1Scope and parties
This policy applies to the Flosa website, the web panel, the Android and iOS apps, and the public API. "We" means the Flosa company and "you" means the organization that holds a Flosa account and the users who act on its behalf.
For the data your organization records in Flosa (documents, personnel, customers, letters), your organization is the "controller" and Flosa is the "processor"; that is, we work with it only on your instructions and to provide the service.
2What information we collect
We have four categories of information, and each has its own rules:
3How we use it
We use information only for these purposes: providing and maintaining the service, security and abuse prevention, support and responding to your requests, issuing invoices, and meeting legal obligations (such as submitting invoices to the tax system at your request).
We analyze usage statistics only in aggregated, anonymous form to improve the product. Your business data is never sold, rented, or used for targeted advertising.
4Liana AI and your data
Liana works within the same access boundaries: every answer is built only from records that the asking user is allowed to see, and it links back to the source record.
Conversation content, meeting audio, and texts are not used to train general models. After it is converted to text, meeting audio is deleted according to the organization admin's setting (default 30 days).
5Storage location and transfer
When you create your account, you choose the data region: Iran (Tehran), Europe (Frankfurt), UAE (Dubai), or Saudi Arabia (Riyadh). The database, files, and backups stay in that region.
Transfer to another region happens only on the organization admin's written request. Each company has a separate database, and data is encrypted at rest and in transit.
7Retention and deletion
We keep data as long as the contract is active. After the contract ends, the account stays read-only for 30 days so you can export; after that, the data and backups are permanently deleted and we issue a deletion certificate.
Security logs are kept for up to 12 months, and Flosa's own financial documents (your invoices) are kept in accordance with the tax laws of the relevant jurisdiction.
8Your rights
You or your organization admin can at any time:
10Security
TLS encryption in transit and AES-256 at rest, two-factor sign-in, granular roles and permissions, an immutable audit log, and frequent backups. Details and certification status are published in the Trust Center.
If a security incident affects your data, we notify the organization admin within 72 hours of detection.
11Changes to this policy
We notify the organization admin of material changes 30 days before they take effect, by email and an in-panel notice. Previous versions of this page, with dates, are available on request.