1. Who we are and how to reach us
flo.space is a product of FLO SPACE LLC, a New York limited liability company ("Company," "we," "us," or "our"). This Privacy Policy explains how the Company handles personal information in connection with the flo.space marketing website (the "Site"). It covers information we receive through the Site and, where noted, information we will collect when the flo.space product and paid accounts go live.
You can contact us about privacy at hello@flo.space, or by post at FLO SPACE LLC, 2405 Avenue T, Brooklyn, NY 11229.
- Where we operate. flo.space is offered to businesses in the United States.
- Scope. This policy applies to the flo.space application (covered in the section immediately below) and to the Site, including the early-access signup form at flo.space/signup, which is covered by Section 3a below. It does not apply to any other third-party website or service that links to or from the Site.
The flo.space Application
When you create a flo.space account and connect your tools, we access and store the following, only with your permission through each provider's official sign in:
- Email (Gmail and Outlook): we read your messages and threads to prepare action cards, and we prepare replies for your review. A message leaves your account only when you approve it. Nothing is ever sent automatically.
- Files and spreadsheets (Google Drive, Google Sheets, OneDrive and Excel): read only access, used to open the files and rows your prepared actions have to agree with, and to attach a file to a reply when you approve it.
- Calendars (Google Calendar and Outlook calendar): read access, used to prepare meeting actions. An event is added to your calendar, with an invite to everyone the reply goes to, only when you approve a meeting.
- Links in your email: when an email links to a shared file, like a Dropbox link, flo may open it to read the file, the same way it reads the email.
- We will update this Policy before flo connects to any other tool.
- Your account email address, used to identify your connection.
How we use this information: content from your connected tools (messages, files and records) is processed by Anthropic's Claude and Google's Gemini API, to classify incoming items, answer your questions and prepare drafts for your approval. It is never sent to any other AI provider. What you type when you sign up, including your onboarding interview answers, is processed by OpenAI, with Anthropic as a backup, to run the interview, and your interview answers are processed by Google's Gemini API to learn how your business works. We store your connection credentials, the actions flo prepares, the decisions you make, and the business facts flo learns for your workspace so it improves for you over time. Our AI providers process your content under terms that do not permit using it to train their models, and we never use your data to train AI models ourselves.
Who processes this information for us. These providers process data in the flo.space application, each only for the purpose listed:
- Google LLC (Gemini API): content from your connected tools, your onboarding interview answers, and what you ask flo in the app, for the AI processing described above.
- OpenAI: what you type when you sign up, including your onboarding interview answers, to run the interview.
- Anthropic (Claude): your connected email, incoming and sent, to sort it, read what replies state, and learn your business's own words and each person's voice; and what you type when you sign up, as OpenAI's backup for the interview.
- Clerk: your name, email address, password, sign-in codes, and your agreement to our Terms of Service and this Policy, to create your account and sign you in.
- Render: hosting for the flo.space application and its database, which stores your workspace data.
- Resend: the messages you send us through Contact support, to deliver them to our inbox.
We will update this list before any new provider receives your data.
What we never do: we do not sell your personal information. We do not share your data with data brokers or advertisers. No action prepared by flo.space is executed without a human approving it.
flo.space's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Data deletion: email hello@flo.space from your account email and we will delete your workspace data and confirm within 30 days, except where we are legally required to retain something.
Retention: we keep your workspace data while your account is active. Data is encrypted in transit.
The sections that follow cover the flo.space marketing website.
2. Categories of personal information we collect
The Site itself is a marketing brochure with no application backend: it has no account system and takes no payments. The information we actually receive comes from four places: the contact form, the early-access signup form, the /scan-me assessment, and bookings made through Cal.com. Using the categories defined by California law (CCPA/CPRA):
| Category | Examples on this Site | Do we receive it? |
|---|---|---|
| Identifiers | Full name and work email from the contact form; first and last name, company name, company address, work email and phone number from the early-access signup form; a random visit identifier from /scan-me; and your name and email address when you book a call through Cal.com. | Contact form: only if you send it (see Section 3b). Signup form: yes, when you submit it (see Section 3a). /scan-me: yes, for every visit (see Section 3c). Bookings: yes, when you book (see Section 3d). |
| Commercial information | The industry you select for your company on the early-access signup form, and your answers to the five questions that follow it. | Yes, from the signup form. |
| Financial information | Payment card or bank details. | No. No payment processor is connected and we accept no payment before launch. We never ask for card details. |
| Internet / network activity | Your IP address, browser user-agent and the address of the page you are on. | We record the IP address with a call and text consent (Section 3a), and the IP address, page address and user-agent on /scan-me (Section 3c). Google receives them once you accept the consent banner, and Cal.com when you open the booking page. |
| Professional / employment information | Your company name, company address, team size, and the industry your company operates in. | Contact form: only what you choose to tell us. Signup form: company name, company address and industry are required to submit it. |
| Account credentials | Passwords. | No. There is no account system, so there is nothing to log in to and no password to collect. |
We do not intentionally collect special-category or "sensitive" personal information (such as health, race, religion, precise geolocation, or government identifiers). Please do not include such information in free-text fields like the contact-form message.
3. Where the information comes from
- The contact form. Described in Section 3b. Submitting it sends your message to us directly.
- The early-access signup form. Described in full immediately below. It is part of this Site, not a separate service.
- The /scan-me assessment. Described in Section 3c.
- Booking a call. Described in Section 3d. The booking page is run by Cal.com.
- Automatically, to our font host. If you accept the consent banner, your browser fetches webfonts from Google, and that request includes your IP address and user-agent. If you decline, no such request is made. See Section 5 and our Cookie Policy.
3a. The early-access signup form
Every "Get early access" and "Join early access" button on this Site opens our signup form, in a window over the page or, on a small screen, at flo.space/signup. The form is part of this Site. Submitting it does not send you to another company's website.
What we collect there: your first and last name, your company name, your company address (street, city, state, ZIP or postal code, and country), your work email address, your phone number with its country calling code, and the industry you select for your company. All of these are required to submit the form, as is ticking the box confirming you agree to this Policy and to our Terms of Service; we record that agreement and its exact wording with your submission, along with the date and time you submitted it. If you go on to the five questions that follow the form, about how your business runs, we keep your answers too. If you tick the separate, optional consent box for calls and texts, we also record that consent, the exact wording you agreed to, and the IP address the submission came from. Those last three exist so we can evidence that you gave permission before we ever call or text you; we record them only when you tick the box, and not otherwise.
Address suggestions. As you type in the street address field, what you have typed is sent to our own server, which asks an address-lookup service for matching addresses and returns them to you. That service is the Google Places API, or the Photon service operated by komoot GmbH over OpenStreetMap data where Google is not configured. Either way your browser never contacts them, so they receive the address text and our server's network address, not yours, and set no cookie on your device. No other field on the form is sent. The lookup is a convenience only: you can ignore the suggestions and type every address field yourself, and the form works identically if you do.
Why: to assess whether flo.space is a good fit for your business, to prepare setup recommendations for you, and to contact you about early access and about our public launch. We contact you by email. Where you ticked the optional consent box beside the phone field, we may also contact you by call or text message, including by automated dialing technology. Ticking it is never a condition of joining, and if you leave it unticked we use your phone number only so that a person can follow up about your submission.
Where it goes: your submission is recorded as a row in a private Google Sheet in our own Google Workspace account. The website that collects it is hosted by Vercel, Inc. The sheet is not published or shared, and is reachable only by authorized personnel. We do not sell this information or share it for advertising.
How long we keep it: up to 24 months from your submission, or less if you ask us to delete it sooner.
How to opt out or have it deleted: reply STOP to any text message to stop texts; use the unsubscribe link in any email we send you to stop emails; or email hello@flo.space to be removed from the list entirely or to request deletion of your submission. We respond within 30 days.
3b. The contact form
What we collect: your name, work email, company, team size, your message, and a source tag identifying which page the message came from.
Why: to respond to your inquiry. Nothing else — we do not add contact-form senders to a marketing list.
Where it goes: the message is stored as a row in a private spreadsheet in Google Workspace, reached through hosting provided by Vercel, Inc., and a notification email is delivered to our own inbox through Google Workspace (Gmail). It is reachable only by authorized personnel.
How long we keep it: up to 24 months, or less if you ask us to delete it sooner.
Deletion: email hello@flo.space and we will remove your message and confirm within 30 days.
3c. The Operator Tax assessment (/scan-me)
This page is reached by scanning a QR code. It asks five questions about how your working week is spent and shows you the result. It asks for no contact details of any kind, and you are never identified by name or email.
What we collect: a random identifier generated in your browser for that visit, the date and time, how far through the five questions you got, the answers you gave (hours a day, days a week, the percentage you estimated, what you selected as the causes, what you would do with the time, and the revenue range you picked), and whether you tapped through to book a call. We also record the IP address the visit came from, the page address you opened, and your browser user-agent.
Why: to count how many people scan the code, see where in the five questions people stop, and understand the range of answers given, so we can improve the assessment. Our legal basis is legitimate interests (measuring and improving our own marketing). The random identifier is not linked to any account or signup, and we do not use it to build a profile of you or to advertise to you.
Where it goes: a row in the same private spreadsheet in Google Workspace described above, reached through hosting provided by Vercel, Inc. It is reachable only by authorized personnel.
How long we keep it: up to 24 months.
Deletion: because the record carries no contact details, we cannot find your row from your name or email alone. If you want it removed, email hello@flo.space with the approximate date and time you used the assessment and we will locate and delete it, and confirm within 30 days.
3d. Booking a call
What we get: the details you enter in the Cal.com booking form, and the time you pick.
Why: to hold the call and follow up.
How long we keep it: up to 24 months, or less if you ask us to delete it sooner.
Deletion: email hello@flo.space and we will remove your booking and confirm within 30 days.
4. Why we process your information, and our legal bases
Where the EU or UK GDPR applies, we rely on the legal bases noted below for each purpose.
| Purpose | GDPR legal basis |
|---|---|
| Responding to your contact-form or sales enquiry. | Our legitimate interest in answering people who contact us, and taking steps at your request prior to any contract. |
| Assessing fit, preparing setup recommendations, and contacting you about early access and launch by email. | Steps taken at your request prior to a contract, and our legitimate interest in building the product with the businesses that will use it. |
| Contacting you by call or text message about early access. | Your consent, given by ticking the optional box beside the phone field on the signup form. You can withdraw it at any time by replying STOP. |
| Loading webfonts so the Site renders correctly, and keeping the Site secure and functional. | Your consent for the webfont load, given through the consent banner; and our legitimate interest in operating a working, secure website. |
| Complying with law and defending legal claims. | Compliance with a legal obligation, and our legitimate interests. |
Where we rely on legitimate interests, we have balanced those interests against your rights. You can object to that processing at any time (see Section 8).
5. Third parties we disclose to (subprocessors)
We keep the list short. These are the only third parties your data reaches through the Site today, and we disclose the minimum necessary for each to do its job:
| Recipient | What it receives | Purpose |
|---|---|---|
| Google LLC (Google Ads) | Your IP address, user-agent, the pages you view on this Site, and any Google advertising identifiers already in your browser — only after you accept the consent banner. If you decline, this tag is never requested and none of it is sent. We do not send Google your name, email address, or phone number. | measuring which advertisements lead to signups, so we do not keep paying for ones that do not |
| Google LLC (Google Fonts) | Your IP address and user-agent, only after you accept the consent banner. | serving web fonts so the site renders correctly |
| Vercel, Inc. | Your signup-form submission and your contact-form message pass through it, as the host of this website. It does not retain either. | website hosting |
| Google LLC (Google Workspace) | Your early-access signup, your contact-form message and your /scan-me visit, each stored as a row in a private Google Sheet; and, for the contact form, a notification email containing your message, delivered to our own inbox through Gmail. | storing early-access signups, contact-form messages and /scan-me visits, and contact-form email delivery |
| Google LLC (Google Places API), or komoot GmbH (Photon) | The text you type into the street address field on the signup form, sent from our server as you type so we can offer matching addresses. One service is used at a time. Your browser does not contact either of them, and no other field is sent. | address suggestions on the signup form |
| Cal.com, Inc. | Your IP address, user-agent and the address of the page you are on when the booking page loads, and what you type into it. The booking page loads only when you open Book a call or the Custom plan window, or press "Load the booking page (Cal.com)" on flo.space/meet. | booking a call with us |
We may also disclose information to professional advisers, or to authorities and other parties where required by law or to protect our rights. The providers that process data in the flo.space application are listed in "The flo.space Application" section above. When paid accounts go live we expect to add a payment processor, and we will update this Policy before doing so.
We do not sell your personal information, and we work with no data brokers. We do run Google Ads conversion measurement, and only if you accept the consent banner. Depending on how California and other US state privacy laws are applied, that may count as "sharing" for cross-context behavioral advertising — so treat the banner as your control: decline it, or reopen it from the footer and change your answer, and the tag is never loaded.
6. International data transfers
Our providers are mostly based in the United States, and some, including Google, may process or store data in other countries where they or their agents operate. You can ask us for more detail using the contact details in Section 1.
7. How long we keep information
Early-access signup submissions are kept for 24 months, or less if you ask us to delete them sooner (Section 3a). Contact-form messages (Section 3b), /scan-me visits (Section 3c) and bookings (Section 3d) are kept for 24 months. Account and billing data: not applicable until accounts launch. We keep information only as long as needed for the purposes in Section 4 or to meet legal obligations, and then delete or anonymize it.
8. Your privacy rights
8a. US state privacy rights
Depending on where you live (for example California, Colorado, Connecticut, Virginia, Utah and other states with comprehensive privacy laws), you may have the right to:
- Know about and access the personal information we hold about you;
- Delete your personal information;
- Correct inaccurate personal information;
- Opt out of the sale or sharing of your personal information and of targeted advertising;
- Limit the use of sensitive personal information;
- Not be discriminated against for exercising your rights; and
- Appeal a decision we make about your request.
Do Not Sell or Share My Personal Information. We do not sell your personal information. Google Ads conversion measurement, which runs only if you accept the consent banner, may count as "sharing" for cross-context behavioral advertising (Section 5). To opt out, decline the banner, or reopen it from the footer and change your answer. You may still exercise your other rights above.
8b. EU / UK (GDPR) rights
If the GDPR or UK GDPR applies to you, you have the right to:
- Access a copy of your personal data;
- Have inaccurate data rectified;
- Have your data erased ("right to be forgotten");
- Restrict our processing of your data;
- Receive your data in a portable format and have it transmitted to another controller;
- Object to processing based on our legitimate interests;
- Withdraw any consent you have given, without affecting prior processing; and
- Lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office).
8c. How to make a request
Send your request to hello@flo.space. To protect your data we will verify your identity before acting — usually by confirming you control the email address associated with your request and asking you to confirm details we already hold. You may use an authorized agent where the law allows. We will respond within the timeframe required by the applicable law and will not charge a fee except where permitted.
9. Deleting your data
There are no accounts today. What we do hold is early-access signup submissions, contact-form messages, bookings, and /scan-me visits (Section 3c says how we find yours). To have yours deleted, email hello@flo.space — we will remove it from our database and confirm within 30 days, except where we must keep something to meet a legal obligation. When accounts go live you will also be able to delete an account and its data from within account settings.
10. Children's privacy
The Site is intended for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16, and we do not knowingly sell or share such information. If you believe a child has provided us information, contact us at hello@flo.space and we will delete it. This reflects our obligations under COPPA and Article 8 of the GDPR.
11. Security
We aim to protect personal information with reasonable technical and organizational measures. The Site has no account system, so there are no credentials to compromise, and it takes no payments, so there is no card data to hold. What we do store (early-access signups, contact-form messages, /scan-me visits and bookings) is transmitted over HTTPS, held in an access-restricted database, and reachable only by authorized personnel. When the product and accounts go live, we intend to encrypt data in transit and at rest, store passwords only as salted hashes, and use a reputable payment processor so card details are handled by that processor rather than by us.
No method of transmission or storage is completely secure, and we do not claim any formal security certification (such as SOC 2) that we have not actually achieved. We will describe our certifications here only once they are in place.
12. Cookies and tracking
The Site sets no cookies of its own, and nothing third-party runs until you accept the consent banner, except the Cal.com booking page, which loads only when you open it. Decline, and the only thing the Site stores in your browser is that choice itself, so we can honour it without asking again. The live demo at flo.space/preview is the one exception: if you open it, it keeps its own settings, such as its layout and recent searches, in your browser, and never sends them to us. Accept, and two things load: Google Ads conversion measurement, which sets Google's own _gcl_* cookies, and webfonts from Google — both receive your IP address and user-agent, as described in Section 5. We run no session-recording tools and no chat widget. For the full picture, see our Cookie Policy.
13. Changes to this policy
We will update this policy when our practices change — in particular when the product and paid accounts go live. When we do, we will revise the "Last updated" date at the top of this page. The effective date of this version is October 30, 2026. Please review it periodically.
14. Contact and complaints
Questions, requests or complaints about privacy can be sent to hello@flo.space, or by post to FLO SPACE LLC, 2405 Avenue T, Brooklyn, NY 11229. If you are in the EU or UK you also have the right to complain to your local supervisory authority, but we would appreciate the chance to address your concern first.
See also our Terms of Service, Early Access Terms, and Accessibility Statement.
Related: Privacy Policy · Terms of Service · Cookie Policy · Early Access Terms · Accessibility Statement