Terms of Service

These Terms of Service are the Customer Terms and Conditions for the Flowlines service. They form an agreement between FLOWLINES SAS, registered with RCS Nanterre under number 994 119 873, whose registered office is 32 rue de Paris, 92100 Boulogne-Billancourt, France (“Flowlines”, “we”, “us”), and the business customer identified in an Order Form or account registration (“Customer”, “you”). Contact us at support@flowlines.ai.

You retain your data and the outputs created for you. We process customer personal data on your instructions under the Data Processing Addendum below. Paid services, where agreed, are subject to the applicable fees and subscription term. Liability is limited as explained in Section 14, including its separate caps and exceptions. This paragraph is a summary; the provisions below govern.

1. Scope and acceptance

1.1 The Service. These Terms cover the hosted Flowlines application, ingestion connectors, API, Model Context Protocol (“MCP”) server, plugins, command-line tools, documentation and related support (the “Service”). The Service provides behavioral observability for AI agents and applications, including customer-instructed analysis of coding-assistant usage.

1.2 Acceptance and authority. You accept these Terms by signing an Order Form referring to them or taking an action that expressly indicates acceptance after these Terms have been made available to you. If you act for an organization, you represent that you are authorized to bind it. Authorized Users use the Service under their organization's agreement; their access does not amend a separately negotiated agreement.

1.3 Business use. The Service is intended for companies, organizations and professionals acting for business purposes. It is not offered for personal consumer use. An “Authorized User” is an employee, contractor or agent whom Customer permits to use its workspace.

1.4 Contract documents. An “Order Form” is an ordering document or quote agreed by both parties specifying the plan, fees, usage limits, term and any express variations. A “Plan” is the service tier agreed with Customer, including any free, trial or design-partner arrangement. An Order Form overrides these Terms only for its express variations. The Data Processing Addendum prevails on personal-data matters, and mandatory data-protection requirements and applicable standard contractual clauses prevail over conflicting terms. Documentation describes the supported features and interfaces. Purchase-order boilerplate does not vary this agreement unless expressly accepted as a contractual variation by both parties.

1.5 Privacy notice. Our Privacy Policy explains processing for which Flowlines acts as controller. Acknowledging that notice is not consent to optional marketing or tracking. The Data Processing Addendum in Schedule 1 governs personal data processed on Customer's behalf.

2. Data and other definitions

Customer Data means data, content and material submitted to the Service by Customer or its Authorized Users, or collected from sources on Customer's instruction. This includes connected telemetry, annotations and support material provided for processing on Customer's behalf.

Trace Data means telemetry describing AI-agent, application or coding-assistant activity, including prompts, model inputs and outputs, tool calls and their arguments and results, spans, session and user identifiers, timestamps, metadata, error information and evaluation results.

Derived Outputs means customer-specific signals, classifications, scores, summaries, clusters, maps, profiles, recommendations, notes and reports generated from Customer Data. They may contain personal data even when the original trace content is not reproduced.

Usage Data means technical information about operation and use of the Service, such as feature events, ingestion volumes, latency and error rates. Usage Data may be personal data where linked to a person and is subject to the applicable purposes, retention limits and rights described in the Privacy Policy.

Anonymous Statistics means aggregate operational statistics that do not contain Customer Data content or personal Derived Outputs, identify a customer or person, or permit them to be identified or their content reconstructed by means reasonably likely to be used. Merely replacing names with identifiers does not make data anonymous.

Customer-connected Services means third-party systems that Customer chooses to connect, such as trace platforms, coding assistants and notification destinations. Providers engaged by Flowlines to supply the Service remain Flowlines' subcontractors or subprocessors as applicable.

3. Access to the Service

3.1 Right to use. Subject to these Terms and payment of agreed fees, Flowlines grants Customer a non-exclusive, non-transferable right to use the Service for its business purposes during the agreed subscription term and within the agreed limits. Customer may permit its Authorized Users and affiliates to use its workspace and remains responsible for their compliance. An affiliate is an entity controlling, controlled by or under common control with Customer.

3.2 What Flowlines does. Flowlines collects, stores and analyzes data from authorized sources and presents patterns across sessions, users, agents and outcomes. It may retain raw trace and message content as well as structured records, embeddings and analysis results. It can return data through the application, API and MCP server and deliver configured notifications. Connecting a source authorizes the configured collection; disconnecting it does not itself erase data already collected.

3.3 Analysis limitations. Statistical and AI-generated outputs may be inaccurate, incomplete or misleading. They support investigation and human judgment and do not guarantee detection of every failure or compliance with a regulatory obligation. Customer must review outputs before relying on them, particularly for decisions affecting individuals, safety or legal rights. Customer remains responsible for its own agents and decisions. This does not exclude Flowlines' own obligations under applicable law or these Terms.

3.4 Account security. Customer must protect credentials, API keys and MCP tokens, use appropriate access controls, review workspace access and promptly report suspected compromise to support@flowlines.ai. Each user must use their own account. Flowlines may revoke or suspend a credential reasonably believed to be compromised.

3.5 Changes. We may develop, modify or retire features. We will not materially reduce the core functionality of an agreed paid Plan during a prepaid term without an appropriate remedy. We will give at least 30 days' notice before retiring a material feature actively used by Customer, unless security or legal reasons require a shorter period.

3.6 Free and beta services. Free Plans, trials and features clearly designated beta, preview or experimental may be limited, modified or discontinued. They carry no paid uptime or support commitment unless agreed in writing. The confidentiality, baseline security and data-protection obligations still apply. Before deleting data from a free Plan inactive for 90 consecutive days, we will give at least 14 days' notice. Liability for free or beta use is governed by Section 14, including its exceptions.

3.7 Client tooling. A separately stated open-source or software license governs the relevant plugin, SDK or command-line package itself. These Terms govern the hosted Service it connects to. Statutory rights and rights granted by an applicable open-source license are preserved.

4. Ownership, permitted processing and retention

4.1 Customer ownership. As between the parties and to the extent rights exist, Customer retains all rights in Customer Data and the Derived Outputs created for it. This does not transfer Flowlines' pre-existing software, models, methods or other underlying technology. Customer may use and export its outputs, including any embedded Flowlines material to the extent needed to use those outputs. AI-generated outputs are not necessarily unique or eligible for intellectual-property protection.

4.2 Service license. Customer permits Flowlines to host, copy, transmit, store, analyze and display Customer Data and create Derived Outputs solely to provide, maintain, secure and support the Service for Customer, follow Customer's lawful documented instructions, and meet applicable legal duties. This permission lasts only while necessary to provide the Service and fulfill agreed return, deletion or lawful retention obligations. Personal data remains governed by the DPA throughout that period.

4.3 No sale or content training. We do not sell Customer Data or use it for advertising. We do not use Customer Data or personal Derived Outputs to train general-purpose foundation models or build identifiable profiles for other customers. We may use Anonymous Statistics to operate and improve the Service and publish aggregate industry statistics. This does not authorize unrestricted reuse of personal Usage Data or customer content. Inference providers may receive content only for the contracted processing described in the DPA; their access does not confer independent rights to use customer content for general-purpose model training.

4.4 Customer instructions and rights. Customer is responsible for the lawfulness of collection, its instructions, required notices and legal bases, and its right to provide data from connected sources. Customer must review the data captured by instrumentation and connectors and use source-level minimization, redaction and filtering where appropriate. An analysis filter does not necessarily prevent ingestion or delete raw source data.

4.5 Restricted data. Unless expressly agreed in writing with suitable safeguards, Customer must not intentionally submit special-category personal data under GDPR Article 9, criminal-offence data, payment-card data requiring PCI DSS handling, regulated health information, government identification numbers, biometric identification data, or knowingly collected personal data of children under 16. Customer must take reasonable measures to prevent accidental inclusion and contact Flowlines promptly if it discovers such data. The parties will coordinate appropriate restriction or deletion; a restriction does not remove Flowlines' duties for data already received.

4.6 Retention and deletion. Retention of Customer Data and personal Derived Outputs follows Customer's instructions and the agreed Plan or Order Form. Customer may request access, export or deletion at support@flowlines.ai. Requests may be fulfilled through supported interfaces or an assisted process. Active-system deletion will be completed within 30 days of an agreed deletion instruction or the end of the retrieval period, subject to mandatory legal retention. Residual backup copies expire within the seven-day backup window described in the DPA and are not used for ordinary processing. A legal hold must be limited to the relevant records and purpose. Anonymous Statistics may be retained after termination; personal data does not become eligible for indefinite retention merely by being called Usage Data.

4.7 Ingestion. Collection depends on source availability, permissions, network delivery and configuration. We do not guarantee receipt of every event emitted by Customer's systems. Status and error information should be considered when interpreting incomplete sessions or analysis.

5. Integrations, AI providers and destinations

5.1 Connected sources. Customer authorizes access to sources it connects within the configured permissions and is responsible for its agreements and fees with those sources. We use reasonable efforts to maintain supported integrations, but third-party API changes or outages may affect them. This does not remove our obligations for the Service or providers we engage ourselves.

5.2 AI inference. Certain analyses use third-party models and can involve transmitting selected trace content, tool information, identifiers and contextual material. Processing may occur outside the country where primary data is stored. Schedule 1 governs this processing and the safeguards required before sharing personal data.

5.3 MCP and coding assistants. When an Authorized User retrieves data through an external MCP host or assistant, returned data is transmitted to that client and may be processed by its provider under Customer's agreement with it. Customer controls its choice of clients, token scopes and permitted users.

5.4 Notifications and exports. Customer may instruct delivery to email, Slack, webhooks or other supported destinations. These deliveries can contain personal identifiers, summaries, feedback or other derived information. Customer is responsible for choosing appropriate destinations and access permissions. Customer-directed recipients are distinct from providers Flowlines engages to operate the Service.

6. Fees and payment

6.1 Agreed charges. Charges, usage allowances, currency, billing period and any overage rates must be stated in the agreed Plan or Order Form. No paid subscription or overage charge arises solely from creating a free account. Payment arrangements and any available checkout are those communicated when a paid service is agreed.

6.2 Invoices. Unless an Order Form states otherwise, invoices are due within 30 days and amounts are in euros, exclusive of applicable taxes. Customer pays applicable transaction taxes other than taxes on Flowlines' net income. Usage-based charges must follow the agreed metric and rate. Customer may request a reasonable explanation of measured usage and dispute an invoice in good faith; the undisputed portion remains payable.

6.3 Late payment. Undisputed overdue amounts bear interest at three times the French statutory legal interest rate, without prejudice to any mandatory rate, plus the statutory EUR 40 recovery-cost indemnity and additional justified recovery costs where permitted by law. We may suspend service for an undisputed overdue amount remaining unpaid 15 days after written notice.

6.4 Changes and refunds. Fees fixed for a term do not change during that term. We will give at least 60 days' notice of a proposed renewal price increase for an annual term, and at least 30 days for a monthly term, allowing Customer to decline renewal after receiving notice. No index-based increase applies unless expressly agreed. Fees are non-refundable except as provided in these Terms, an Order Form or applicable law.

7. Flowlines intellectual property and restrictions

7.1 Platform rights. Flowlines and its licensors retain the software, documentation, underlying detection methods, models, rules and improvements to the platform. No rights in Customer Data or personal Derived Outputs are transferred to Flowlines by this reservation.

7.2 Feedback. We may use voluntary product suggestions to improve the Service without compensation. This permission excludes Customer Data, personal Derived Outputs and Customer Confidential Information and does not permit disclosure of them.

7.3 Restrictions. Customer must not resell or sublicense access to the Service without agreement, remove proprietary notices, copy the platform, or circumvent its access or usage controls. Reverse engineering is restricted only to the extent permitted by applicable law; statutory exceptions and applicable open-source rights remain available. Customer must not use unauthorized automated extraction methods to bypass the API, MCP or supported export interfaces. These restrictions do not prevent Customer from using its own exported data and outputs or exercising mandatory switching rights.

7.4 Trademarks and publicity. Each party retains its name and trademarks. Flowlines may identify Customer by name and logo as a customer, subject to Customer's supplied brand guidelines. Customer may opt out at any time by email; Flowlines will stop new uses within 30 days. Quotes, testimonials and case studies require prior written approval.

8. Acceptable use and AI responsibilities

Customer must not use the Service to:

• Violate applicable law or third-party rights, including privacy, intellectual-property, sanctions or export-control rules.
• Access another customer's information without authorization, interfere with the Service, distribute executable malware or deliberately compromise a system. Legitimate telemetry recording an attack, malicious prompt or code sample is not itself prohibited when handled safely for authorized analysis.
• Conduct unauthorized security testing, evade limits or share credentials with unauthorized people.
• Conduct unlawful or covert workplace surveillance, operate a prohibited AI system, or make unlawful decisions about individuals using Derived Outputs.
• Make decisions producing legal or similarly significant effects solely from Derived Outputs without the safeguards required by applicable law. Human review does not by itself establish legal compliance.

Customer is responsible for the purposes and lawful deployment of its own AI systems, notices to affected people, necessary assessments and appropriate oversight. Flowlines remains responsible for obligations applicable to its own activities and systems. The Service is not a certification that Customer satisfies the EU AI Act or another regulatory regime.

We may investigate credible reports of misuse and take proportionate action under Section 11.

9. Security and support

9.1 Baseline protection. Flowlines will maintain technical and organizational measures appropriate to the nature and risks of processing, including the measures in Schedule 1. Baseline security and confidentiality apply to paid, free and beta use. Customer is responsible for security of its own systems and configuration.

9.2 Information and audits. We will provide information reasonably necessary to assess processing security and DPA compliance. Confidential security material may be shared under confidentiality. Any available independent assessment is limited to its stated scope and period; these Terms do not represent that a particular certification or audit report has been issued. DPA audit rights apply regardless of Plan.

9.3 Incidents. We will notify Customer without undue delay after becoming aware of a security incident affecting Customer Data and, in any event, within 72 hours of awareness of a personal-data breach. This outer limit does not permit an avoidable delay. Information may be provided in stages; notification does not await completion of containment or investigation. Schedule 1 specifies the personal-data notification requirements.

9.4 Continuity and support. Our recovery objectives are an eight-hour Recovery Time Objective and a 24-hour Recovery Point Objective. They describe recovery targets, not a guarantee of zero loss or uninterrupted service. Schedule 2 describes paid availability and support commitments. Our standard support model is based on French business hours, with best-effort response outside those hours unless separately agreed.

10. Confidentiality

10.1 Protected information. Confidential Information is non-public information marked confidential or reasonably understood to be confidential, including Customer Data and Derived Outputs, business information, security information and non-public platform details.

10.2 Duties. Each recipient must use the other party's Confidential Information only to perform or exercise rights under this agreement, protect it with reasonable care, and disclose it only to people or providers who need it and are subject to appropriate confidentiality duties. Information lawfully public, independently developed without using the information, already lawfully known without restriction, or lawfully obtained from another source is excluded.

10.3 Required disclosure. Where disclosure is legally required, the recipient will provide notice when permitted, disclose only what is required and reasonably cooperate with protective measures.

10.4 Duration. These duties continue for five years after termination, and for Customer Data and Derived Outputs while retained and for trade secrets while they remain trade secrets. Personal-data obligations continue for as long as relevant processing continues.

11. Term, suspension, termination and switching

11.1 Term and renewal. The agreement begins on acceptance. Paid terms and renewal arrangements must be stated when the Plan is agreed. Where automatic renewal is agreed, annual terms renew unless either party gives at least 30 days' notice; monthly terms may be cancelled before the next billing period. Customer can give notice at support@flowlines.ai, or through billing controls where available. A price-change notice must leave a reasonable opportunity to decline the affected renewal.

11.2 Termination for cause. Either party may terminate for material breach not cured within 30 days after written notice. Immediate action may be taken where a breach cannot be cured, threatens security or makes continued performance unlawful. Insolvency-related termination applies only where permitted by applicable law.

11.3 Suspension. We may suspend the affected access where reasonably necessary for security, unlawful use, a material acceptable-use violation, or overdue undisputed fees under Section 6.3. We will give practicable notice, limit suspension to what is necessary and restore access when its cause is resolved. Agreed fees continue during a suspension caused by Customer's breach.

11.4 Financial effects. On termination, accrued fees remain due. Where Flowlines terminates for Customer's uncured material breach, remaining committed term fees are payable to the extent permitted by law. Where Customer terminates for Flowlines' uncured material breach, we refund prepaid fees for the unused period. Mandatory rights are preserved.

11.5 Return and deletion. Customer retains a limited right to retrieve Customer Data and Derived Outputs for at least 30 days after termination or expiry. We will make them available through supported interfaces or an assisted export in a commonly used machine-readable format. At Customer's choice we will return or delete personal data; deletion after retrieval follows Section 4.6 and the DPA. We will confirm completed deletion on request. Ordinary service-use rights end on termination, subject to these retrieval and switching rights.

11.6 Switching. To the extent the EU Data Act's switching requirements apply, Customer may request switching to another provider or its own infrastructure by email. The notice period will not exceed two months; the standard transition period will not exceed 30 calendar days, subject to legally permitted exceptions or an extension requested by Customer. We will provide required information on exportable data, digital assets, formats and interfaces, reasonable switching assistance and continuity during the transition, followed by at least 30 calendar days for retrieval. Exclusions for Flowlines' protected technology will not prevent export of data and assets required by law. Any switching charge must be lawful and disclosed in advance; from 12 January 2027 no switching charge will apply where prohibited by the Data Act. Separate lawful subscription charges are addressed in the applicable agreement.

11.7 Survival. Rights and obligations concerning ownership, confidentiality, accrued payment, permitted retention, return/deletion, liability and dispute resolution survive as needed to give them effect. The DPA continues until Customer Personal Data has been returned or deleted, subject to required legal retention.

12. Warranties

Each party represents that it has authority to enter this agreement. Flowlines will provide the Service with reasonable skill and care and materially in accordance with its applicable documentation. If a material nonconformity is not corrected within 30 days after notice, Customer may terminate the affected paid service and receive a refund of unused prepaid fees.

Except for express commitments in this agreement and rights that cannot lawfully be excluded, the Service and AI-generated outputs are provided without additional warranties, including guarantees of uninterrupted operation, completeness of detection or suitability for a particular regulated decision. Free and beta features carry no general performance warranty; their security, confidentiality and DPA commitments remain in effect.

13. Third-party claims

13.1 Flowlines indemnity. Flowlines will defend Customer against a third-party claim that the Service, as supplied and used in accordance with these Terms, infringes intellectual-property rights enforceable in the EU, UK or US, and pay damages finally awarded or settlements approved by Flowlines. This excludes claims caused by Customer Data, unauthorized modifications, combinations not supplied by Flowlines where the claim would not otherwise arise, or continued infringing use after an appropriate replacement is offered. This indemnity does not apply to free Plans or beta features. We may obtain continued-use rights, modify or replace the affected feature, or terminate it and refund unused prepaid fees if neither option is commercially reasonable.

13.2 Customer indemnity. Customer will defend Flowlines against third-party claims to the extent caused by Customer's unlawful collection or provision of Customer Data, infringement of third-party rights in that data, or unlawful use of its own agents or the Service. Customer will pay damages finally awarded and approved settlements attributable to that conduct. This does not cover claims to the extent caused by Flowlines' breach, negligence or other fault, and does not transfer statutory responsibilities or fines that cannot lawfully be indemnified.

13.3 Procedure. The indemnified party must give prompt notice, reasonable cooperation at the indemnifying party's expense, and control of the defense subject to applicable law. Delayed notice relieves an obligation only to the extent prejudiced. No settlement may impose admissions or non-monetary obligations on the other party without its consent. Regulatory proceedings remain subject to the authority's powers and each party's duties.

14. Limitation of liability

14.1 Indirect loss. To the fullest extent permitted by law, neither party is liable for indirect or consequential loss. The nature of an actual loss is determined under applicable law; describing a loss of data or revenue does not automatically make it indirect. No exclusion deprives an essential obligation of its substance or removes a mandatory remedy.

14.2 General cap. Subject to Section 14.3, each party's aggregate liability arising from this agreement in a 12-month period is limited to the fees paid or payable by Customer in the 12 months before the first event giving rise to the relevant claim, or EUR 1,000 where no fees were payable. Related events are treated as one event for determining the applicable cap.

14.3 Exceptions. The general cap and indirect-loss exclusion do not apply to fraud, willful misconduct, gross negligence or other liability that cannot lawfully be limited; payment of agreed fees; or the indemnification obligations in Section 13. For a breach of confidentiality or Flowlines' DPA obligations, aggregate liability is instead limited to the greater of twice the general cap or EUR 250,000, unless an uncapped exception also applies. These are separate contractual risk allocations, not a statement that every claim is capped at annual fees. A claim is not counted twice merely because it falls under more than one provision.

14.4 Mandatory rights. Nothing limits the rights of data subjects, powers of regulators, liability owed to them under applicable law, or rights under binding standard contractual clauses. These provisions allocate liability between the parties only to the extent legally permitted.

15. General provisions

15.1 Law and courts. French law governs this agreement, subject to mandatory applicable rules. The parties will seek an amicable resolution for 30 days following written notice, without delaying urgent relief or mandatory deadlines. WHERE A TERRITORIAL JURISDICTION AGREEMENT IS LAWFUL, INCLUDING THE CONDITIONS OF ARTICLE 48 OF THE FRENCH CODE OF CIVIL PROCEDURE WHERE APPLICABLE, THE COMPETENT COURTS OF NANTERRE, FRANCE HAVE EXCLUSIVE JURISDICTION. Otherwise, the courts determined by applicable law have jurisdiction. This does not restrict mandatory data-subject complaint or court rights.

15.2 Notices and changes. Notices to Flowlines may be sent to support@flowlines.ai; notices to Customer may be sent to its account owner or designated contract contact. Registered post is not required for agreed electronic notices, privacy requests or cancellation. We will provide at least 30 days' notice of material changes to these Terms. Changes normally apply at renewal; earlier application is limited to legal necessity or changes that do not materially reduce Customer's rights. If an earlier material change adversely affects Customer, Customer may terminate the affected service before it takes effect and receive a refund of unused prepaid fees. A fixed negotiated version changes only as agreed or at renewal under its terms.

15.3 Other terms. Neither party may assign the agreement without consent, except to an affiliate or successor in a merger, reorganization or sale of the relevant business, with notice and without reducing agreed protections. Flowlines remains responsible for subcontractors it engages. Each party will comply with applicable sanctions, export-control and anti-corruption laws. A force-majeure event must meet the conditions of Article 1218 of the French Civil Code; a supplier outage is not automatically force majeure. Either party may terminate an affected service after 60 days of continuing force majeure.

15.4 Interpretation. The parties are independent contractors. This agreement and applicable Order Forms constitute the agreement for the Service. A provision that is unenforceable does not invalidate the remaining provisions where they can continue to operate. A waiver must be clear and does not waive future breaches. No provision excludes mandatory third-party rights. English is the contractual language to the extent permitted by law. Electronic signatures and acceptance records may be used as evidence under applicable law.

Schedule 1. Data Processing Addendum

A. Scope and roles

This Data Processing Addendum (“DPA”) forms part of the Terms and governs personal data processed by Flowlines on Customer's behalf. “Data Protection Laws” means applicable privacy laws, including the EU GDPR and French data-protection law and, where applicable, UK, Swiss and US state privacy laws.

Customer Personal Data includes personal data submitted, collected, generated or otherwise processed on Customer's behalf, including personal data in Customer Data, Derived Outputs, associated identifiers, embeddings and copies. Flowlines acts as processor, or subprocessor where Customer processes on another controller's behalf. Customer is responsible for obtaining that controller's authorization. Flowlines' separate processing as controller is described in the Privacy Policy.

B. Processing details and instructions

Subject matter and duration: provision of the Service during the subscription, any retrieval/switching period and the time necessary to complete return, deletion or required retention.

Nature and purposes: authorized collection, storage, normalization, analysis including LLM inference, generation of summaries/profiles and other outputs, display, customer-instructed notifications, API/MCP access, export, troubleshooting/support, backup, restriction and deletion. Processing is for Customer's observability and analysis purposes.

People concerned: users of Customer's agents and applications, employees and contractors using coding assistants, Authorized Users and other people whose information appears in submitted content.

Data categories: identifiers, conversation content, prompts and model responses, tool arguments/results, annotations, behavioral inferences, metadata and technical records. Restricted Data under Section 4.5 is excluded unless expressly agreed with safeguards. Customer controls the connected sources and instructed scope.

Documented instructions comprise this agreement, the agreed configuration and further lawful written instructions. Flowlines will inform Customer if it considers an instruction unlawful and may suspend affected processing until the concern is lawfully resolved. A requirement under EU or Member State law to process differently will be communicated before processing unless prohibited by law.

C. Processor obligations

Confidentiality and security. Flowlines will limit access to authorized people subject to confidentiality, provide appropriate training and maintain the measures in Annex A. Measures may evolve without materially reducing the overall protection agreed with Customer.

Rights requests. Taking account of the nature of processing, Flowlines will provide appropriate technical and organizational assistance with access, correction, erasure, restriction, objection and portability requests. Requests received directly concerning customer-controlled data will be forwarded or directed to the relevant customer without undue delay, unless law requires another response.

Assistance. Flowlines will reasonably assist with security duties, breaches, DPIAs and prior consultation, taking account of available information. Additional bespoke work may be subject to reasonable agreed charges, but required cooperation is not conditional on purchasing a higher service tier.

Breach notification. Flowlines will notify Customer without undue delay, and no later than 72 hours after awareness of a personal-data breach affecting Customer Personal Data. Notification will describe the nature of the breach, known categories and approximate numbers of affected people/records, likely consequences, measures taken or proposed and a contact. Initial notice may be followed by updates; it need not await completed investigation or containment. Customer decides notifications to authorities and individuals for its controlled data, with Flowlines' assistance, unless law requires Flowlines to notify directly.

Return and deletion. At Customer's choice, Flowlines will return or delete Customer Personal Data after the Service ends. Customer has the retrieval rights in Section 11. Active deletion will be completed within 30 days of Customer's applicable instruction or the end of retrieval, and residual backup copies expire within the seven-day backup window. Retained backups are access-restricted and are not restored to ordinary processing without reapplying relevant deletion instructions. EU or Member State mandatory retention is limited to the required records and purpose. Flowlines will confirm completed deletion on request.

Demonstration and audits. Flowlines will make available information necessary to demonstrate compliance with GDPR Article 28 and allow and contribute to audits, including inspections, by Customer or its independent confidential auditor. Existing reports and questionnaires should be used where sufficient. Audits ordinarily occur no more than annually on 30 days' notice; additional audits or shorter notice are permitted when reasonably required following a breach or by an authority or law. Reasonable scope, security, confidentiality and cost arrangements must not prevent effective exercise of these rights.

Records. Flowlines will maintain the applicable processing records and cooperate with competent supervisory authorities as required by law. The DPA continues to protect data while any covered processing remains.

D. Subprocessors and international processing

Customer gives general written authorization for the service providers in Annex B to process Customer Personal Data for the stated purposes where used in providing Customer's service. Flowlines will provide at least 30 days' advance notice of an intended addition or replacement to Customer's designated contact, allowing objection on reasonable data-protection grounds before the new processing begins. The parties will seek a reasonable solution. If unresolved, Customer may terminate the affected service with a refund of unused prepaid fees before the proposed processing begins, without limiting mandatory rights.

Before allowing processing, Flowlines must bind each subprocessor to applicable data-protection obligations offering the protection required by this DPA and remains responsible for its performance. Customer-directed external MCP clients and notification destinations are governed by Customer's instructions and agreements and are not automatically Flowlines-appointed subprocessors.

Storage, inference and remote support can have different processing locations, including the European Union and United States. A restricted-location requirement must be agreed before the relevant processing is enabled. Flowlines will provide processing-location and transfer information on request.

Transfers subject to GDPR Chapter V must use an applicable lawful mechanism: an adequacy decision covering the actual recipient/transfer, or appropriate safeguards such as the relevant standard contractual clauses, with a transfer assessment and supplementary measures where required. Applicable UK or Swiss transfer requirements must also be met. Flowlines must have the relevant binding arrangements in place before a covered transfer; this DPA does not by itself bind a vendor that is not a party. Applicable SCCs prevail over conflicting terms and retain their data-subject rights. Copies of applicable safeguards, with legitimate confidential details protected, are available on request.

E. Customer obligations

Customer must provide lawful instructions, necessary information to affected people and an appropriate legal basis for collection and use. It must minimize submitted data, appropriately configure sources and destinations, and obtain any controller authorization required where it acts as processor. Customer must not instruct unlawful processing. Each party remains responsible for duties imposed on it by law; Customer's selection of a provider does not waive required transfer safeguards.

F. US privacy laws where applicable

Where Flowlines receives personal information as a service provider or contractor under the CCPA, it receives that information only for the limited, specified purposes in Section B. It will comply with applicable CCPA provisions and regulations, provide the same level of privacy protection required of businesses for that information, and will not sell or share it, use or disclose it outside the direct business relationship or specified purposes, or combine it with other personal information except as permitted by law.

Flowlines will assist Customer with applicable consumer rights and other required compliance measures, notify Customer if it can no longer comply, permit reasonable and appropriate steps to verify compliant use and stop/remediate unauthorized use, and impose required obligations on downstream providers. Flowlines certifies that it understands and will comply with these restrictions. Other applicable US state processor requirements apply to the extent required by law.

Annex A. Technical and organizational measures

Flowlines' security program provides for the following measures, applied according to the systems and risks involved:

• Documented security and data-handling policies, assigned responsibility, risk assessment and periodic review.
• Classification of traces, prompts, completions and credentials as Secret, with strictly limited access and logging of access to personal data.
• Encryption of customer data at rest and in transit, protection of credentials and secrets, and access controls enforcing tenant permissions.
• Workforce least privilege, MFA for critical systems, SSO where supported, periodic access reviews and prompt revocation of unneeded access.
• Separation of production and non-production environments and protection against copying identifiable production data into ordinary development or testing.
• Reviewed changes, security testing, dependency monitoring, secret scanning and risk-based vulnerability remediation and verification.
• Logging and monitoring, an incident-response process and escalation arrangements.
• Daily encrypted platform backups, a seven-day backup retention window, recovery objectives of eight hours/24 hours and periodic recovery exercises.
• Personnel confidentiality, security awareness and device protections.
• Review and contractual controls for vendors handling personal data, including required transfer safeguards and return/deletion arrangements.

These measures describe the agreed protection program. More specific requirements, processing locations and evidence can be provided for Customer's assessment or agreed in an Order Form. Mandatory protections may not be reduced by an Order Form.

Annex B. Authorized service providers

The following providers are authorized for the indicated service functions where those functions are used. The particular contracting entity, processing locations and applicable transfer documentation are available from support@flowlines.ai. Model availability through AWS does not itself mean the model developer separately receives Customer Personal Data.

Providers used for Flowlines-controlled account, website and business-contact processing are described separately in the Privacy Policy. If customer personal data is placed in a support or collaboration tool on Customer's behalf, the relevant subprocessor requirements also apply; the tool's internal label does not remove them.

Schedule 2. Service levels and support

A. Paid-service availability

Unless a different target is agreed, Flowlines will use commercially reasonable efforts to achieve 99.5% monthly availability for paid hosted application and API services. Free and beta services have no uptime target unless agreed.

Availability is measured for the affected Customer's covered service: the minutes in a calendar month less qualifying downtime, divided by total minutes in that month. Downtime is material unavailability preventing normal use of a covered core application or API function. It does not require every customer or both interfaces to fail simultaneously. Flowlines' monitoring and reasonable Customer evidence may be used to establish downtime.

Excluded events are agreed or notified maintenance within an agreed maintenance allowance; necessary emergency security maintenance; Customer-caused outages or unauthorized use; failure of Customer-controlled external sources or networks; lawful suspension; and force majeure meeting applicable law. Failure of a Flowlines-appointed hosting provider or subprocessor is not excluded merely because it is a third party. Delayed arrival of source telemetry does not itself establish application/API downtime, but impairment of a covered core function is assessed under the definition above.

Scheduled maintenance will be notified at least 48 hours in advance where practicable and arranged to minimize disruption. An uptime target is distinct from an analysis-latency or ingestion-freshness commitment, which must be separately agreed.

B. Credits and chronic failure

For the standard 99.5% paid-service target, Customer may claim a credit of 5% of the affected monthly service fee where availability is below 99.5% but at least 99%; 10% below 99% but at least 97%; and 25% below 97%. A claim should be submitted within 30 days after the month ends with reasonable details. Credits are applied to future fees and capped at 25% of the affected month's fees. Any higher negotiated target must include its corresponding remedy in the Order Form.

If availability is below 97% in three months of a rolling six-month period, Customer may terminate the affected paid service on 30 days' notice and receive a refund of unused prepaid fees. Credits are the ordinary monetary remedy for a target shortfall, without limiting this termination right, other material-breach remedies or rights that cannot be excluded by law.

C. Support

Contact support@flowlines.ai for support or use a shared support channel where agreed. Standard hours are 09:00–18:00, Europe/Paris time, on French business days. Paid-service initial response targets are:

These are acknowledgment targets, not resolution guarantees. Standard coverage does not include a 24/7 on-call commitment; response outside business hours is best effort. Security incidents remain subject to the notice requirements in the Terms and DPA. Free Plans receive best-effort assistance. Material customer-impacting incidents are communicated to affected customers by email or an agreed channel.