Privacy Policy

Overview

Flona AI generates AI ads/reels built for your market. You give us a brand URL and optional assets, and we generate short-form video content tailored to your brand, audience, and market. This Privacy Policy explains what personal data we collect when you visit flona.ai, use the Flona application, or use the separately deployed Flona Studio editor, why we collect it, how we use it, and the rights you have over it.

We have written this policy in plain language. Where a section is specific to a region, jurisdiction, or a sensitive feature such as AI Twin (voice and face cloning), we have called it out so you can find it quickly.

Last updated: August 13, 2026.

Who we are

The data controller for information processed through flona.ai and the Flona application is FLONAAI TECHNOLOGIES PRIVATE LIMITED, a company incorporated in India under Corporate Identity Number U62099KA2026PTC218897, with its registered office at Naganands Comm Complex, 15/1, 185/2, 185A, 18th Main, Jayanagar, Bangalore South, Karnataka 560041, India.

You can reach us about privacy at support@flona.ai. Our Grievance Officer under India's Digital Personal Data Protection Act is Abhishek Singh, reachable at the same address.

What we collect

We only collect what we need to run the service. The categories below cover everything Flona touches.

Information you give us

• Account data. Name, email address, and authentication identifiers when you sign up through our auth provider using email, social sign-in, or another supported method.
• Brand data. The brand URL you paste, plus any logos, images, videos, product descriptions, colour palettes, or brand guidelines you upload or connect.
• Creative inputs. Prompts, scripts, edits, language and market selections, and any feedback you leave on generated content.
• Onboarding and business profile data. Your role, target markets, creative goals, advertising platforms, expected content volume, company information, and other answers you submit while setting up or using the Service.
• AI Twin inputs. Short face video and voice samples you choose to upload so Flona can build a reusable AI creator. See the AI Twin section below.
• Billing data. Name, billing address, tax identifiers where required, and transaction records. Card and bank details are handled directly by our third-party payment processor and are not stored on Flona servers.
• Support data. Anything you send us through email or support channels. Contact and sales forms may also collect your name, work email, company, job title, company size, advertising spend range, preferred contact time, brand URL, and message.
• Inferred data. Signals produced from the content you submit, such as brand tone, product attributes, target audience, visual characteristics, language, accent, approximate age range, and other attributes needed to generate or match media. These are model-generated estimates and may be inaccurate.

Information we collect automatically

• Device and log data. IP address, browser type, operating system, device type, referring URL, timestamps, and similar technical signals, used for security and service reliability.
• Product usage. Features used, formats generated, page and element interactions, form interactions, attribution information, sessions, errors encountered, diagnostics, and performance data. Where enabled and permitted, this includes sampled session replay used to understand product friction. We do not intentionally include AI Twin source media or payment-card numbers in replay.
• Website scrape output. When you paste a brand URL, we fetch the public pages at that URL and extract brand signals such as products, tone, colours, and imagery. We only fetch URLs you submit; we do not crawl the wider web on your behalf.
• Cookies and similar technologies. See our separate Cookie Policy for the exact list.
• Contact-form security data. When you submit a support or sales form, we record your IP address and user agent to prevent spam, enforce submission limits, investigate abuse, and help deliver your request.
• Flona Studio local data. The browser editor stores projects, media, thumbnails, preferences, and related metadata in your browser using IndexedDB, Origin Private File System (OPFS), and local storage. This local project data remains on the device unless you delete it, clear browser storage, or use a server-backed feature.

What we do not collect

We do not buy personal data from data brokers. We do not indiscriminately crawl the wider web. Some optional extraction and research tools may retrieve public product, brand, marketplace, or social-media information when needed for a URL or task you submit. We do not intentionally collect biometric data except from face and voice media submitted for AI Twin or voice-cloning features.

AI Twin and biometric data

AI Twin lets you clone a real face and voice so you can reuse it across ad formats. Because this involves biometric information, Flona treats AI Twin inputs with a higher standard of care than other data.

• Consent based. You must confirm that you are the person in the video or that you have documented written permission from every identifiable person in the video. Uploading a face or voice without consent is a material breach of our Terms.
• Purpose limited. Face and voice samples are used only to generate ad content for the account that uploaded them. We do not use AI Twin data to train general-purpose foundation models and we do not share it with other Flona customers.
• Encrypted at rest. AI Twin inputs and derived biometric embeddings are encrypted and access is restricted to a narrow set of internal services that are required to generate videos. Even the Flona team cannot read the raw biometric payloads.
• Deletable. You can delete an AI Twin from your account where a deletion control is available, or request deletion by emailing us. Removing an item from a screen or cancelling a job does not necessarily erase copies already stored by Flona or an AI provider. After verifying a valid request, we delete or de-identify the applicable source media, derived data, and cloned model from systems we control and instruct applicable processors to do the same, subject to legal retention, fraud prevention, dispute resolution, and backup-rotation requirements.
• Sensitive category. Where applicable law treats face or voice data as biometric, sensitive, or special-category personal data (for example under GDPR Article 9, India's DPDP Act, California's CPRA, or Illinois BIPA), we rely on your explicit consent and process it only for the purposes above.

If you believe an AI Twin has been created using your likeness without your consent, email support@flona.ai and we will investigate and remove it promptly.

How we use your data

• Deliver the service: authenticate you, understand your brand, generate scripts and videos, render them, and serve them back to you.
• Operate safely: prevent fraud, abuse, spam, and unauthorised use of the platform, including automated checks on uploaded content.
• Improve Flona: measure performance, debug errors, and prioritise new formats and features. We use aggregated or anonymised data wherever possible.
• Communicate with you: service emails, billing notices, security alerts, and product updates. Marketing emails are sent only with your consent or under a soft opt-in permitted by law, and you can unsubscribe at any time.
• Legal compliance: respond to lawful requests, enforce our Terms, and protect our rights and the rights of our users.

We do not use your brand assets, uploaded content, AI Twin biometrics, or generated videos to train a Flona general-purpose foundation model for other customers. We may use aggregated or de-identified operational information to improve reliability, safety, and product performance.

AI providers and model data

Flona routes different tasks to specialised providers. Depending on the feature, this can include prompts, scripts, brand and product context, public webpage content, reference images, uploaded images, video, audio, transcripts, voice samples, generated outputs, locale, and technical job metadata. We send only the information reasonably needed for that task.

Providers may temporarily retain requests and outputs for service delivery, abuse prevention, caching, troubleshooting, or legal compliance under their enterprise terms and our configuration. Flona's promise not to train its own general-purpose model does not mean that no processor ever retains data. We select business API services and configure limited-retention or no-training controls where they are available and appropriate.

AI output and inferred attributes are probabilistic. They may be inaccurate, incomplete, or reflect characteristics that are not actually true. They are used to provide creative tools, not to make legal, employment, credit, healthcare, or similarly significant decisions about people.

Legal bases for processing

Where GDPR, UK GDPR, or India's DPDP Act applies, we rely on the following legal bases:

• Contract. To create your account, deliver the service you signed up for, and bill you for it.
• Legitimate interests. To operate and secure the platform, prevent abuse, and improve Flona, where those interests are not overridden by your rights.
• Consent. For marketing emails, non-essential cookies, and AI Twin biometric processing. You can withdraw consent at any time without affecting processing that happened before you withdrew it.
• Legal obligation. Tax records, accounting, responding to lawful requests, and similar compliance needs.

How we share data

We do not sell your personal data. We share limited data with a small set of vendors that run critical parts of Flona, always under a written data processing agreement that restricts what they can do with it.

• Sub-processors. Infrastructure, storage, authentication, AI model providers, email delivery, and payment processors. See the list below.
• Within your team. If you join a team or agency workspace, other members may see content you create in that workspace.
• Links and exports you share. When you copy, share, or export a generated-media link, anyone who receives an accessible link may be able to view or download that content. You are responsible for choosing recipients and publication settings.
• Corporate events. If Flona is merged, acquired, or reorganised, your data may transfer to the successor entity, under the protections of this policy.
• Legal requirements. When required by a valid legal process, to protect rights and safety, or to enforce our Terms.

Service providers

We use carefully selected service providers to operate Flona. They process personal data only for contracted purposes, under confidentiality, security, data-protection, and deletion obligations appropriate to the service they provide.

These providers support categories such as application hosting and content delivery; authentication and account security; object and media storage; AI text, image, video, audio, transcription, and voice processing; public webpage extraction; workflow orchestration; product analytics and sampled session replay; error diagnostics and performance monitoring; transactional email and support delivery; and payment processing, tax, invoicing, fraud prevention, and Merchant of Record functions.

A provider receives only the data reasonably needed for its function. The providers used for a particular request depend on the feature, media type, model availability, account configuration, and region. For enterprise contracting or a legally valid request, contact support@flona.ai for additional information about applicable processor categories and safeguards.

International data transfers

Flona is headquartered in India, but our sub-processors may be located in the United States, the European Union, and other regions. When required, we use contractual, technical, and organisational safeguards for cross-border processing, including applicable data-processing agreements, the European Commission's Standard Contractual Clauses, and the UK Addendum or another lawful transfer mechanism.

You can request a copy of the safeguards we have in place by emailing support@flona.ai.

How long we keep data

• Account data. For as long as your account is active.
• Brand assets and generated videos. Stored in your account until you delete them or close the account.
• AI Twin inputs and embeddings. Until you delete the AI Twin or submit a verified deletion request, subject to the provider, legal-retention, dispute, and backup qualifications described above.
• Billing and tax records. Up to eight (8) years, as required by Indian tax law.
• Server and access logs. Up to ninety (90) days for security and debugging.
• Support and sales enquiries. For as long as reasonably needed to respond, maintain a business record, prevent abuse, and follow up on the relationship, after which they are deleted or de-identified under our retention process.
• Analytics and diagnostics. According to the retention settings of the relevant analytics or monitoring tool and no longer than reasonably needed for product analysis, security, and troubleshooting.
• Account closure and erasure requests. Closing an identity-provider account may deactivate access but does not by itself erase every Flona record. To request erasure, email us. We verify and process requests within the period required by applicable law, while retaining billing, tax, fraud, security, legal-claim, and dispute records where required or permitted.

Security

We take security seriously. We encrypt data in transit with TLS and encrypt sensitive data at rest. Access to production systems is limited to a small group of engineers, protected by strong authentication, and logged. We run regular dependency and vulnerability reviews.

No system is perfect. If we ever become aware of a security incident that affects your data, we will notify you and the applicable regulators within the timelines required by law.

Your rights

Subject to your location and the data we hold, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or outdated data.
• Delete your data (also known as the right to be forgotten).
• Object to or restrict certain processing.
• Port your data to another service in a common format.
• Withdraw consent at any time.
• Complain to a supervisory authority.

To exercise any of these rights, email support@flona.ai. We will respond within the timelines required by the law that applies to you.

Notice to users in India (DPDP Act)

If you are in India, the Digital Personal Data Protection Act, 2023 applies to your personal data. Flona is the Data Fiduciary. You have the right to access and correct your data, withdraw consent, nominate another person to exercise your rights in the event of death or incapacity, and file a grievance.

Our Grievance Officer is Abhishek Singh and can be reached at support@flona.ai. We aim to acknowledge grievances within forty-eight (48) hours and resolve them within the timeline required by the Act.

Notice to users in the EEA and UK (GDPR)

If you are in the European Economic Area or the United Kingdom, Flona is the Controller for your personal data. Our legal bases are set out above. You have the rights listed in the Your Rights section, and you can complain to your local Data Protection Authority (for example, the ICO in the UK, the CNIL in France, or your Member State equivalent).

Where AI Twin or other processing involves special-category biometric data under Article 9 of the GDPR, we rely on your explicit consent.

Notice to users in California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, to delete it, to correct it, and to limit the use of sensitive personal information. We do not sell or share personal information for cross-context behavioural advertising as those terms are defined under the CPRA. Face and voice biometric data submitted to AI Twin is treated as sensitive personal information and is used only for the purposes you authorise.

To exercise these rights, email support@flona.ai. We will not discriminate against you for exercising any of these rights.

Children

Flona is built for businesses and is not directed to children under the age of eighteen (18). We do not knowingly collect personal data from children. If you believe a child has provided us personal data, email support@flona.ai and we will delete it.

Changes to this policy

We may update this policy from time to time. When we make material changes we will notify you by email or through a notice in the Flona application before the change takes effect. The "Last updated" date at the top of the page shows when the policy was most recently revised.

Contact us

Questions about this policy or how we handle your data? Reach us at:

• Email: support@flona.ai
• Mailing address: FLONAAI TECHNOLOGIES PRIVATE LIMITED, Naganands Comm Complex, 15/1, 185/2, 185A, 18th Main, Jayanagar, Bangalore South, Karnataka 560041, India
• Governing law and courts: India, Bangalore, Karnataka, India