Privacy Policy
Version 2026-08-29 ยท Effective 29 August 2026
Related: Cookie Policy and Terms of Service.
1. Who we are
Flolah operates the AI Company OS (for example login.flolah.cloud and marketing site flolah.cloud).
2. Data we collect
- Account data: name, email, password hash, optional region/mobile, company/industry, role.
- Security: MFA settings, sessions, password-reset tokens, login times, login IP addresses, and country derived locally from the login IP.
- Usage: feature activity, workflow runs, tool invocations, operational logs (secrets redacted where designed).
- Content you provide: chats, documents, media, configs, vault API keys you store.
- Technical: IP and user agent may appear in logs for security. Login-country lookup is local and does not send the IP to an external lookup API.
- Promotions: eligible delivery, impression, viewable, expand, dismiss, suppression, CTA, and channel-delivery evidence. Rendering is not treated as proof that you read an announcement.
- MCP Universe: public searches, listing interactions, moderated submissions and reports, human-verification evidence, and pseudonymous abuse-control identifiers.
- Legal acceptance: timestamp and Terms/Privacy version IDs when you accept at registration.
3. How we use data
- Provide, secure, and support the Service
- Authenticate users and enforce entitlements / CEO tenant isolation
- Run AI employees and tools you enable (prompts/content may go to model providers you select)
- Operational communications and abuse prevention
4. Sharing
We do not sell personal data. We share data with subprocessors only as needed (hosting, email, model APIs you configure, OAuth providers you connect). Multi-tenant design isolates CEO workspaces.
5. BYOK and AI processors
If you configure BYOK or platform LLM access, related content may be sent to third-party model providers under their practices. Review those providers before enabling them.
6. Business apps (CRM and similar)
CRM and similar features may run on separate hostnames and set their own cookies/storage. See the Cookie Policy.
7. Retention
Data is retained while your account is active and for a reasonable period afterward for backups, disputes, and legal compliance. In-product retention settings may apply. Offboarding deletes or anonymizes data subject to legal holds.
8. Security
We use production TLS, hashed passwords, session tokens, and log redaction. No system is perfectly secure.
9. Your choices
Update profile fields, revoke keys, disconnect OAuth, and request offboarding where available. Depending on location you may have access/correction/deletion rights - contact published support channels.
10. Children
The Service is not directed to children under 16 (or higher age where required). Do not register if under that age.
11. Changes
We may update this Policy with a new version ID (currently 2026-08-29).
12. Contact
Privacy questions: in-product support or flolah.cloud contact channels.