Privacy Policy

This notice explains how FLOWLINES SAS, registered with RCS Nanterre under number 994 119 873, handles personal data on its website, in the Flowlines service and in business relationships. Our registered office is 32 rue de Paris, 92100 Boulogne-Billancourt, France. Our privacy contact is support@flowlines.ai.

1. Our role and who this notice covers

Flowlines provides behavioral observability for AI agents, applications and coding-assistant usage. This notice covers website visitors, prospects and business contacts, account users, applicants, supplier and investor contacts, and people whose information appears in customer-submitted data. Employee data is addressed in separate internal notices.

We act as controller when determining the purposes and means of processing our website, account-administration and business-contact data. For data we process on a customer's instructions, including personal data in traces and generated outputs, we act as processor or subprocessor. The customer may itself act for another controller. The Data Processing Addendum governs that processing.

An account user can appear in both categories: we administer their login as controller while analyzing their customer-submitted activity on the customer's behalf. The role depends on the processing purpose, not simply on whether someone has an account.

2. Website visitors and enquiries

We receive information you provide through forms, email or meeting bookings, such as your name, work email, company, message and scheduling details. Hosting and security services also process request information such as IP address, browser/device information, time and the page requested.

We use this information to operate and protect the site, respond to enquiries, arrange meetings and understand its use. The legal basis is our legitimate interest in operating and securing the business, steps requested by an individual before entering a contract where applicable, or consent where required for optional tracking or another activity.

Information entered into a third-party booking or other embedded service is also handled by that provider. Its notice and any required choices apply when you use it. Browser/device settings may restrict storage or third-party content; restricting necessary technologies can affect functionality.

3. Prospects and business contacts

We may process names, professional contact details, job titles, employers, public professional profiles, relevant company information and the history of our communications. This can include emails, meeting notes, sales records and, where clearly disclosed for a meeting, recordings or transcripts.

Information comes from you, your organization, introductions, events, public professional sources or business-data providers. Where we obtain contact information indirectly, we provide the required information about that processing and its source, including at the first communication where applicable.

We use relevant professional contact information to respond to requests, manage customer and partner relationships and conduct lawful B2B prospecting. We rely on assessed legitimate interests, consent where required, contract where you are personally a party, or specific legal obligations for relevant records. A contract with an employer is not automatically the legal basis for every use of an employee's information.

You can object to direct marketing at any time by replying, using an available unsubscribe link or emailing support@flowlines.ai. We retain the minimum suppression information needed to respect your choice. Necessary security, billing and contractual notices are distinct from promotional messages.

Our policy retains CRM and marketing information for two years after the last relevant contact, subject to an earlier applicable erasure request, a continuing customer relationship or a specific legal retention requirement. Repeated unanswered marketing messages do not by themselves justify indefinite retention.

4. Accounts, service usage and support

We process account details such as your name, email address, authentication identifiers or password credentials handled by our authentication provider, workspace membership and role, login/security information, API-key or MCP-token records, and requests for support. For paid services, this may include billing contacts, invoices and transaction records. A payment provider identified when a payment is arranged handles the payment information submitted to it.

We use account information to authenticate users, administer access, provide and secure the Service, assist users and communicate about their accounts. Appropriate legal bases include our legitimate interests in providing and protecting business services, a contract with the individual where applicable, and specific legal obligations. We use consent where the relevant processing requires it.

Our authentication provider is Supabase. Product data is also processed through the service's hosting, storage and processing infrastructure. Workspace administrators and other authorized members can access information according to their permissions; customers control their own workspace access and the collection they authorize.

Customer notes, annotations, traces and personal analysis outputs are handled according to the customer-instructed purposes in Section 6, even when an account user writes or views them. They are not automatically treated as Flowlines' own analytics data.

5. Product analytics, cookies and local storage

The application uses necessary storage to maintain authentication sessions, remember relevant settings and operate securely. These functions are distinct from optional product analytics.

Where configured, PostHog processes product-usage events and technical information to help us understand and improve the Service. The application uses a pseudonymous user identifier and may associate events with workspace identifiers and roles. Pseudonymous information can still be personal data.

The application's analytics configuration disables automatic capture of page contents. It records selected feature actions and normalized page information and, where enabled, masked session replays that show page layout and interactions, with page text and form input masked and page addresses reduced to page types; raw prompts, model responses, trace contents, note text, search text, passwords and API secrets are excluded from the intended analytics payload. Viewing or editing a note may generate a feature event without sending the note text.

Optional analytics must rely on consent where applicable tracking rules require it; otherwise we rely on an appropriate assessed legal basis. Acceptance of the Terms of Service or an employer's subscription does not itself provide tracking consent. You may contact us to object to personal-data processing based on legitimate interests or ask about the technologies and retention used. Browser controls can restrict cookies and local storage, although restricting necessary storage may prevent sign-in or other functionality.

6. Customer traces, coding activity and generated outputs

Customers connect telemetry from their own agents, applications, trace platforms or coding-assistant instrumentation. It can include:

• Prompts, model inputs and outputs, conversation messages and contextual material.
• Tool calls, arguments, results, errors, spans and other execution records.
• User/session identifiers, timestamps and metadata supplied by the customer or source.
• Summaries, classifications, scores, profiles, embeddings, signals and other outputs derived from that information.

These records can concern external end users, employees or contractors using coding assistants, and other people mentioned in content. The product can show patterns of activity and behavior at individual and aggregate levels. Such analysis can constitute profiling even where it does not itself make a legally significant decision.

We process this information on the customer's documented instructions to deliver the Service. Processing includes collection, storage of raw content and structured records, AI analysis, display, customer-directed notifications, support, export, backup and deletion. Selected information may be sent to contracted AI inference providers. Data stored in one region can be analyzed or supported from another; see Section 8.

We do not sell this data, use it for advertising, or use customer content or personal outputs to train general-purpose foundation models. We may use genuinely anonymous aggregate operational statistics to improve the Service. This does not authorize unrestricted use of identifiable traces or profiles for our own purposes or for other customers.

The customer determines what it collects, whom it monitors and which users can access results. It is responsible for required notices, lawful bases and safeguards for its intended use. Flowlines does not itself make decisions producing legal or similarly significant effects on people solely from these analyses. Customer use of outputs remains subject to applicable law and the Terms of Service.

To exercise rights over customer-controlled information, contact that customer or the controller it represents. If you contact us, we will help route the request where we can identify the responsible customer and assist it in responding.

7. Recipients and service providers

We disclose personal data where needed for the purposes in this notice, under appropriate confidentiality and contractual arrangements or another applicable legal basis. Relevant recipient categories include:

Probo supports our compliance policies, evidence collection and audit preparation in an advisory role. It does not operate the Service or make operational incident decisions. Access to compliance documents is distinct from access to production systems.

Customers may instruct delivery to Slack, email, webhooks or other destinations, or retrieve information through an external MCP client or coding assistant. Those recipients may receive identifiers, summaries, feedback and other customer information under the customer's configuration and agreements. A collaboration tool used by Flowlines for customer-instructed support remains subject to applicable processor/subprocessor requirements.

We may disclose information to competent authorities where legally required, or where necessary and lawful to establish or protect rights. A corporate transaction may involve appropriate disclosure to advisers or a successor under confidentiality and applicable data-protection requirements. We do not sell personal data or disclose it to others for their independent marketing.

Information about providers and safeguards for customer-instructed processing is available under the DPA or from our privacy contact. Not every provider receives every category of data; this depends on the function and configuration used.

8. International processing

The Service uses international infrastructure and providers. Hosting/storage, AI inference, error monitoring, business communications and remote support can occur in different locations, including the European Union and the United States. An EU storage location does not by itself mean all processing remains in the EU.

Transfers of personal data outside the EEA must have the safeguards required by applicable law. Depending on the recipient and transfer, these may include an applicable adequacy decision, including the EU–US Data Privacy Framework for a covered certified recipient, or appropriate contractual safeguards such as the European Commission's standard contractual clauses, with assessments and supplementary measures where required. UK and Swiss transfer rules apply where relevant.

You can request information about the applicable locations and copies of relevant safeguards at support@flowlines.ai, subject to protection of legitimate confidential information. Customer-specific residency requirements must be agreed before the relevant processing is enabled.

9. Retention and deletion

We retain personal data only for the relevant purpose and period, subject to applicable rights, legal obligations and justified legal holds. The principal retention rules are:

The DPA provides a retrieval period and active-system deletion within 30 days of the applicable instruction or end of retrieval. This period is distinct from backup expiry. Requests may be handled through supported interfaces or assisted by our team. Deletion covers relevant personal outputs and copies, not only original trace content, subject to lawful retention exceptions. Anonymous statistics that no longer concern identifiable people may be retained.

You can request more specific retention information for a processing activity at our privacy contact.

10. Security

Our information-security program covers data classification, encryption, access controls, workforce MFA and least privilege, secure development, monitoring, incident handling, backups, recovery planning and vendor review. Traces, prompts, completions and credentials receive the highest internal sensitivity classification, with restricted access and handling requirements. Personnel handling personal data are subject to confidentiality and appropriate training.

Security is a continuing responsibility and no system can guarantee absolute protection. Customer data is governed by the baseline security commitments in the DPA, including on free Plans. Information about applicable measures and available assessments can be requested; an assessment only covers its specified scope and period.

Where we are controller, we notify the competent supervisory authority within 72 hours after awareness of a personal-data breach where legally required and inform affected individuals without undue delay where the applicable high-risk threshold is met. Where we act for a customer, we notify and assist that customer under the DPA. Notification does not await completion of investigation or containment.

11. Your rights

Subject to the applicable conditions and exceptions, you may:

• Request access to and a copy of your personal data.
• Correct inaccurate or incomplete information.
• Request erasure or restriction of processing.
• Object to processing based on legitimate interests and, at any time, to direct marketing.
• Request portability of data you provided where processed automatically on the basis of consent or a contract with you.
• Withdraw consent at any time, without affecting the lawfulness of earlier processing.
• Give instructions concerning your personal data after death where French law applies.

Email support@flowlines.ai or write to our registered office. We may request proportionate identity information where we have reasonable doubt about a requester's identity. We respond within one month; for complex requests, the period can be extended by two further months, with notice and reasons within the initial month. Customer-controlled trace requests are handled as described in Section 6.

You may complain to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or another competent supervisory authority, including in the EU country where you live or work. Applicable regional laws may provide additional rights.

12. Applicants, investors and suppliers

For recruitment we process application materials, professional history, interviews and lawful references to assess candidates. Depending on the activity, the basis is requested pre-contractual steps or legitimate interests, with separate information and an appropriate basis for a talent pool.

Investor, adviser and supplier relationships can involve professional contact details, correspondence, agreements, invoices and governance records. We process these for assessed legitimate interests in operating the business, a contract with an individual where applicable, or specific legal obligations. Relevant retention follows the purpose and record category, with restricted archives where legally necessary.

13. Children

The website and Service are directed at professionals, not children. The Service's restrictions on intentionally submitted children's data are set out in the Terms and DPA. Information about a child can nevertheless appear in customer-controlled content; account eligibility and the legal basis for that incidental processing are different questions.

If you believe a child has provided information directly to us, or that children's information is being processed improperly, contact our privacy contact. We will assess the report and coordinate appropriate restriction or deletion with the responsible controller, subject to applicable law.

14. Changes and contact

We update this notice when practices, providers or legal requirements change. The version and update date appear above. We provide additional notice of material changes where required and do not treat publication of a new notice as consent to a new purpose. Earlier versions can be requested.

For questions about privacy, providers, safeguards or your rights, contact FLOWLINES SAS, 32 rue de Paris, 92100 Boulogne-Billancourt, France, at support@flowlines.ai.