Privacy Policy

Overview

Flona is a personalised AI ads and reels creation platform. You give us a brand URL and optional assets, and we generate short-form video content tailored to your brand, audience, and market. This Privacy Policy explains what personal data we collect when you visit flona.ai or use the Flona application, why we collect it, how we use it, and the rights you have over it.

We have written this policy in plain language. Where a section is specific to a region, jurisdiction, or a sensitive feature such as AI Twin (voice and face cloning), we have called it out so you can find it quickly.

Last updated: April 23, 2026.

Who we are

The data controller for information processed through flona.ai and the Flona application is FLONAAI TECHNOLOGIES PRIVATE LIMITED, a company incorporated in India under Corporate Identity Number U62099KA2026PTC218897, with its registered office at Naganands Comm Complex, 15/1, 185/2, 185A, 18th Main, Jayanagar, Bangalore South, Karnataka 560041, India.

You can reach us about privacy at support@flona.ai. Our Grievance Officer under India's Digital Personal Data Protection Act is Abhishek Singh, reachable at the same address.

What we collect

We only collect what we need to run the service. The categories below cover everything Flona touches.

Information you give us

• Account data. Name, email address, and authentication identifiers when you sign up through our auth provider (email, Google, or other supported sign-in).
• Brand data. The brand URL you paste, plus any logos, images, videos, product descriptions, colour palettes, or brand guidelines you upload or connect.
• Creative inputs. Prompts, scripts, edits, language and market selections, and any feedback you leave on generated content.
• AI Twin inputs. Short face video and voice samples you choose to upload so Flona can build a reusable AI creator. See the AI Twin section below.
• Billing data. Name, billing address, tax identifiers where required, and transaction records. Card and bank details are handled directly by our third-party payment processor and are not stored on Flona servers.
• Support data. Anything you send us through email or support channels.

Information we collect automatically

• Device and log data. IP address, browser type, operating system, device type, referring URL, timestamps, and similar technical signals, used for security and service reliability.
• Product usage. Features used, formats generated, errors encountered, and aggregated performance data so we can improve Flona.
• Website scrape output. When you paste a brand URL, we fetch the public pages at that URL and extract brand signals such as products, tone, colours, and imagery. We only fetch URLs you submit; we do not crawl the wider web on your behalf.
• Cookies and similar technologies. See our separate Cookie Policy for the exact list.

What we do not collect

We do not buy personal data from data brokers. We do not scrape social media profiles or your customers' data. We do not collect biometric data from anyone except the specific face and voice samples that you explicitly upload for AI Twin.

AI Twin and biometric data

AI Twin lets you clone a real face and voice so you can reuse it across ad formats. Because this involves biometric information, Flona treats AI Twin inputs with a higher standard of care than other data.

• Consent based. You must confirm that you are the person in the video or that you have documented written permission from every identifiable person in the video. Uploading a face or voice without consent is a material breach of our Terms.
• Purpose limited. Face and voice samples are used only to generate ad content for the account that uploaded them. We do not use AI Twin data to train general-purpose foundation models and we do not share it with other Flona customers.
• Encrypted at rest. AI Twin inputs and derived biometric embeddings are encrypted and access is restricted to a narrow set of internal services that are required to generate videos. Even the Flona team cannot read the raw biometric payloads.
• Deletable. You can delete an AI Twin from your account at any time. Within thirty (30) days we delete the underlying face and voice samples, embeddings, and cloned voice models from live systems. Backups are overwritten on our normal backup rotation schedule.
• Sensitive category. Where applicable law treats face or voice data as biometric, sensitive, or special-category personal data (for example under GDPR Article 9, India's DPDP Act, California's CPRA, or Illinois BIPA), we rely on your explicit consent and process it only for the purposes above.

If you believe an AI Twin has been created using your likeness without your consent, email support@flona.ai and we will investigate and remove it promptly.

How we use your data

• Deliver the service: authenticate you, understand your brand, generate scripts and videos, render them, and serve them back to you.
• Operate safely: prevent fraud, abuse, spam, and unauthorised use of the platform, including automated checks on uploaded content.
• Improve Flona: measure performance, debug errors, and prioritise new formats and features. We use aggregated or anonymised data wherever possible.
• Communicate with you: service emails, billing notices, security alerts, and product updates. Marketing emails are sent only with your consent or under a soft opt-in permitted by law, and you can unsubscribe at any time.
• Legal compliance: respond to lawful requests, enforce our Terms, and protect our rights and the rights of our users.

We do not use your brand assets, uploaded content, AI Twin biometrics, or generated videos to train general-purpose AI models for other customers. Brand context stays inside your account.

Legal bases for processing

Where GDPR, UK GDPR, or India's DPDP Act applies, we rely on the following legal bases:

• Contract. To create your account, deliver the service you signed up for, and bill you for it.
• Legitimate interests. To operate and secure the platform, prevent abuse, and improve Flona, where those interests are not overridden by your rights.
• Consent. For marketing emails, non-essential cookies, and AI Twin biometric processing. You can withdraw consent at any time without affecting processing that happened before you withdrew it.
• Legal obligation. Tax records, accounting, responding to lawful requests, and similar compliance needs.

How we share data

We do not sell your personal data. We share limited data with a small set of vendors that run critical parts of Flona, always under a written data processing agreement that restricts what they can do with it.

• Sub-processors. Infrastructure, storage, authentication, AI model providers, email delivery, and payment processors. See the list below.
• Within your team. If you join a team or agency workspace, other members may see content you create in that workspace.
• Corporate events. If Flona is merged, acquired, or reorganised, your data may transfer to the successor entity, under the protections of this policy.
• Legal requirements. When required by a valid legal process, to protect rights and safety, or to enforce our Terms.

Sub-processors

The following vendors may process personal data on Flona's behalf. We keep this list current; if a vendor changes we update this page.

International data transfers

Flona is headquartered in India, but our sub-processors may be located in the United States, the European Union, and other regions. When we move personal data across borders we rely on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission and equivalent frameworks accepted under India's DPDP Act and UK GDPR.

You can request a copy of the safeguards we have in place by emailing support@flona.ai.

How long we keep data

• Account data. For as long as your account is active.
• Brand assets and generated videos. Stored in your account until you delete them or close the account.
• AI Twin inputs and embeddings. Until you delete the AI Twin, after which removal from live systems happens within thirty (30) days.
• Billing and tax records. Up to eight (8) years, as required by Indian tax law.
• Server and access logs. Up to ninety (90) days for security and debugging.
• Deleted account. When you close your account we delete personal data within ninety (90) days, except what we must keep by law or to resolve disputes.

Security

We take security seriously. We encrypt data in transit with TLS and encrypt sensitive data at rest. Access to production systems is limited to a small group of engineers, protected by strong authentication, and logged. We run regular dependency and vulnerability reviews.

No system is perfect. If we ever become aware of a security incident that affects your data, we will notify you and the applicable regulators within the timelines required by law.

Your rights

Subject to your location and the data we hold, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or outdated data.
• Delete your data (also known as the right to be forgotten).
• Object to or restrict certain processing.
• Port your data to another service in a common format.
• Withdraw consent at any time.
• Complain to a supervisory authority.

To exercise any of these rights, email support@flona.ai. We will respond within the timelines required by the law that applies to you.

Notice to users in India (DPDP Act)

If you are in India, the Digital Personal Data Protection Act, 2023 applies to your personal data. Flona is the Data Fiduciary. You have the right to access and correct your data, withdraw consent, nominate another person to exercise your rights in the event of death or incapacity, and file a grievance.

Our Grievance Officer is Abhishek Singh and can be reached at support@flona.ai. We aim to acknowledge grievances within forty-eight (48) hours and resolve them within the timeline required by the Act.

Notice to users in the EEA and UK (GDPR)

If you are in the European Economic Area or the United Kingdom, Flona is the Controller for your personal data. Our legal bases are set out above. You have the rights listed in the Your Rights section, and you can complain to your local Data Protection Authority (for example, the ICO in the UK, the CNIL in France, or your Member State equivalent).

Where AI Twin or other processing involves special-category biometric data under Article 9 of the GDPR, we rely on your explicit consent.

Notice to users in California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioural advertising as those terms are defined under the CPRA. Face and voice biometric data submitted to AI Twin is treated as sensitive personal information and is used only for the purposes you authorise.

To exercise these rights, email support@flona.ai. We will not discriminate against you for exercising any of these rights.

Children

Flona is built for businesses and is not directed to children under the age of eighteen (18). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, email support@flona.ai and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make material changes we will notify you by email or through a notice in the Flona application before the change takes effect. The "Last updated" date at the top of the page shows when the policy was most recently revised.

Contact us

Questions about this policy or how we handle your data? Reach us at:

• Email: support@flona.ai
• Mailing address: FLONAAI TECHNOLOGIES PRIVATE LIMITED, Naganands Comm Complex, 15/1, 185/2, 185A, 18th Main, Jayanagar, Bangalore South, Karnataka 560041, India
• Governing law and courts: India, Bangalore, Karnataka, India