diagnose missing messages; these are not proof that a recipient read an email.

6. Retention and account deletion

We keep information for as long as reasonably needed to provide the Service, maintain security and marketplace integrity, resolve disputes, comply with law, and enforce agreements. Retention depends on the type and status of the record. Current important rules are:

• Active account and marketplace records. Kept while the account or related service history remains active and longer when needed for completed-work history, safety, moderation, disputes, or legal obligations.
• Client sharing records. Ongoing shared contacts and vehicle grants remain until the customer changes or withdraws the choice, the vehicle is removed, or applicable account deletion removes the records. Withdrawal removes the live vehicle grants and stored shared contact values; minimal connection state and the latest choice's actor/time/version remain to operate the connection and document its current state. Pending invitations expire after 30 days, but expiry does not itself erase the connection record. Account deactivation/suspension or blocking prevents further module access while it applies. Final deletion removes personal client connections and grants under the account-deletion process. Business-scoped records stay with the business during ownership transfer. Existing requests, request vehicle snapshots and chats follow their separate retention/redaction rules. Withdrawal cannot recall information already viewed or copied by a recipient.
• Lifestyle retention. Event records with an end date are normally eligible for cleanup 365 days after that date, together with related attendance/vehicle-participation records and unreferenced event media. Shared media is not removed while another retained record still needs it. Active club/organizer records and retained chat history follow the account and integrity rules described here.
• Diagnostics. Sanitized browser/PWA and native diagnostic journals are bounded and kept locally for up to 72 hours. A Bug or Problem report automatically uploads the current diagnostic bundle; a Suggestion does not.
• Reports and delivery jobs. Submitted report files are normally removed 30 days after resolution. Terminal push-delivery, completed AI-job, and account-deletion email-delivery records are normally cleaned up after 30 days under current configuration.
• Account deletion. Deletion starts with immediate deactivation and a seven-day cancellation period. At finalization, direct identity, contact, authentication, profile, address, garage, notification, non-chat media, Lifestyle memberships/follows/invites and participation data, and most request/review content are deleted, redacted, or tombstoned. Retained organizer, club, or event records may be tombstoned or anonymized to preserve related history. Chat history and limited integrity records may remain under a "Deleted user" label; chat media remains with the conversation. Review text and media authored by the deleted user are removed, while aggregate rating values may remain.
• Backups and holds. Residual copies may remain temporarily in secured backups until overwritten. Records may be kept longer when subject to a fraud, safety, evidence, dispute, or legal hold.

To avoid repeatedly showing the optional sharing prompt, Flocara may store a limited preference on your device identifying your account, selected workspace and the business for which the prompt was shown. It contains no vehicle or contact details and does not authorize sharing. Clearing app/site data removes this preference; older entries are also removed when its limit is reached. If device storage is unavailable, the preference lasts only for the current app session.

Testing copies remain subject to our retention, security, deletion and privacy request practices. A testing copy does not justify retaining information after its testing purpose ends or restoring information already erased.

7. Security

We use administrative, technical, and physical safeguards designed for the information we handle, including access controls, encrypted network transport, protected authentication credentials, session management, private media storage, rate limits, and security monitoring. No system is completely secure. If a security incident requires notice under Florida or other applicable law, we will provide the required notices.

8. Your choices

• Account and profile. Review or update available account, profile, vehicle, address, business, workspace, and notification settings in Flocara.
• Business sharing. In Settings > Business sharing, review invitations and connections, accept without sharing additional information, decline, select specific vehicles and optional contact details, or stop all ongoing sharing for a business. New vehicles and personal security contacts are never selected automatically. Review the separate sharing explanation before granting access; accepting this policy is not a substitute for that choice.
• Location, camera, media, and push. Control device or browser permissions and notification preferences. Some features will not work when their permission is disabled.
• AI consent and Lifestyle. Manage AI permission in Settings > Security. Review your club membership, follows, RSVP choices, event visibility, and notification preferences in the corresponding features.
• Sessions. Review signed-in devices and terminate sessions you do not recognize from the Sessions page.
• Delete your account. Start deletion from Settings > Security after active work is completed or cancelled, or use our public account deletion request page. You may cancel during the seven-day grace period.
• Privacy request. Email support@flocara.com with the subject "Privacy Request" to ask about, access, correct, or delete your personal information. We may verify that the request comes from you and will honor rights required by applicable law.

You can review or stop ongoing sharing in Settings > Business sharing, or use Manage sharing on an eligible business profile. Removing a business from favorites does not automatically revoke a separate sharing choice. Stopping sharing removes ongoing garage/contact access but does not erase existing request/chat history or minimal connection and latest-choice records kept as described in this policy.

Contact support@flocara.com for a privacy request that should apply across environments.

• Policy updates. We may update this policy when the Service, our providers, or legal requirements change and may provide an in-app notice for material updates. The date at the top identifies this revision.