© Innora Lab 2026
The company Studio Flora, publisher of the Innora Lab service, attaches fundamental importance to the protection of privacy and personal data of its users. This Privacy Policy is intended to inform you, in a clear, transparent and accessible manner, about the nature of the data we collect, the purposes for which we process them, their retention period, the recipients of this data and your rights.
Studio Flora is a French company that offers its service to users residing in France, the European Economic Area, the United Kingdom and the rest of the world. This Policy is intended to apply to all of these users, in compliance with the rights recognised by their local legislation.
This Policy applies to all processing carried out as part of the use of the innoralab.ai website and the Innora Lab application (hereinafter, together, the "Service"). It complies with Regulation (EU) 2016/679 of 27 April 2016 on data protection (hereinafter the "GDPR"), French Law No. 78-17 of 6 January 1978 as amended, known as "Informatique et Libertés", as well as equivalent regulations applicable in other jurisdictions concerned, in particular the UK GDPR for users residing in the United Kingdom.
At the date of publication of this Policy, the Innora Lab application is being finalised. Certain treatments described below (in particular those related to subscribing to a subscription, creating an account and using artificial intelligence assistants) will only be effectively implemented from the opening of the Service to the public. Currently active processing mainly concerns the innoralab.ai marketing site, newsletter registration, the contact form and the waiting list.
1. Data Controller
The data controller for personal data is the company Studio Flora, a single-member simplified joint-stock company with a capital of 100 euros, whose registered office is located at 60 rue François 1er, 75008 Paris (France), registered in the Paris Trade and Companies Register under number 999 649 635.
For any questions regarding this Policy or the processing of your personal data, you can contact Studio Flora at the address contact@innoralab.ai.
2. International Scope
This Policy applies to all users of the Service, regardless of their country of residence. Studio Flora uniformly applies the highest protection standards, in particular those of the European GDPR, to all of its users.
Users residing outside France and the European Union also retain the benefit of more protective mandatory provisions recognised by their local law. In particular, they may exercise additional rights granted by their national legislation against Studio Flora, upon simple request to the address contact@innoralab.ai.
3. Data We Collect
We only collect data strictly necessary for the operation, securing and improvement of the Service. These data are distributed as follows.
3.1. Data collected via the marketing site
When you interact with the innoralab.ai site outside of creating an application account, we may collect the following data via our service provider Brevo.
Newsletter subscription: your email address, collected based on your explicit consent.
Contact form: your name, your email address and the content of your message, when you contact us via the form made available on the Site.
Waiting list: your email address and, where applicable, your first name and declared area of interest, when you wish to be informed of the launch of the Service or upcoming features.
3.2. Registration and account data (upon opening of the Service)
When you create an account and subscribe to the Innora Lab Service, we collect the data necessary for your identification and the management of your subscription: last name, first name and email address. The management of your member account is provided by our service provider Thenty. Data relating to your method of payment (in particular credit card number) are collected and processed directly by our payment provider Stripe. Neither Studio Flora nor Thenty has access to your full bank details, which remain exclusively managed by Stripe.
3.3. Data on your use of the assistants
When you interact with Innora Lab's artificial intelligence assistants, you enter information relating to your activity (for example your offer, your market, your positioning or your strategy). This information, exchanged during your conversation with an assistant, is processed for the duration of the current conversation and stored as long as this conversation remains open, so that you can continue, consult and enrich it.
At the end of the conversation, the content of the exchanges is not stored on a persistent basis. Only documents generated at the end of the conversation, in PDF format, are saved and linked to your account, so that you can find, consult and download them at any time.
3.4. Technical and connection data
During your browsing and use of the Service, we may automatically collect certain technical data: IP address, browser type and version, operating system, pages consulted, dates and times of connection, as well as logging data (logs) relating to the use of the Service. These data are necessary for the proper functioning, security and improvement of the Service.
3.5. Communication data
When you contact us outside the contact form (for example directly by email), we collect the data you communicate on this occasion (name, email address, content of your message) in order to process your request and ensure its follow-up.
4. Purposes and Legal Bases of Processing
In accordance with the GDPR, each processing of your data is based on a specific legal basis. The information below presents, for each purpose, the data concerned and the applicable legal basis.
Management of the waiting list and information on the launch of the Service
Data concerned: email address, first name, declared area of interest.
Legal basis: consent.
Sending newsletters and marketing communications
Data concerned: email address and preferences.
Legal basis: consent.
Response to your contact requests
Data concerned: name, email address, message content.
Legal basis: legitimate interest.
Creation and management of your account and your subscription
Data concerned: registration and account data.
Legal basis: performance of a contract.
Provision of the Service and generation of the requested results
Data concerned: data on the use of assistant services.
Legal basis: performance of a contract.
Payment processing and billing
Data concerned: registration data, payment data (via Stripe).
Legal basis: performance of a contract and legal obligation (accounting and tax).
Security, fraud prevention and proper functioning of the Service
Data concerned: technical and connection data.
Legal basis: legitimate interest.
Improvement of the Service and audience measurement
Data concerned: technical and connection data.
Legal basis: legitimate interest or consent (depending on the case).
Compliance with our legal and regulatory obligations
Data concerned: account and billing data.
Legal basis: legal obligation.
5. Use of Artificial Intelligence and your Data
5.1. Nature of the Service
In accordance with the transparency requirements set out in the European Artificial Intelligence Act (Regulation (EU) 2024/1689, known as the "AI Act"), we expressly inform you that the Innora Lab Service relies on generative artificial intelligence systems. When you use Innora Lab's assistants, you are interacting with an artificial intelligence system, not a human being.
5.2. Underlying Technology
Innora Lab's assistants rely on artificial intelligence technology provided by Google, via the Gemini API programming interface. The information you enter during your conversations is transmitted to this provider solely to enable the generation of the requested response. Studio Flora uses Google's paid professional offerings whose terms contractually exclude the use of transmitted data for training their models.
5.3. Non-use of your data for model training
Studio Flora undertakes not to use your data to train artificial intelligence models. We do not train any models, whether our own or third-party models, from your conversations or content. Your strategic and professional information remains exclusively used for the provision of the Service to your benefit, and does not contribute to any training datasets.
5.4. No automated decisions within the meaning of Article 22 of the GDPR
The Service does not implement any decision producing legal effects concerning you or significantly affecting you based on automated processing, within the meaning of Article 22 of the GDPR. The results generated by the assistants are an aid to your own decision-making and do not carry any automatic legal consequences in themselves. You retain full and complete control over the decisions you make on the basis of the results provided at all times.
5.5. Limits of Artificial Intelligence
The results generated by the assistants are based on probabilistic models: they predict the most likely elements of response with respect to your request. As such, they may contain inaccuracies, approximations, outdated information or errors, and cannot be considered exhaustive, verified or definitive. The results provided by the Service constitute an aid to decision-making and strategic structuring. They do not substitute your own professional judgment. You remain solely responsible for the decisions you make on the basis of these results.
6. Recipients and Subprocessors
Your personal data is never sold, rented or assigned to third parties for commercial purposes. They are only accessible to authorised people within Studio Flora, as well as to our subprocessors, who only intervene on our instructions and in the strict performance of the Service. Our main current and future subprocessors are as follows.
Brevo (Brevo SAS, a French company whose registered office is at 7 rue de Madrid, 75008 Paris) — collection and management of newsletter registrations, the contact form and the waiting list, as well as sending associated emails. The data is hosted and processed within the European Union.
Framer B.V. (Rozengracht 207B, 1016 LZ Amsterdam, Netherlands) — hosting of the innoralab.ai website.
Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for the European Economic Area; Google LLC, Mountain View, United States) — audience measurement via Google Analytics, and provision of artificial intelligence technology via Gemini API upon opening of the Service.
Thenty (edited by Insert Frame, contact: support@thenty.io) — member account management, authentication and sending of transactional emails associated with the Service, from its opening onwards.
Stripe (Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland) — processing of credit card payments, from the opening of the Service.
Studio Flora ensures that each of its subprocessors provides sufficient guarantees in terms of data protection, in accordance with Article 28 of the GDPR, and enters into appropriate contractual agreements with them. We may also be required to disclose your data to administrative or judicial authorities when required by law, or to assert, exercise or defend our rights.
7. Data Transfers Outside the European Union
Some of our subprocessors, and in particular our artificial intelligence provider Google, are likely to process your data outside the European Union, in particular in the United States. In general, we may transfer your data outside the European Union for the purposes of providing the Service.
In all of these cases, Studio Flora ensures that these transfers are governed by appropriate safeguards in accordance with Articles 44 et seq. of the GDPR, which may include: (i) an adequacy decision by the European Commission, where the destination country offers a level of protection deemed adequate; (ii) standard contractual clauses adopted by the European Commission; or (iii) the subprocessor's adherence to a framework of protection recognised as adequate, such as the EU-US Data Privacy Framework.
Data collected via our service provider Brevo (newsletter, contact form, waiting list) is hosted and processed exclusively within the European Union. You can obtain a copy of the safeguards in place by sending us a request to the address contact@innoralab.ai.
8. Deleting Your Account and Data
You can request the deletion of your account and associated data at any time by sending a request by email to contact@innoralab.ai. We will process your request within thirty (30) days of receipt.
Following your request, we will permanently delete your user profile (last name, first name, email address, identifiers), generated documents attached to your account, and all data associated with the operation of the Service concerning you.
However, some data is kept beyond the deletion of the account, to the extent strictly necessary to comply with our legal obligations, in particular billing data kept for ten (10) years from the closing of the financial year, in accordance with applicable accounting and tax obligations, as well as any data necessary for the defence of a right in court. This retained data is archived and used exclusively for the legal purposes for which it must be maintained.
9. Retention Periods
We store your data for the period strictly necessary for the purposes for which they are processed, in compliance with the maximum periods set by the applicable regulations. The main retention periods are as follows.
Account and subscription data: retained for the entire duration of your contractual relationship with Studio Flora, then deleted within thirty (30) days after your account is closed, subject to legal retention periods.
Conversation content: retained as long as the conversation remains open, then deleted at its end. No persistent retention beyond the conversation session.
Generated documents (PDF): retained on your account as long as it is active. You can delete them at any time from your account.
Billing data: retained for ten (10) years from the closing of the financial year, in accordance with French accounting and tax obligations.
Technical and connection data: retained for a period not exceeding that necessary for the security and improvement purposes of the service, within the limit of twelve (12) months.
Data related to marketing communications and waiting list: retained until your consent is withdrawn, and for a maximum of three (3) years from your last active contact with Studio Flora.
10. Your Rights
In accordance with the applicable regulations, you have the following rights regarding your personal data:
Right of access: obtain confirmation as to whether or not your data is being processed, and receive a copy thereof.
Right to rectification: request rectification of inaccurate data or complete incomplete data.
Right to erasure ("right to be forgotten"): obtain the erasure of your data in the cases provided for by the regulations.
Right to restriction: request the limitation of the processing of your data in certain cases.
Right to object: object at any time to the processing of your data based on legitimate interest or for commercial prospecting purposes.
Right to portability: receive your data in a structured, commonly used format, and transmit it to another data controller.
Right to withdraw consent: when the treatment is based on your consent, you can withdraw it at any time.
Right not to be subject to an automated decision: in accordance with Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you.
Right relating to the fate of data after your death: you can define general or specific guidelines relating to the retention, erasure and communication of your personal data after your death.
You can exercise these rights by sending a request to the address contact@innoralab.ai. We may ask you for proof of identity in case of reasonable doubt about your identity. We undertake to respond to your request within one (1) month from its receipt, a period that may be extended by two (2) additional months in the event of complex or many requests.
11. Competent Supervisory Authorities
If you feel, after contacting us, that your rights are not being respected, you have the right to lodge a complaint with the competent supervisory authority in your place of residence. The main competent authorities for users of our Service are:
France: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, www.ico.org.uk.
Other Member States of the European Economic Area: the supervisory authority of your country of residence. The full list is available on the European Data Protection Board (EDPB) website at edpb.europa.eu.
For users residing outside these areas, you retain the right to contact the competent supervisory authority under your local law.
12. Cookies and Trackers
12.1. What is a cookie?
A cookie is a small text file deposited on your terminal (computer, tablet, smartphone) when you visit the Site. It enables, in particular, the proper functioning of the Site, the the storage of your preferences, or the measurement of its traffic.
12.2. Cookies used on the Site
The Site uses two categories of cookies.
Strictly necessary cookies: these cookies are essential for the proper functioning of the Site (session management, security, storage of consent preferences). They do not require your consent, in accordance with Article 82 of the French Data Protection Act (Loi Informatique et Libertés).
Audience measurement cookies: these cookies, placed by Google Analytics (Google Ireland Limited), allow us to measure the traffic on the Site, analyse user navigation paths and improve the user experience. These cookies are only placed after obtaining your explicit consent. The data collected are used for internal statistical purposes and are not transmitted for advertising purposes. The retention period for these cookies is a maximum of thirteen (13) months.
12.3. Collection and withdrawal of consent
During your first visit to the Site, an information banner allows you to accept, refuse or customise the placement of cookies that are not strictly necessary. Refusing cookies is as simple as accepting them, and does not have any consequences on accessing the Site.
Your choice is stored for a maximum period of six (6) months, after which your consent will be requested again.
You can change your preferences at any time by clicking on the "Manage my cookies" link in the footer of the Site.
12.4. Browser configuration
You can also configure your browser to refuse all or some cookies. Setting methods are specific to each browser (Chrome, Firefox, Safari, Edge, etc.) and accessible via their respective help menus. Refusing certain cookies, however, may affect the proper functioning of the Site.
12.5. Exercising your rights
For any questions regarding cookies or to exercise your rights, you can contact Studio Flora at the address contact@innoralab.ai.
13. Protection of Minors
The Service is exclusively intended for adults, aged at least eighteen (18) years old, acting in a personal or professional capacity within the framework of an entrepreneurial activity or in preparation for such an activity. Studio Flora does not knowingly collect personal data from minors. If we learn that a minor has sent us personal data, we will delete it as soon as possible.
14. Security and Incident Notification
Studio Flora implements appropriate technical and organisational measures to protect your data against loss, alteration, disclosure or unauthorised access. These measures notably include encrypting communications, limiting access to authorised individuals, and strict contractual commitments with our subprocessors. However, no data transmission over the internet can be guaranteed as fully secure. We therefore invite you to be cautious in the nature of information you communicate during your exchanges with the Service.
In accordance with Articles 33 and 34 of the GDPR, in the event of a personal data breach presenting a risk to your rights and freedoms, Studio Flora undertakes to notify the competent supervisory authority within the required timeframes, and to inform you as soon as possible when this breach is likely to lead to a high risk for your rights and freedoms.
15. Changes to this Policy
This Privacy Policy may be modified at any time to reflect legal, regulatory or technical developments, or changes to the Service. The applicable version is the one in force and accessible on the Site at the time of your visit. In the event of a material change, we will endeavour to inform you by an appropriate means, for example by sending a notification to the email address associated with your account.
16. Contact Details
For any questions regarding this Privacy Policy, the processing of your personal data, or to exercise your rights, you can contact Studio Flora electronically at the address contact@innoralab.ai or by post at the following address: Studio Flora, 60 rue François 1er, 75008 Paris (France).
The company Studio Flora, publisher of the Innora Lab service, attaches fundamental importance to the protection of privacy and personal data of its users. This Privacy Policy is intended to inform you, in a clear, transparent and accessible manner, about the nature of the data we collect, the purposes for which we process them, their retention period, the recipients of this data and your rights.
Studio Flora is a French company that offers its service to users residing in France, the European Economic Area, the United Kingdom and the rest of the world. This Policy is intended to apply to all of these users, in compliance with the rights recognised by their local legislation.
This Policy applies to all processing carried out as part of the use of the innoralab.ai website and the Innora Lab application (hereinafter, together, the "Service"). It complies with Regulation (EU) 2016/679 of 27 April 2016 on data protection (hereinafter the "GDPR"), French Law No. 78-17 of 6 January 1978 as amended, known as "Informatique et Libertés", as well as equivalent regulations applicable in other jurisdictions concerned, in particular the UK GDPR for users residing in the United Kingdom.
At the date of publication of this Policy, the Innora Lab application is being finalised. Certain treatments described below (in particular those related to subscribing to a subscription, creating an account and using artificial intelligence assistants) will only be effectively implemented from the opening of the Service to the public. Currently active processing mainly concerns the innoralab.ai marketing site, newsletter registration, the contact form and the waiting list.
1. Data Controller
The data controller for personal data is the company Studio Flora, a single-member simplified joint-stock company with a capital of 100 euros, whose registered office is located at 60 rue François 1er, 75008 Paris (France), registered in the Paris Trade and Companies Register under number 999 649 635.
For any questions regarding this Policy or the processing of your personal data, you can contact Studio Flora at the address contact@innoralab.ai.
2. International Scope
This Policy applies to all users of the Service, regardless of their country of residence. Studio Flora uniformly applies the highest protection standards, in particular those of the European GDPR, to all of its users.
Users residing outside France and the European Union also retain the benefit of more protective mandatory provisions recognised by their local law. In particular, they may exercise additional rights granted by their national legislation against Studio Flora, upon simple request to the address contact@innoralab.ai.
3. Data We Collect
We only collect data strictly necessary for the operation, securing and improvement of the Service. These data are distributed as follows.
3.1. Data collected via the marketing site
When you interact with the innoralab.ai site outside of creating an application account, we may collect the following data via our service provider Brevo.
Newsletter subscription: your email address, collected based on your explicit consent.
Contact form: your name, your email address and the content of your message, when you contact us via the form made available on the Site.
Waiting list: your email address and, where applicable, your first name and declared area of interest, when you wish to be informed of the launch of the Service or upcoming features.
3.2. Registration and account data (upon opening of the Service)
When you create an account and subscribe to the Innora Lab Service, we collect the data necessary for your identification and the management of your subscription: last name, first name and email address. The management of your member account is provided by our service provider Thenty. Data relating to your method of payment (in particular credit card number) are collected and processed directly by our payment provider Stripe. Neither Studio Flora nor Thenty has access to your full bank details, which remain exclusively managed by Stripe.
3.3. Data on your use of the assistants
When you interact with Innora Lab's artificial intelligence assistants, you enter information relating to your activity (for example your offer, your market, your positioning or your strategy). This information, exchanged during your conversation with an assistant, is processed for the duration of the current conversation and stored as long as this conversation remains open, so that you can continue, consult and enrich it.
At the end of the conversation, the content of the exchanges is not stored on a persistent basis. Only documents generated at the end of the conversation, in PDF format, are saved and linked to your account, so that you can find, consult and download them at any time.
3.4. Technical and connection data
During your browsing and use of the Service, we may automatically collect certain technical data: IP address, browser type and version, operating system, pages consulted, dates and times of connection, as well as logging data (logs) relating to the use of the Service. These data are necessary for the proper functioning, security and improvement of the Service.
3.5. Communication data
When you contact us outside the contact form (for example directly by email), we collect the data you communicate on this occasion (name, email address, content of your message) in order to process your request and ensure its follow-up.
4. Purposes and Legal Bases of Processing
In accordance with the GDPR, each processing of your data is based on a specific legal basis. The information below presents, for each purpose, the data concerned and the applicable legal basis.
Management of the waiting list and information on the launch of the Service
Data concerned: email address, first name, declared area of interest.
Legal basis: consent.
Sending newsletters and marketing communications
Data concerned: email address and preferences.
Legal basis: consent.
Response to your contact requests
Data concerned: name, email address, message content.
Legal basis: legitimate interest.
Creation and management of your account and your subscription
Data concerned: registration and account data.
Legal basis: performance of a contract.
Provision of the Service and generation of the requested results
Data concerned: data on the use of assistant services.
Legal basis: performance of a contract.
Payment processing and billing
Data concerned: registration data, payment data (via Stripe).
Legal basis: performance of a contract and legal obligation (accounting and tax).
Security, fraud prevention and proper functioning of the Service
Data concerned: technical and connection data.
Legal basis: legitimate interest.
Improvement of the Service and audience measurement
Data concerned: technical and connection data.
Legal basis: legitimate interest or consent (depending on the case).
Compliance with our legal and regulatory obligations
Data concerned: account and billing data.
Legal basis: legal obligation.
5. Use of Artificial Intelligence and your Data
5.1. Nature of the Service
In accordance with the transparency requirements set out in the European Artificial Intelligence Act (Regulation (EU) 2024/1689, known as the "AI Act"), we expressly inform you that the Innora Lab Service relies on generative artificial intelligence systems. When you use Innora Lab's assistants, you are interacting with an artificial intelligence system, not a human being.
5.2. Underlying Technology
Innora Lab's assistants rely on artificial intelligence technology provided by Google, via the Gemini API programming interface. The information you enter during your conversations is transmitted to this provider solely to enable the generation of the requested response. Studio Flora uses Google's paid professional offerings whose terms contractually exclude the use of transmitted data for training their models.
5.3. Non-use of your data for model training
Studio Flora undertakes not to use your data to train artificial intelligence models. We do not train any models, whether our own or third-party models, from your conversations or content. Your strategic and professional information remains exclusively used for the provision of the Service to your benefit, and does not contribute to any training datasets.
5.4. No automated decisions within the meaning of Article 22 of the GDPR
The Service does not implement any decision producing legal effects concerning you or significantly affecting you based on automated processing, within the meaning of Article 22 of the GDPR. The results generated by the assistants are an aid to your own decision-making and do not carry any automatic legal consequences in themselves. You retain full and complete control over the decisions you make on the basis of the results provided at all times.
5.5. Limits of Artificial Intelligence
The results generated by the assistants are based on probabilistic models: they predict the most likely elements of response with respect to your request. As such, they may contain inaccuracies, approximations, outdated information or errors, and cannot be considered exhaustive, verified or definitive. The results provided by the Service constitute an aid to decision-making and strategic structuring. They do not substitute your own professional judgment. You remain solely responsible for the decisions you make on the basis of these results.
6. Recipients and Subprocessors
Your personal data is never sold, rented or assigned to third parties for commercial purposes. They are only accessible to authorised people within Studio Flora, as well as to our subprocessors, who only intervene on our instructions and in the strict performance of the Service. Our main current and future subprocessors are as follows.
Brevo (Brevo SAS, a French company whose registered office is at 7 rue de Madrid, 75008 Paris) — collection and management of newsletter registrations, the contact form and the waiting list, as well as sending associated emails. The data is hosted and processed within the European Union.
Framer B.V. (Rozengracht 207B, 1016 LZ Amsterdam, Netherlands) — hosting of the innoralab.ai website.
Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for the European Economic Area; Google LLC, Mountain View, United States) — audience measurement via Google Analytics, and provision of artificial intelligence technology via Gemini API upon opening of the Service.
Thenty (edited by Insert Frame, contact: support@thenty.io) — member account management, authentication and sending of transactional emails associated with the Service, from its opening onwards.
Stripe (Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland) — processing of credit card payments, from the opening of the Service.
Studio Flora ensures that each of its subprocessors provides sufficient guarantees in terms of data protection, in accordance with Article 28 of the GDPR, and enters into appropriate contractual agreements with them. We may also be required to disclose your data to administrative or judicial authorities when required by law, or to assert, exercise or defend our rights.
7. Data Transfers Outside the European Union
Some of our subprocessors, and in particular our artificial intelligence provider Google, are likely to process your data outside the European Union, in particular in the United States. In general, we may transfer your data outside the European Union for the purposes of providing the Service.
In all of these cases, Studio Flora ensures that these transfers are governed by appropriate safeguards in accordance with Articles 44 et seq. of the GDPR, which may include: (i) an adequacy decision by the European Commission, where the destination country offers a level of protection deemed adequate; (ii) standard contractual clauses adopted by the European Commission; or (iii) the subprocessor's adherence to a framework of protection recognised as adequate, such as the EU-US Data Privacy Framework.
Data collected via our service provider Brevo (newsletter, contact form, waiting list) is hosted and processed exclusively within the European Union. You can obtain a copy of the safeguards in place by sending us a request to the address contact@innoralab.ai.
8. Deleting Your Account and Data
You can request the deletion of your account and associated data at any time by sending a request by email to contact@innoralab.ai. We will process your request within thirty (30) days of receipt.
Following your request, we will permanently delete your user profile (last name, first name, email address, identifiers), generated documents attached to your account, and all data associated with the operation of the Service concerning you.
However, some data is kept beyond the deletion of the account, to the extent strictly necessary to comply with our legal obligations, in particular billing data kept for ten (10) years from the closing of the financial year, in accordance with applicable accounting and tax obligations, as well as any data necessary for the defence of a right in court. This retained data is archived and used exclusively for the legal purposes for which it must be maintained.
9. Retention Periods
We store your data for the period strictly necessary for the purposes for which they are processed, in compliance with the maximum periods set by the applicable regulations. The main retention periods are as follows.
Account and subscription data: retained for the entire duration of your contractual relationship with Studio Flora, then deleted within thirty (30) days after your account is closed, subject to legal retention periods.
Conversation content: retained as long as the conversation remains open, then deleted at its end. No persistent retention beyond the conversation session.
Generated documents (PDF): retained on your account as long as it is active. You can delete them at any time from your account.
Billing data: retained for ten (10) years from the closing of the financial year, in accordance with French accounting and tax obligations.
Technical and connection data: retained for a period not exceeding that necessary for the security and improvement purposes of the service, within the limit of twelve (12) months.
Data related to marketing communications and waiting list: retained until your consent is withdrawn, and for a maximum of three (3) years from your last active contact with Studio Flora.
10. Your Rights
In accordance with the applicable regulations, you have the following rights regarding your personal data:
Right of access: obtain confirmation as to whether or not your data is being processed, and receive a copy thereof.
Right to rectification: request rectification of inaccurate data or complete incomplete data.
Right to erasure ("right to be forgotten"): obtain the erasure of your data in the cases provided for by the regulations.
Right to restriction: request the limitation of the processing of your data in certain cases.
Right to object: object at any time to the processing of your data based on legitimate interest or for commercial prospecting purposes.
Right to portability: receive your data in a structured, commonly used format, and transmit it to another data controller.
Right to withdraw consent: when the treatment is based on your consent, you can withdraw it at any time.
Right not to be subject to an automated decision: in accordance with Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you.
Right relating to the fate of data after your death: you can define general or specific guidelines relating to the retention, erasure and communication of your personal data after your death.
You can exercise these rights by sending a request to the address contact@innoralab.ai. We may ask you for proof of identity in case of reasonable doubt about your identity. We undertake to respond to your request within one (1) month from its receipt, a period that may be extended by two (2) additional months in the event of complex or many requests.
11. Competent Supervisory Authorities
If you feel, after contacting us, that your rights are not being respected, you have the right to lodge a complaint with the competent supervisory authority in your place of residence. The main competent authorities for users of our Service are:
France: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, www.ico.org.uk.
Other Member States of the European Economic Area: the supervisory authority of your country of residence. The full list is available on the European Data Protection Board (EDPB) website at edpb.europa.eu.
For users residing outside these areas, you retain the right to contact the competent supervisory authority under your local law.
12. Cookies and Trackers
12.1. What is a cookie?
A cookie is a small text file deposited on your terminal (computer, tablet, smartphone) when you visit the Site. It enables, in particular, the proper functioning of the Site, the the storage of your preferences, or the measurement of its traffic.
12.2. Cookies used on the Site
The Site uses two categories of cookies.
Strictly necessary cookies: these cookies are essential for the proper functioning of the Site (session management, security, storage of consent preferences). They do not require your consent, in accordance with Article 82 of the French Data Protection Act (Loi Informatique et Libertés).
Audience measurement cookies: these cookies, placed by Google Analytics (Google Ireland Limited), allow us to measure the traffic on the Site, analyse user navigation paths and improve the user experience. These cookies are only placed after obtaining your explicit consent. The data collected are used for internal statistical purposes and are not transmitted for advertising purposes. The retention period for these cookies is a maximum of thirteen (13) months.
12.3. Collection and withdrawal of consent
During your first visit to the Site, an information banner allows you to accept, refuse or customise the placement of cookies that are not strictly necessary. Refusing cookies is as simple as accepting them, and does not have any consequences on accessing the Site.
Your choice is stored for a maximum period of six (6) months, after which your consent will be requested again.
You can change your preferences at any time by clicking on the "Manage my cookies" link in the footer of the Site.
12.4. Browser configuration
You can also configure your browser to refuse all or some cookies. Setting methods are specific to each browser (Chrome, Firefox, Safari, Edge, etc.) and accessible via their respective help menus. Refusing certain cookies, however, may affect the proper functioning of the Site.
12.5. Exercising your rights
For any questions regarding cookies or to exercise your rights, you can contact Studio Flora at the address contact@innoralab.ai.
13. Protection of Minors
The Service is exclusively intended for adults, aged at least eighteen (18) years old, acting in a personal or professional capacity within the framework of an entrepreneurial activity or in preparation for such an activity. Studio Flora does not knowingly collect personal data from minors. If we learn that a minor has sent us personal data, we will delete it as soon as possible.
14. Security and Incident Notification
Studio Flora implements appropriate technical and organisational measures to protect your data against loss, alteration, disclosure or unauthorised access. These measures notably include encrypting communications, limiting access to authorised individuals, and strict contractual commitments with our subprocessors. However, no data transmission over the internet can be guaranteed as fully secure. We therefore invite you to be cautious in the nature of information you communicate during your exchanges with the Service.
In accordance with Articles 33 and 34 of the GDPR, in the event of a personal data breach presenting a risk to your rights and freedoms, Studio Flora undertakes to notify the competent supervisory authority within the required timeframes, and to inform you as soon as possible when this breach is likely to lead to a high risk for your rights and freedoms.
15. Changes to this Policy
This Privacy Policy may be modified at any time to reflect legal, regulatory or technical developments, or changes to the Service. The applicable version is the one in force and accessible on the Site at the time of your visit. In the event of a material change, we will endeavour to inform you by an appropriate means, for example by sending a notification to the email address associated with your account.
16. Contact Details
For any questions regarding this Privacy Policy, the processing of your personal data, or to exercise your rights, you can contact Studio Flora electronically at the address contact@innoralab.ai or by post at the following address: Studio Flora, 60 rue François 1er, 75008 Paris (France).
The company Studio Flora, publisher of the Innora Lab service, attaches fundamental importance to the protection of privacy and personal data of its users. This Privacy Policy is intended to inform you, in a clear, transparent and accessible manner, about the nature of the data we collect, the purposes for which we process them, their retention period, the recipients of this data and your rights.
Studio Flora is a French company that offers its service to users residing in France, the European Economic Area, the United Kingdom and the rest of the world. This Policy is intended to apply to all of these users, in compliance with the rights recognised by their local legislation.
This Policy applies to all processing carried out as part of the use of the innoralab.ai website and the Innora Lab application (hereinafter, together, the "Service"). It complies with Regulation (EU) 2016/679 of 27 April 2016 on data protection (hereinafter the "GDPR"), French Law No. 78-17 of 6 January 1978 as amended, known as "Informatique et Libertés", as well as equivalent regulations applicable in other jurisdictions concerned, in particular the UK GDPR for users residing in the United Kingdom.
At the date of publication of this Policy, the Innora Lab application is being finalised. Certain treatments described below (in particular those related to subscribing to a subscription, creating an account and using artificial intelligence assistants) will only be effectively implemented from the opening of the Service to the public. Currently active processing mainly concerns the innoralab.ai marketing site, newsletter registration, the contact form and the waiting list.
1. Data Controller
The data controller for personal data is the company Studio Flora, a single-member simplified joint-stock company with a capital of 100 euros, whose registered office is located at 60 rue François 1er, 75008 Paris (France), registered in the Paris Trade and Companies Register under number 999 649 635.
For any questions regarding this Policy or the processing of your personal data, you can contact Studio Flora at the address contact@innoralab.ai.
2. International Scope
This Policy applies to all users of the Service, regardless of their country of residence. Studio Flora uniformly applies the highest protection standards, in particular those of the European GDPR, to all of its users.
Users residing outside France and the European Union also retain the benefit of more protective mandatory provisions recognised by their local law. In particular, they may exercise additional rights granted by their national legislation against Studio Flora, upon simple request to the address contact@innoralab.ai.
3. Data We Collect
We only collect data strictly necessary for the operation, securing and improvement of the Service. These data are distributed as follows.
3.1. Data collected via the marketing site
When you interact with the innoralab.ai site outside of creating an application account, we may collect the following data via our service provider Brevo.
Newsletter subscription: your email address, collected based on your explicit consent.
Contact form: your name, your email address and the content of your message, when you contact us via the form made available on the Site.
Waiting list: your email address and, where applicable, your first name and declared area of interest, when you wish to be informed of the launch of the Service or upcoming features.
3.2. Registration and account data (upon opening of the Service)
When you create an account and subscribe to the Innora Lab Service, we collect the data necessary for your identification and the management of your subscription: last name, first name and email address. The management of your member account is provided by our service provider Thenty. Data relating to your method of payment (in particular credit card number) are collected and processed directly by our payment provider Stripe. Neither Studio Flora nor Thenty has access to your full bank details, which remain exclusively managed by Stripe.
3.3. Data on your use of the assistants
When you interact with Innora Lab's artificial intelligence assistants, you enter information relating to your activity (for example your offer, your market, your positioning or your strategy). This information, exchanged during your conversation with an assistant, is processed for the duration of the current conversation and stored as long as this conversation remains open, so that you can continue, consult and enrich it.
At the end of the conversation, the content of the exchanges is not stored on a persistent basis. Only documents generated at the end of the conversation, in PDF format, are saved and linked to your account, so that you can find, consult and download them at any time.
3.4. Technical and connection data
During your browsing and use of the Service, we may automatically collect certain technical data: IP address, browser type and version, operating system, pages consulted, dates and times of connection, as well as logging data (logs) relating to the use of the Service. These data are necessary for the proper functioning, security and improvement of the Service.
3.5. Communication data
When you contact us outside the contact form (for example directly by email), we collect the data you communicate on this occasion (name, email address, content of your message) in order to process your request and ensure its follow-up.
4. Purposes and Legal Bases of Processing
In accordance with the GDPR, each processing of your data is based on a specific legal basis. The information below presents, for each purpose, the data concerned and the applicable legal basis.
Management of the waiting list and information on the launch of the Service
Data concerned: email address, first name, declared area of interest.
Legal basis: consent.
Sending newsletters and marketing communications
Data concerned: email address and preferences.
Legal basis: consent.
Response to your contact requests
Data concerned: name, email address, message content.
Legal basis: legitimate interest.
Creation and management of your account and your subscription
Data concerned: registration and account data.
Legal basis: performance of a contract.
Provision of the Service and generation of the requested results
Data concerned: data on the use of assistant services.
Legal basis: performance of a contract.
Payment processing and billing
Data concerned: registration data, payment data (via Stripe).
Legal basis: performance of a contract and legal obligation (accounting and tax).
Security, fraud prevention and proper functioning of the Service
Data concerned: technical and connection data.
Legal basis: legitimate interest.
Improvement of the Service and audience measurement
Data concerned: technical and connection data.
Legal basis: legitimate interest or consent (depending on the case).
Compliance with our legal and regulatory obligations
Data concerned: account and billing data.
Legal basis: legal obligation.
5. Use of Artificial Intelligence and your Data
5.1. Nature of the Service
In accordance with the transparency requirements set out in the European Artificial Intelligence Act (Regulation (EU) 2024/1689, known as the "AI Act"), we expressly inform you that the Innora Lab Service relies on generative artificial intelligence systems. When you use Innora Lab's assistants, you are interacting with an artificial intelligence system, not a human being.
5.2. Underlying Technology
Innora Lab's assistants rely on artificial intelligence technology provided by Google, via the Gemini API programming interface. The information you enter during your conversations is transmitted to this provider solely to enable the generation of the requested response. Studio Flora uses Google's paid professional offerings whose terms contractually exclude the use of transmitted data for training their models.
5.3. Non-use of your data for model training
Studio Flora undertakes not to use your data to train artificial intelligence models. We do not train any models, whether our own or third-party models, from your conversations or content. Your strategic and professional information remains exclusively used for the provision of the Service to your benefit, and does not contribute to any training datasets.
5.4. No automated decisions within the meaning of Article 22 of the GDPR
The Service does not implement any decision producing legal effects concerning you or significantly affecting you based on automated processing, within the meaning of Article 22 of the GDPR. The results generated by the assistants are an aid to your own decision-making and do not carry any automatic legal consequences in themselves. You retain full and complete control over the decisions you make on the basis of the results provided at all times.
5.5. Limits of Artificial Intelligence
The results generated by the assistants are based on probabilistic models: they predict the most likely elements of response with respect to your request. As such, they may contain inaccuracies, approximations, outdated information or errors, and cannot be considered exhaustive, verified or definitive. The results provided by the Service constitute an aid to decision-making and strategic structuring. They do not substitute your own professional judgment. You remain solely responsible for the decisions you make on the basis of these results.
6. Recipients and Subprocessors
Your personal data is never sold, rented or assigned to third parties for commercial purposes. They are only accessible to authorised people within Studio Flora, as well as to our subprocessors, who only intervene on our instructions and in the strict performance of the Service. Our main current and future subprocessors are as follows.
Brevo (Brevo SAS, a French company whose registered office is at 7 rue de Madrid, 75008 Paris) — collection and management of newsletter registrations, the contact form and the waiting list, as well as sending associated emails. The data is hosted and processed within the European Union.
Framer B.V. (Rozengracht 207B, 1016 LZ Amsterdam, Netherlands) — hosting of the innoralab.ai website.
Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for the European Economic Area; Google LLC, Mountain View, United States) — audience measurement via Google Analytics, and provision of artificial intelligence technology via Gemini API upon opening of the Service.
Thenty (edited by Insert Frame, contact: support@thenty.io) — member account management, authentication and sending of transactional emails associated with the Service, from its opening onwards.
Stripe (Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland) — processing of credit card payments, from the opening of the Service.
Studio Flora ensures that each of its subprocessors provides sufficient guarantees in terms of data protection, in accordance with Article 28 of the GDPR, and enters into appropriate contractual agreements with them. We may also be required to disclose your data to administrative or judicial authorities when required by law, or to assert, exercise or defend our rights.
7. Data Transfers Outside the European Union
Some of our subprocessors, and in particular our artificial intelligence provider Google, are likely to process your data outside the European Union, in particular in the United States. In general, we may transfer your data outside the European Union for the purposes of providing the Service.
In all of these cases, Studio Flora ensures that these transfers are governed by appropriate safeguards in accordance with Articles 44 et seq. of the GDPR, which may include: (i) an adequacy decision by the European Commission, where the destination country offers a level of protection deemed adequate; (ii) standard contractual clauses adopted by the European Commission; or (iii) the subprocessor's adherence to a framework of protection recognised as adequate, such as the EU-US Data Privacy Framework.
Data collected via our service provider Brevo (newsletter, contact form, waiting list) is hosted and processed exclusively within the European Union. You can obtain a copy of the safeguards in place by sending us a request to the address contact@innoralab.ai.
8. Deleting Your Account and Data
You can request the deletion of your account and associated data at any time by sending a request by email to contact@innoralab.ai. We will process your request within thirty (30) days of receipt.
Following your request, we will permanently delete your user profile (last name, first name, email address, identifiers), generated documents attached to your account, and all data associated with the operation of the Service concerning you.
However, some data is kept beyond the deletion of the account, to the extent strictly necessary to comply with our legal obligations, in particular billing data kept for ten (10) years from the closing of the financial year, in accordance with applicable accounting and tax obligations, as well as any data necessary for the defence of a right in court. This retained data is archived and used exclusively for the legal purposes for which it must be maintained.
9. Retention Periods
We store your data for the period strictly necessary for the purposes for which they are processed, in compliance with the maximum periods set by the applicable regulations. The main retention periods are as follows.
Account and subscription data: retained for the entire duration of your contractual relationship with Studio Flora, then deleted within thirty (30) days after your account is closed, subject to legal retention periods.
Conversation content: retained as long as the conversation remains open, then deleted at its end. No persistent retention beyond the conversation session.
Generated documents (PDF): retained on your account as long as it is active. You can delete them at any time from your account.
Billing data: retained for ten (10) years from the closing of the financial year, in accordance with French accounting and tax obligations.
Technical and connection data: retained for a period not exceeding that necessary for the security and improvement purposes of the service, within the limit of twelve (12) months.
Data related to marketing communications and waiting list: retained until your consent is withdrawn, and for a maximum of three (3) years from your last active contact with Studio Flora.
10. Your Rights
In accordance with the applicable regulations, you have the following rights regarding your personal data:
Right of access: obtain confirmation as to whether or not your data is being processed, and receive a copy thereof.
Right to rectification: request rectification of inaccurate data or complete incomplete data.
Right to erasure ("right to be forgotten"): obtain the erasure of your data in the cases provided for by the regulations.
Right to restriction: request the limitation of the processing of your data in certain cases.
Right to object: object at any time to the processing of your data based on legitimate interest or for commercial prospecting purposes.
Right to portability: receive your data in a structured, commonly used format, and transmit it to another data controller.
Right to withdraw consent: when the treatment is based on your consent, you can withdraw it at any time.
Right not to be subject to an automated decision: in accordance with Article 22 of the GDPR, you have the right not to be subject to a decision based solely on automated processing that produces legal effects concerning you.
Right relating to the fate of data after your death: you can define general or specific guidelines relating to the retention, erasure and communication of your personal data after your death.
You can exercise these rights by sending a request to the address contact@innoralab.ai. We may ask you for proof of identity in case of reasonable doubt about your identity. We undertake to respond to your request within one (1) month from its receipt, a period that may be extended by two (2) additional months in the event of complex or many requests.
11. Competent Supervisory Authorities
If you feel, after contacting us, that your rights are not being respected, you have the right to lodge a complaint with the competent supervisory authority in your place of residence. The main competent authorities for users of our Service are:
France: Commission Nationale de l'Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
United Kingdom: Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, www.ico.org.uk.
Other Member States of the European Economic Area: the supervisory authority of your country of residence. The full list is available on the European Data Protection Board (EDPB) website at edpb.europa.eu.
For users residing outside these areas, you retain the right to contact the competent supervisory authority under your local law.
12. Cookies and Trackers
12.1. What is a cookie?
A cookie is a small text file deposited on your terminal (computer, tablet, smartphone) when you visit the Site. It enables, in particular, the proper functioning of the Site, the the storage of your preferences, or the measurement of its traffic.
12.2. Cookies used on the Site
The Site uses two categories of cookies.
Strictly necessary cookies: these cookies are essential for the proper functioning of the Site (session management, security, storage of consent preferences). They do not require your consent, in accordance with Article 82 of the French Data Protection Act (Loi Informatique et Libertés).
Audience measurement cookies: these cookies, placed by Google Analytics (Google Ireland Limited), allow us to measure the traffic on the Site, analyse user navigation paths and improve the user experience. These cookies are only placed after obtaining your explicit consent. The data collected are used for internal statistical purposes and are not transmitted for advertising purposes. The retention period for these cookies is a maximum of thirteen (13) months.
12.3. Collection and withdrawal of consent
During your first visit to the Site, an information banner allows you to accept, refuse or customise the placement of cookies that are not strictly necessary. Refusing cookies is as simple as accepting them, and does not have any consequences on accessing the Site.
Your choice is stored for a maximum period of six (6) months, after which your consent will be requested again.
You can change your preferences at any time by clicking on the "Manage my cookies" link in the footer of the Site.
12.4. Browser configuration
You can also configure your browser to refuse all or some cookies. Setting methods are specific to each browser (Chrome, Firefox, Safari, Edge, etc.) and accessible via their respective help menus. Refusing certain cookies, however, may affect the proper functioning of the Site.
12.5. Exercising your rights
For any questions regarding cookies or to exercise your rights, you can contact Studio Flora at the address contact@innoralab.ai.
13. Protection of Minors
The Service is exclusively intended for adults, aged at least eighteen (18) years old, acting in a personal or professional capacity within the framework of an entrepreneurial activity or in preparation for such an activity. Studio Flora does not knowingly collect personal data from minors. If we learn that a minor has sent us personal data, we will delete it as soon as possible.
14. Security and Incident Notification
Studio Flora implements appropriate technical and organisational measures to protect your data against loss, alteration, disclosure or unauthorised access. These measures notably include encrypting communications, limiting access to authorised individuals, and strict contractual commitments with our subprocessors. However, no data transmission over the internet can be guaranteed as fully secure. We therefore invite you to be cautious in the nature of information you communicate during your exchanges with the Service.
In accordance with Articles 33 and 34 of the GDPR, in the event of a personal data breach presenting a risk to your rights and freedoms, Studio Flora undertakes to notify the competent supervisory authority within the required timeframes, and to inform you as soon as possible when this breach is likely to lead to a high risk for your rights and freedoms.
15. Changes to this Policy
This Privacy Policy may be modified at any time to reflect legal, regulatory or technical developments, or changes to the Service. The applicable version is the one in force and accessible on the Site at the time of your visit. In the event of a material change, we will endeavour to inform you by an appropriate means, for example by sending a notification to the email address associated with your account.
16. Contact Details
For any questions regarding this Privacy Policy, the processing of your personal data, or to exercise your rights, you can contact Studio Flora electronically at the address contact@innoralab.ai or by post at the following address: Studio Flora, 60 rue François 1er, 75008 Paris (France).
Last updated: 4 June 2026
Privacy Policy
Privacy
policy
© Innora Lab 2026