Privacy & Data-Use Disclosure

Depending on the context, Floe acts as a data controller or a data processor.

Floe as controller. We act as controller when you visit floe.so or our marketing properties, register for a Floe account, or contact us. This means we determine the purposes and means of processing your personal data.

Floe as processor. When you use the Service to run demos, onboard users, or provide support — and in doing so, upload Customer Data, provide Demo Credentials, or generate Demo Interaction Data involving End Users — you act as the data controller and Floe acts as the data processor. We process that data only on your documented instructions to provide the Service. Our Data Processing Addendum applies automatically to every customer as part of the Terms of Service — no separate request or signature is needed — and includes the EU Standard Contractual Clauses.

End Users.If you interacted with a Floe-powered agent on a third-party website, that website’s operator is the controller of your data. You should contact them directly for privacy requests. We will assist them as required by our DPA.

Website Visitors

When you visit floe.so or our marketing properties, we may collect:

• Usage data: pages visited, referring URL, browser type, device type, operating system, and IP address.
• Product analytics and session replay: we use PostHog to record how visitors interact with our marketing site. This includes a replay of your session (pages viewed, mouse movement, clicks, scrolling, and page content), automatically captured interaction events, heatmaps, and page performance timings. Text you type into form fields is masked by default in replays. This applies to our own website only — it is separate from the agent session recording described in Section 7.
• Cookies and similar technologies for analytics and performance monitoring. See the Cookies section below.

Customers

When you create a Floe account, we collect:

• Account information: name, work email address, company name, and billing information (processed by our payment provider).
• Demo Credentials: login email, password, TOTP secret, and/or MailSlurp inbox identifiers you provide to enable the Demo Agent to sign into your product. Credentials are encrypted at rest (AES-256) in per-account isolated storage.
• Customer Data: product documentation, knowledge sources, guidance, ICP criteria, branding assets, and agent configuration settings you upload to the Service.
• Usage data: login activity, feature usage, and platform interactions within the dashboard.

End Users (Agent Interactions)

When a prospect or user interacts with a Floe-powered agent on a customer’s website, inside their product, or via a shared link, we record the session and collect:

• Demo Interaction Data: video of the product UI as the agent navigates it, audio of the conversation (when voice is enabled), and a full text transcript. For chat-based interactions, the chat history is included.
• Device and network data: IP address, browser type, device type, operating system, and approximate location derived from the IP address.
• Voluntarily provided information: name, email address, job title, company, role, or other information the End User chooses to share during the conversation. The Website Agent may also capture identity information submitted by the visitor.
• Engagement and attribution data: referring URL, campaign parameters, session duration, pages viewed during the session, actions taken, and ICP qualification signals.

Floe agents are powered by artificial intelligence. Interactions are conducted by AI, not humans.

We use personal data only as necessary:

• To provide the Service: running demos, onboarding sessions, and support conversations; generating demo responses; navigating your product UI using Demo Credentials; qualifying leads; scoring ICP fit; producing analytics, reports, and session summaries; writing qualified leads into your CRM.
• Account management: processing payments, managing subscriptions, and sending service-related communications.
• Improving the Service: analyzing anonymized, aggregated usage patterns, identifying bugs, and developing new features.
• Website analytics: understanding how visitors use floe.so to improve content and experience.
• Marketing: sending promotional communications to customers and prospects who have opted in. You may opt out at any time.
• Security and compliance: detecting and preventing unauthorized access, fraud, abuse, and security threats; complying with legal obligations; enforcing our Terms.

Automated Scoring and Profiling

The Service analyses agent conversations to qualify leads and produce an ICP (ideal customer profile) fit score for each End User, alongside engagement and intent signals. This is profiling within the meaning of GDPR Article 4(4): it evaluates professional attributes such as role, company, and stated needs in order to rank sales interest.

These scores inform the customer’s sales follow-up. They are not used to make decisions producing legal or similarly significant effects on an End User, so they do not constitute solely automated decision-making under GDPR Article 22. Where Floe acts as a processor, the customer determines how scores are used and is responsible for the corresponding disclosures to its End Users.

Where the GDPR applies, End Users may object to profiling carried out on the basis of legitimate interests, and may request human review of a score, by contacting the customer whose agent they interacted with, or us at privacy@floe.so.

Where the GDPR or UK GDPR applies and Floe acts as a controller, we rely on these legal bases:

• Performance of a contract: to provide and operate the Service, manage accounts, and respond to support requests.
• Legitimate interests: to secure and improve the Service, prevent fraud and abuse, perform analytics, and communicate with business contacts. You may object to legitimate-interest processing at any time.
• Consent: for optional marketing communications and non-essential cookies. You may withdraw consent at any time.
• Legal obligation: to comply with applicable laws and respond to lawful requests from authorities.

Where Floe acts as a processor, the customer (as controller) is responsible for establishing the legal basis for processing End User data.

Floe does not use Customer Data, Demo Credentials, or Demo Interaction Data to train or fine-tune general-purpose AI or machine learning models without your prior written consent. We may use anonymized, aggregated data that cannot reasonably identify any individual or organization to improve the Service, develop features, and produce benchmarks.

Demo Credentials are encrypted at rest (AES-256) in per-account isolated storage. They are never shared across Floe customers, never used for purposes other than running the Service for your account, and never used to train AI models.

The Service signs into your product using your Demo Credentials and acts as that user: navigating pages, clicking, filling forms, and interacting with the UI to conduct demos on your behalf. You remain responsible for the actions taken while signed in as your demo account. Floe implements guardrails to prevent destructive actions (inviting or removing users, changing permissions, connecting integrations, sending real messages, or making purchases). However, the agent can create, modify, and delete data within the scope of the demo account’s permissions (see our Terms of Service for details). We recommend using a dedicated sandbox or low-privilege test account.

Each agent session is recorded. Recordings may include video of the product UI, audio of the conversation (when voice is enabled), a full text transcript, and engagement metadata. Recordings are stored in your Floe account and accessible to your team through the dashboard.

Where Floe acts as a processor, recordings are processed on behalf of the customer according to the customer’s instructions. Customers are responsible for providing End Users with appropriate notice that sessions may be recorded, as required by applicable law.

We do not sell personal data. We share it only as follows:

• With customers. Demo Interaction Data (including End User messages, session summaries, and lead records) is shared with the customer whose agent the End User interacted with.
• Service providers. We share data with sub-processors who help us operate the Service, including cloud infrastructure and object storage, AI model providers, speech-to-text and text-to-speech services, real-time media transport, product analytics, error monitoring, and transactional email. The complete list, including what each one processes and where, is published at floe.so/subprocessors.
• Legal compliance. We may disclose data when required by law, regulation, legal process, or governmental request, or to protect rights, property, or safety. We will seek to limit disclosures to the minimum necessary and, where legally permitted, notify affected customers beforehand.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, personal data may be transferred. We will notify you of any change in ownership or use of your data.

Floe is headquartered in the United States. Personal data may be transferred to and processed in the United States and other jurisdictions where Floe or its service providers operate. Where required by applicable data protection law, Floe implements appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission and other lawful transfer mechanisms. A copy of the relevant safeguards is available on request.

Retention periods by data category:

• Account data: retained for the duration of your account and for 30 days after account closure, then permanently deleted.
• Demo Credentials: retained while your site is active. Deleted immediately when you remove them from the dashboard or deactivate your account.
• Session recordings and transcripts: retained for 90 days, then automatically purged by a scheduled retention job. A different retention period can be agreed in an Order Form. After termination, deleted within 30 days.
• Lead records and ICP scores: retained until you delete them or deactivate your account.
• Customer Data: retained during the subscription period. Deleted within 30 days after termination, unless retention is required by law.
• Website analytics data: event data and session replays captured by PostHog on our marketing site are retained for the period configured in our PostHog project; anonymized, aggregated event data may be retained longer. To ask what the current period is, contact privacy@floe.so.

Anonymized, aggregated data that cannot reasonably identify any individual may be retained indefinitely. Data in backups is purged within 30 days of deletion from our primary systems.

You control your data. You can delete it at any time:

• Credentials— remove Demo Credentials from your site’s authentication settings in the dashboard.
• Recordings and leads — delete individual recordings, transcripts, or lead records from the dashboard.
• Account — deactivate your account to trigger deletion of all associated data. Retention windows apply as described in Section 10 above; account data is deleted from primary systems within 30 days of closure.

You may also request deletion by emailing privacy@floe.so. Deletion requests are processed from primary systems within 5 business days; data in backups is purged within 30 days as described in Section 10.

General Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, object to processing of, or receive a copy of your personal data. Where processing is based on consent, you may withdraw consent at any time (without affecting prior lawful processing).

To exercise your rights, contact us at privacy@floe.so. We may need to verify your identity. We will respond within the timeframe required by applicable law. If Floe processes your data on behalf of a customer, we may direct your request to that customer.

GDPR (EU/EEA and UK)

If you are in the EEA or UK, you have the right to lodge a complaint with your local data protection supervisory authority. A directory of EU authorities is available at edpb.europa.eu; the UK authority is the ICO. We would welcome the chance to address your concerns first.

CCPA (California)

We do not sell or share personal data as defined by the CCPA. When Floe processes personal information on behalf of a customer, we act as a service provider (Cal. Civ. Code § 1798.140(ag)) and process such information only for the business purposes specified in our Terms. California residents may request to know, access, or delete their personal information by contacting us. We will not discriminate against you for exercising your CCPA rights.

Floe protects personal data with:

• Encryption in transit (TLS 1.3) and at rest (AES-256).
• Per-account data isolation.
• Role-based access controls with least-privilege enforcement.
• Regular penetration testing and vulnerability scanning.
• Incident response procedures. Where Floe acts as a processor, we notify the customer of a personal data breach without undue delay after becoming aware, and in any event within 72 hours of becoming aware.

SOC 2 Type II certification is in progress. For details, see our Security documentation.

We use cookies and similar technologies on floe.so and our marketing properties for:

• Essential cookies: required for website functionality and security.
• Analytics and session replay: set by PostHog, our product analytics provider, to identify a returning browser across pages and to link the events and session replay described in Section 2 into a single session.

Consent. Where we detect that you are in the EEA, the UK, or Switzerland, we do not set analytics cookies or start session replay until you accept them in our cookie banner. Declining leaves only essential cookies in place. Elsewhere, analytics runs by default and the same banner lets you decline. You can change your choice at any time using the Cookie preferences link in the footer of our website; withdrawing is as easy as consenting, and takes effect immediately.

Region detection uses your browser’s time zone, which is an approximation — a VPN or travel can place you in the wrong group. Whichever group you are placed in, the banner always offers a decline, and declining always stops analytics cookies and session replay.

We do not currently deploy advertising or ad-retargeting cookies, and we do not run third-party ad pixels on our marketing site. If that changes, we will update this Disclosure and obtain consent where required before setting them.

The Floe agent widget deployed on customer websites may use essential session identifiers to maintain conversation state, and analytics identifiers to generate engagement reports for the customer. The widget does not set third-party advertising cookies. Customers control deployment and configuration on their websites.

You can also block or delete cookies through your browser settings. Blocking cookies may affect site functionality.

Floe is a B2B service and is not directed at children under 16. We do not knowingly collect personal data from children under 16. If we learn we have collected such data, we will delete it promptly. If you believe a child has provided us with personal data, contact us at privacy@floe.so.

Our website and agents may contain links to third-party websites. We are not responsible for the privacy practices of those websites. We encourage you to review their privacy policies.

We may update this Disclosure from time to time. Material changes will be communicated via email to the account owner at least 30 days before the changes take effect. The “Last Updated” date reflects the most recent revision.

Questions about this Disclosure or our privacy practices? Contact:

Privacy and data-subject requests: privacy@floe.so
Security issues and vulnerability reports: security@floe.so
Data protection matters and DPA requests: legal@floe.so

EEA and UK individuals. Floe is established in the United States. If you are in the EEA or the UK and wish to exercise your rights or raise a data protection concern, write to privacy@floe.so and we will respond within the timeframes required by the GDPR and UK GDPR. You may also lodge a complaint with your local supervisory authority as described in Section 12.

Floe AI Inc.
United States