Privacy Policy

Last updated: 16 August 2026

This Privacy Policy explains how Flow Leap SASU ("FlowLeap", "we", "us") collects, uses, shares, and protects personal data when you use the FlowLeap desktop application, website at flowleap.co, dashboard, API, and related services (the "Service").

We are committed to protecting your privacy and the confidentiality of your patent work. We do not use your content to train AI models (see Section 5).

This policy is written for the European Union General Data Protection Regulation (GDPR) and French data-protection law, overseen by the CNIL.

1. Who is responsible for your data

For personal data processed through the Service, the data controller is:

Flow Leap SASU — registered in the French National Business Register (RNE) under SIREN 988 064 721, with head-office SIRET 988 064 721 00018, VAT number FR81 988 064 721, and registered office at 47 rue Marcel Bonnet, 94230 Cachan, France.

Privacy contact: contact@flowleap.co

Where we process personal data on behalf of an Organization (for example, content submitted by an Organization's members in the course of their work), we generally act as a data processor for that Organization, which is the controller of that data. In that case, our Data Processing Agreement governs that processing, and you should also consult your Organization's own privacy notice.

2. Scope

This policy covers personal data of account holders, Organization members, website visitors, and people who contact us. It does not cover third-party websites or services we link to, or the Model Provider and agent harness accounts you choose to connect, which have their own policies.

3. What data we collect

Data you provide:

Identity and account data — name, email address, and authentication details (managed via our identity provider, Clerk).
Organization data — Organization name, your role, membership, and settings.
Billing data — subscription plan, billing details, and invoices (payments are handled by our payment provider, Stripe; we do not store full card numbers).
Your Content — the Inputs you submit (prompts, instructions, documents, prior-art references, drafts, claims) and the Outputs generated for you.
Support and communications — messages you send us and related details.

Data collected automatically:

Technical data — IP address, device and browser information, and application version.
Usage data — feature usage, request counts, tool activity, diagnostics, and activity/audit events.
Cookies and similar technologies — as described in Section 11.

We do not intentionally collect special-category personal data, and you should avoid submitting it as Input unless necessary and lawful.

4. How and why we use your data (purposes and lawful bases)

Purpose	Examples	Lawful basis (GDPR Art. 6)
Provide the Service	Authenticate you, run AI features and patent-data tools, return Outputs, and manage Organizations	Performance of a contract
Billing and payments	Process subscriptions, invoices, taxes	Contract; legal obligation
Security and abuse prevention	Protect accounts, detect and prevent fraud and misuse, maintain audit logs	Legitimate interests; legal obligation
Support	Respond to your requests	Contract; legitimate interests
Service improvement (aggregated)	Anonymous/aggregated statistics and diagnostics — not model training	Legitimate interests
Communications	Service and security notices	Contract / legitimate interests
Marketing (if any)	Product news, newsletters	Consent (you can opt out anytime)
Legal compliance and disputes	Comply with law, enforce our Terms, establish or defend legal claims	Legal obligation; legitimate interests

Where we rely on legitimate interests, we balance them against your rights and have concluded our interests do not override them; you may object (see Section 12).

5. Your Content: our commitments

5.1 We do not train on your content. We do not use your Inputs or Outputs to train, fine-tune, or improve any AI models, and our agreements with AI Service Providers prohibit them from using your content to train their models. Your chosen Model Provider processes primary inference under its own terms.

5.2 Confidentiality. We treat Your Content as confidential. Access is limited to personnel and sub-processors who need it to provide the Service, under confidentiality obligations.

5.3 Primary model inference. Primary model inference uses the Model Provider account, credentials, or agent harness you select. FlowLeap does not proxy or pay for that model usage. Your selected provider processes those requests under your separate agreement with it, including its privacy, retention, and training terms.

5.4 FlowLeap-managed AI tools. Three features run on FlowLeap's own AI Service Provider accounts rather than on the Model Provider account you select:

Document OCR — the document you submit is sent to Mistral AI to be converted to text.
Analyst narration — on FlowLeap's patent-analytics pages, the patent or applicant you asked about, together with the analytics already displayed, is sent to Anthropic to produce the written commentary. The charts themselves are computed from patent-statistics data and involve no AI Service Provider.
Public Try Agent — a question submitted to the home-page demonstration, together with the PATSTAT results needed to answer it, is sent to DeepSeek V4 Pro through Vercel AI Gateway. This demonstration is separate from the desktop product and must not be used for confidential or unfiled inventions.

Each sends only the content that feature needs, to the providers listed in Section 7, which process it under FlowLeap's instructions. No other feature sends Your Content to a model FlowLeap pays for.

Separately, our legal-reference search converts your search text into a numerical representation to rank results. That conversion runs on FlowLeap's own servers, so no AI Service Provider receives that text.

Until August 2026, FlowLeap-managed query building and claim analysis also ran on our AI Service Provider accounts. Those features were withdrawn from our servers and now run on the Model Provider account you select. Our public data-handling page records what leaves your machine, feature by feature, and is updated whenever that changes.

5.5 You stay in control. You can access, export, and delete Your Content from the Service, subject to limited backup and legal-retention periods (Section 9).

6. We do not sell your data

We do not sell your personal data, and we do not use Your Content for advertising or to build advertising profiles.

Your chosen Model Provider or agent harness processes primary inference under your separate relationship with it. User-selected BYOK providers are therefore not included in FlowLeap's subprocessor table for primary inference. If FlowLeap separately engages the same company for a FlowLeap-managed feature, that separate processing relationship appears below.

We share personal data only as needed to run FlowLeap-managed parts of the Service, with providers bound by data-protection terms, and with authorities where required by law. Our key sub-processors are:

Sub-processor	Purpose	Location	Notes
Mistral AI	Document OCR	EU (France)	No training under FlowLeap's provider terms
Anthropic	Analyst narration on the patent-analytics pages	USA	No training under FlowLeap's provider terms
DeepSeek, routed through Vercel AI Gateway	Public home-page Try Agent	Provider infrastructure	PATSTAT-only demonstration; do not submit confidential material
Clerk	Authentication and account management	USA	—
Stripe	Payments and billing	USA	Card data handled by the payment provider
Vercel	Application hosting and delivery	USA	—

We may also share data with professional advisers, and with authorities, courts, or regulators (including the CNIL) where legally required, and in connection with a merger, acquisition, or sale of assets (with notice where required).

Patent-data queries are transmitted to the data services needed to fulfil your request, including EPO OPS and USPTO ODP. When you supply your own patent-data credentials, they are forwarded to the relevant service for authentication and are not persisted by FlowLeap.

We keep an up-to-date list of sub-processors and will update this policy when it changes. Our data-handling page sets out the same facts feature by feature, including what is retained and for how long.

8. International data transfers

Some of our sub-processors are located outside the European Economic Area (notably in the United States). Where we transfer personal data outside the EEA, we rely on appropriate safeguards under the GDPR, primarily the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate. You can request more information about these safeguards using the contact details below.

9. Data retention

We keep personal data only as long as necessary for the purposes above, then delete or anonymize it. Indicative periods:

Your Content — until you delete it or your Account/Organization is terminated, subject to limited backups.
Account data — for the life of your Account, then deleted or anonymized within a reasonable period after closure.
Technical/usage logs — a limited rolling period for security and diagnostics.
Billing records and invoices — as required by French law (typically up to 10 years).
Support records — for a limited period after the matter is resolved.

10. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and least-privilege access to Your Content. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a personal-data breach where the law requires.

11. Cookies

We use strictly necessary cookies to operate the Service and, with your consent where required, limited analytics. You can manage non-essential cookies through our cookie controls.

12. Your rights

Under the GDPR, you have the right to: access your data; rectify inaccurate data; erase data; restrict or object to processing (including processing based on legitimate interests); data portability; and to withdraw consent at any time where processing is based on consent. You also have the right not to be subject to solely automated decisions producing legal or similarly significant effects; we do not make such decisions about you.

To exercise your rights, contact us at contact@flowleap.co. We will respond within the time limits required by law. If your data is processed on behalf of an Organization, we may direct your request to that Organization as controller.

You also have the right to lodge a complaint with a supervisory authority — in France, the Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr.