Flolah

Privacy Policy

Version 2026-08-29 · Effective 29 August 2026

Related: Cookie Policy and Terms of Service.

1. Who we are

Flolah operates the AI Company OS (for example login.flolah.cloud and marketing site flolah.cloud).

2. Data we collect

• Account data: name, email, password hash, optional region/mobile, company/industry, role.
• Security: MFA settings, sessions, password-reset tokens, login times.
• Usage: feature activity, workflow runs, tool invocations, operational logs (secrets redacted where designed).
• Content you provide: chats, documents, media, configs, vault API keys you store.
• Technical: IP and user agent may appear in logs for security.
• Promotions: eligible delivery, impression, viewable, expand, dismiss, suppression, CTA, and channel-delivery evidence. Rendering is not treated as proof that you read an announcement.
• MCP Universe: public searches, listing interactions, moderated submissions and reports, human-verification evidence, and pseudonymous abuse-control identifiers.
• Legal acceptance: timestamp and Terms/Privacy version IDs when you accept at registration.

3. How we use data

• Provide, secure, and support the Service
• Authenticate users and enforce entitlements / CEO tenant isolation
• Run AI employees and tools you enable (prompts/content may go to model providers you select)
• Operational communications and abuse prevention

4. Sharing

We do not sell personal data. We share data with subprocessors only as needed (hosting, email, model APIs you configure, OAuth providers you connect). Multi-tenant design isolates CEO workspaces.

5. BYOK and AI processors

If you configure BYOK or platform LLM access, related content may be sent to third-party model providers under their practices. Review those providers before enabling them.

6. Business apps (CRM and similar)

CRM and similar features may run on separate hostnames and set their own cookies/storage. See the Cookie Policy.

7. Retention

Data is retained while your account is active and for a reasonable period afterward for backups, disputes, and legal compliance. In-product retention settings may apply. Offboarding deletes or anonymizes data subject to legal holds.

8. Security

We use production TLS, hashed passwords, session tokens, and log redaction. No system is perfectly secure.

9. Your choices

Update profile fields, revoke keys, disconnect OAuth, and request offboarding where available. Depending on location you may have access/correction/deletion rights - contact published support channels.

10. Children

The Service is not directed to children under 16 (or higher age where required). Do not register if under that age.

11. Changes

We may update this Policy with a new version ID (currently 2026-08-29).

12. Contact

Privacy questions: in-product support or flolah.cloud contact channels.