Studio Flora, the publisher of the Innora Lab service, considers the protection of the privacy and personal data of its users to be of fundamental importance. The purpose of this Privacy Policy is to inform you, in a clear, transparent and accessible manner, about the nature of the data we collect, the purposes for which we process it, its retention period, the recipients of this data and your rights.
This Policy applies to all processing carried out within the framework of using the innoralab.ai website and the Innora Lab application (hereinafter, together, the "Service"). It complies with Regulation (EU) 2016/679 of 27 April 2016 on data protection (hereinafter the "GDPR") and Act No. 78-17 of 6 January 1978 as amended, known as the "Data Protection Act".
As of the publication date of this Policy, the Innora Lab application is offered in a beta phase to a limited number of users who have an account. Processing relating to account creation, the use of assistants, the retention of exchanges and the generation of documents is carried out within this framework.
1. Data Controller
The controller for the processing of personal data is Studio Flora, a single-member simplified joint-stock company with a share capital of 100 euros, whose registered office is located at 60 rue François 1er, 75008 Paris (France), registered in the Paris Trade and Companies Register under number 999 649 635.
For any questions relating to this Policy or the processing of your personal data, you can contact Studio Flora at contact@innoralab.ai.
2. Scope
The Service is accessible to users located in France and internationally. The processing of personal data carried out by Studio Flora in the course of its business is mainly subject to the General Data Protection Regulation and the French Data Protection Act, as Studio Flora is established in the European Union.
Where mandatory local provisions are applicable to users located outside the European Union, they may supplement this framework. Any questions relating to the application of these provisions can be sent to contact@innoralab.ai.
3. Data We Collect
We only collect data necessary for the operation, security and delivery of the Service.
3.1. Data collected via the website
When you interact with the innoralab.ai website outside of creating an application account, we may collect the following data via our provider Brevo.
Newsletter subscription: your email address and first name, collected with your consent.
Contact form: your first or last name, your email address and the content of your message.
Waitlist: your email address and first name.
Data relating to electronic communications: information relating to the delivery of messages, their opening, clicks on links, unsubscribes and associated statistics.
3.2. Account and Subscription Data
When you create an account, we collect your first name or display name and your email address. Information relating to the products, subscriptions or access rights associated with your account may also be recorded, including the product concerned, its type, its status and the date of its last update.
The management of member accounts, authentication and access rights is provided by our partner Thenty.
Complete data relating to the payment method, including the full credit card number, is collected and processed directly by Stripe. Studio Flora and Thenty do not have access to the full card number.
Studio Flora may nevertheless receive information necessary for payment and subscription management, including the customer's email address, the amount and currency, the date and status of the payment or refund, the type and brand of payment method, as well as the last four digits of the card.
3.3. Data from your use of assistants
When you interact with Innora Lab's assistants, the content of your exchanges is recorded and linked to your account to allow you to view your history and find your previous work.
When a session is closed, its content remains viewable in read-only mode, but the conversation can no longer be continued. To continue using an assistant, you must open a new session.
The documents generated at the end of a session are also saved and linked to your account to allow you to view and download them.
You can delete conversations, history and available documents from your account area. When data is deleted from the interface, it is no longer accessible from your account. It is then deleted from the active systems as soon as possible, subject to legal retention obligations and its possible temporary persistence in technical backups.
3.4. INFORMATION RELATING TO THIRD PARTIES
When using the assistants, users are requested not to enter personal data that allows for the direct identification of a third party, except where strictly necessary and where they have a legal basis to do so.
Where the context allows, they should prefer anonymised or pseudonymised information, for example by replacing a person's name with a job title, a generic profile or a pseudonym.
In particular, users must not enter sensitive data relating to third parties, such as information concerning their health, origin, political opinions, religious beliefs, sex life or any offences or convictions.
3.5. Technical and Connection Data
Technical logs may be collected to ensure security, error diagnosis and the proper functioning of the Service. They may include technical identifiers, connection information, dates and times of use and information relating to errors encountered. Their exact content, location and retention period depend on the technical infrastructure used.
3.5. Communication Data
When you contact us outside of the contact form, for example directly by email, we collect the data you communicate to us on that occasion (name, email address, content of your message) in order to process your request and follow it up.
4. Purposes and Legal Bases of Processing
In accordance with the GDPR, each processing operation of your data is based on a specific legal basis. The information below presents, for each purpose, the data concerned and the applicable legal basis.
Waitlist management and information about the launch of the Service — email address and first name. Legal basis: consent.
Sending newsletters and commercial communications — email address, first name and communication preferences. Legal basis: consent.
Measuring the delivery and interaction with electronic communications — data relating to delivery, openings and clicks. Legal basis: consent.
Responding to contact requests — first or last name, email address and message content. Legal basis: legitimate interest of Studio Flora in responding to requests received.
Account creation and management and access rights — account data and associated products. Legal basis: performance of the contract or implementation of pre-contractual measures requested by the user.
Provision of assistants and generation of documents — prompts, responses, history and generated documents. Legal basis: performance of the contract.
Payment processing, subscription management and billing — account, transaction and billing data. Legal basis: performance of the contract and legal accounting and tax obligations.
Security, abuse prevention and error diagnosis — technical data, connection data and logs. Legal basis: legitimate interest of Studio Flora in securing and maintaining the Service.
Audience measurement and analysis of Site use via Google Analytics — navigation data and technical data. Legal basis: consent.
Compliance with legal obligations and defense of Studio Flora's rights — data necessary according to the situation. Legal basis: legal obligation or legitimate interest.
5. Use of Artificial Intelligence and Your Data
5.1. Nature of the Service
In accordance with the transparency requirements set out in the European Artificial Intelligence Act (Regulation (EU) 2024/1689, known as the "AI Act"), we expressly inform you that the Innora Lab Service is based on generative artificial intelligence systems. When you use Innora Lab's assistants, you are interacting with an artificial intelligence system, not a human being.
5.2. Underlying Technology
Innora Lab's assistants are based on artificial intelligence technology provided by Google using the Gemini API. The contents entered by the user and the generated responses are transmitted to Google to allow the assistants to function.
Studio Flora uses a paid offer of the Gemini API linked to a project for which billing is enabled. Under the contractual terms applicable to this offer, Google does not use prompts and responses to improve its products and processes them in accordance with its data processing agreement.
Google, however, retains prompts and responses for a limited period, solely for the purposes of detecting breaches of its use policy, ensuring the security of its services and satisfying its legal or regulatory obligations. This data may be stored or cached in any country where Google or its agents maintain facilities. Google also processes technical and usage information necessary for the operation, security and billing of its services.
5.3. Non-use of your data for model training
Studio Flora does not use user conversations or content to train its own artificial intelligence models. Under the terms applicable to the paid Gemini API offer used by Studio Flora, Google does not use prompts and responses to improve its products.
5.4. Absence of automated decision-making within the meaning of Article 22 of the GDPR
The Service does not implement decisions that produce legal effects concerning you or significantly affect you based on purely automated processing, within the meaning of Article 22 of the GDPR. The results generated by the assistants constitute an aid to your own decision-making and do not in themselves carry any automatic legal consequences.
5.5. Limits of Artificial Intelligence
Assistants generate responses in an automated manner and may produce inaccurate information. The terms of use of the Service specify the terms of use of the generated results.
6. Recipients and Processors
Your personal data is never sold, rented or transferred to third parties for commercial purposes. It may be accessible to authorised persons within Studio Flora as well as to the providers and recipients identified below, to the extent necessary for the purposes described in this Policy.
The main service providers likely to receive or process personal data within the framework of the Service are the following.
Brevo SAS — management of the newsletter, waitlist, contact forms, email send-outs and statistics relating to delivery, openings and clicks.
Framer B.V. — design, publication and hosting of the showcase site innoralab.ai, as well as processing of technical data necessary for its display, operation and security.
Thenty Pty Ltd (Australia) — management of member accounts, authentication, access rights, products associated with accounts and transactional emails. Legal contact: account@insertframe.io. Support: support@thenty.io.
Stripe Payments Europe, Ltd. — payment processing, transaction management, fraud prevention and processing of information necessary for billing.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — provision of the Google Analytics service, audience measurement, analysis of navigation and production of usage statistics, subject to user consent.
Google Cloud France SARL, 8 rue de Londres, 75009 Paris, France — provision of the Gemini API and processing of prompts, responses and technical data necessary for the operation of the assistants.
Zapier, Inc. (United States) — automation of data transmission entered in the Site's forms to Brevo.
Not all providers necessarily act in the same role for all processing operations. Some of them, including Stripe, may act as a processor for certain operations and as a separate data controller for others, particularly in respect of fraud prevention and their regulatory obligations.
Studio Flora selects service providers that offer appropriate guarantees regarding data protection and structures its relationships with them in accordance with applicable requirements. We may also be required to communicate your data to administrative or judicial authorities when required by law, or to assert, exercise or defend our rights.
7. TRANSFERS OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
Studio Flora prefers, where possible, service providers established or having infrastructure within the European Economic Area. However, some providers may process data from countries located outside the European Economic Area or use processors established in these countries.
The transfers likely to occur are as follows: account and authentication data processed by Thenty Pty Ltd, a company established in Australia — according to information published by the provider, European data is created in a European region and remains stored in Europe, although some access or processing may nevertheless be carried out from a country located outside the European Economic Area; data transmitted to Zapier, established in the United States; prompts and responses transmitted to Google under the Gemini API, which may be stored or cached in any country where Google has facilities. Framer and Stripe may also use processors established outside the European Economic Area.
Depending on the service provider and the transfer concerned, the applicable guarantees may notably rely on an adequacy decision, on the EU-US Data Privacy Framework or on standard contractual clauses adopted by the European Commission.
You can obtain additional information on transfers and applicable guarantees by writing to contact@innoralab.ai.
8. Deletion of Your Account and Your Data
You can request the deletion of your account and exercise your rights by writing to contact@innoralab.ai. Studio Flora responds to these requests within one month, unless an extension is authorised by regulations.
Where the right to erasure applies, the data concerned is deleted from active systems as soon as possible. Some information may, however, be retained where this retention is necessary for compliance with a legal obligation, for the establishment, exercise or defense of legal claims, or for the duration of the technical persistence of backups.
8.1. End of Subscription
After the end of the subscription, account data is kept for thirty (30) days to allow the user to recover their documents or reactivate their account. At the end of this period, data is deleted from active systems or archived where its retention remains legally necessary.
9. Retention Periods
We retain your data for the period strictly necessary for the purposes for which they are processed.
Account data: during the entire life of the account, then for thirty (30) days after its closure.
Conversations: as long as the account is active or until deleted by the user.
Generated documents (PDF): as long as the account is active or until deleted by the user.
Billing data: ten (10) years from the end of the relevant financial year, in accordance with French accounting and tax obligations.
Newsletter and waitlist: until consent is withdrawn and, in the absence of withdrawal, for a maximum period of three (3) years from the last active contact.
Contact requests, regardless of the channel used: deleted following the processing of the request, and at most three (3) years from the last contact.
Technical logs: for a period proportionate to security, error diagnosis and Service maintenance needs, determined according to the technical infrastructure used.
Backups: data deleted from active systems may persist temporarily in technical backups until overwritten as part of the usual backup rotation cycle.
Google Analytics: event and usage data is retained for the period configured in the Google Analytics property, determined according to audience measurement needs.
Opening and click data for electronic communications: for the duration necessary to analyze campaigns and at most for the duration of contact retention.
10. Your Rights
In accordance with applicable regulations, you have the following rights over your personal data:
Right of access: obtain confirmation of whether or not your data is being processed, and receive a copy of it.
Right to rectification: have inaccurate data corrected or incomplete data completed.
Right to erasure: obtain the erasure of your data in the cases provided for by the regulations.
Right to restriction: request the restriction of the processing of your data in certain cases.
Right to object: object at any time to the processing of your data based on legitimate interest or intended for commercial prospecting.
Right to portability: in the cases provided for by the GDPR, receive the data you have provided to Studio Flora in a structured, commonly used and machine-readable format, and request its transmission to another controller where technically possible.
Right to withdraw consent: where processing is based on your consent, you can withdraw it at any time.
Right not to be subject to an automated decision, in accordance with Article 22 of the GDPR.
Right relating to the outcome of data after your death: you can define general or specific directives regarding the storage, erasure and communication of your data after your death.
You can exercise these rights by sending a request to contact@innoralab.ai. We may ask you for proof of identity in case of reasonable doubt about your identity. We commit to responding to your request within one (1) month from its receipt, which may be extended by an additional two (2) months in case of complex or numerous requests.
11. Supervisory Authorities
If you feel, after contacting us, that your rights are not being respected, you have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
Where applicable, you can also contact the competent supervisory authority of your place of residence or work.
12. Cookies and Trackers
12.1. What is a cookie?
A cookie is a small text file placed on your terminal (computer, tablet, smartphone) when you visit the Site. In particular, it ensures the proper functioning of the Site, memorises your preferences, or measures its audience.
12.2. Cookies used on the Site
Strictly necessary cookies: essential for the functioning of the Site (session management, security, storage of consent preferences). They do not require your consent, in accordance with Article 82 of the Data Protection Act.
Audience measurement cookies: subject to your consent, we use Google Analytics to measure Site traffic, understand visitor navigation, identify visited pages and improve the functioning of the Site. Google Analytics can process, in particular, a navigation identifier, visited pages, triggered events, device and browser type, operating system and an approximate geographical location. Google Analytics notably uses the _ga cookie to distinguish users and their sessions when Analytics storage is authorised. Google Analytics uses cookies and identifiers subject to your consent. Their retention period depends on the configuration applied to the Site and is limited to what is necessary for audience measurement.
12.3. Gathering and Withdrawal of Consent
On your first visit to the Site, an information banner allows you to accept, refuse or customise the placement of non-strictly necessary cookies. Refusing cookies is as simple as accepting them, and has no impact on accessing the Site.
No non-strictly necessary cookie is placed before your consent has been gathered.
Your choice is kept for a maximum of six (6) months, after which your consent will be requested again. You can change your preferences at any time by clicking on the "Manage my cookies" link in the footer of the Site.
12.4. Browser Settings
You can also configure your browser to refuse all or part of the cookies. Configuration procedures are specific to each browser and accessible via their respective help menus. Refusing certain cookies may, however, affect the proper functioning of the Site.
13. Protection of Minors
The Service is exclusively intended for adults, aged at least eighteen (18) years, acting in a personal or professional capacity within the framework of an entrepreneurial activity or in preparation for such an activity. Studio Flora does not knowingly collect personal data relating to minors. If we learn that a minor has transmitted personal data to us, we will delete it as soon as possible.
14. Security and Incident Notification
Studio Flora implements technical and organisational measures adapted to risks in order to preserve the confidentiality, integrity and availability of personal data. These measures are adapted according to the nature of the data processed, the features of the Service and the technical infrastructure used.
However, no data transmission over the Internet can be guaranteed to be completely secure. We therefore invite you to be cautious in the nature of the information you communicate during your exchanges with the Service.
In accordance with Articles 33 and 34 of the GDPR, in the event of a personal data breach presenting a risk to your rights and freedoms, Studio Flora undertakes to notify the competent supervisory authority within the required timeframe, and to inform you as soon as possible when this breach is likely to result in a high risk to your rights and freedoms.
15. Amendments to this Policy
This Privacy Policy may be modified to take account of legal, regulatory or technical developments, or developments in the Service. The applicable version is the one in force and accessible on the Site at the time of your visit.
In the event of a substantial modification affecting the nature of the processing or the rights of users, Studio Flora informs the persons concerned by an appropriate method, where required by regulations.
16. Contact
For any questions relating to this Privacy Policy, the processing of your personal data, or to exercise your rights, you can contact Studio Flora electronically at contact@innoralab.ai or by post at the following address: Studio Flora, 60 rue François 1er, 75008 Paris (France).
Studio Flora, the publisher of the Innora Lab service, considers the protection of the privacy and personal data of its users to be of fundamental importance. The purpose of this Privacy Policy is to inform you, in a clear, transparent and accessible manner, about the nature of the data we collect, the purposes for which we process it, its retention period, the recipients of this data and your rights.
This Policy applies to all processing carried out within the framework of using the innoralab.ai website and the Innora Lab application (hereinafter, together, the "Service"). It complies with Regulation (EU) 2016/679 of 27 April 2016 on data protection (hereinafter the "GDPR") and Act No. 78-17 of 6 January 1978 as amended, known as the "Data Protection Act".
As of the publication date of this Policy, the Innora Lab application is offered in a beta phase to a limited number of users who have an account. Processing relating to account creation, the use of assistants, the retention of exchanges and the generation of documents is carried out within this framework.
1. Data Controller
The controller for the processing of personal data is Studio Flora, a single-member simplified joint-stock company with a share capital of 100 euros, whose registered office is located at 60 rue François 1er, 75008 Paris (France), registered in the Paris Trade and Companies Register under number 999 649 635.
For any questions relating to this Policy or the processing of your personal data, you can contact Studio Flora at contact@innoralab.ai.
2. Scope
The Service is accessible to users located in France and internationally. The processing of personal data carried out by Studio Flora in the course of its business is mainly subject to the General Data Protection Regulation and the French Data Protection Act, as Studio Flora is established in the European Union.
Where mandatory local provisions are applicable to users located outside the European Union, they may supplement this framework. Any questions relating to the application of these provisions can be sent to contact@innoralab.ai.
3. Data We Collect
We only collect data necessary for the operation, security and delivery of the Service.
3.1. Data collected via the website
When you interact with the innoralab.ai website outside of creating an application account, we may collect the following data via our provider Brevo.
Newsletter subscription: your email address and first name, collected with your consent.
Contact form: your first or last name, your email address and the content of your message.
Waitlist: your email address and first name.
Data relating to electronic communications: information relating to the delivery of messages, their opening, clicks on links, unsubscribes and associated statistics.
3.2. Account and Subscription Data
When you create an account, we collect your first name or display name and your email address. Information relating to the products, subscriptions or access rights associated with your account may also be recorded, including the product concerned, its type, its status and the date of its last update.
The management of member accounts, authentication and access rights is provided by our partner Thenty.
Complete data relating to the payment method, including the full credit card number, is collected and processed directly by Stripe. Studio Flora and Thenty do not have access to the full card number.
Studio Flora may nevertheless receive information necessary for payment and subscription management, including the customer's email address, the amount and currency, the date and status of the payment or refund, the type and brand of payment method, as well as the last four digits of the card.
3.3. Data from your use of assistants
When you interact with Innora Lab's assistants, the content of your exchanges is recorded and linked to your account to allow you to view your history and find your previous work.
When a session is closed, its content remains viewable in read-only mode, but the conversation can no longer be continued. To continue using an assistant, you must open a new session.
The documents generated at the end of a session are also saved and linked to your account to allow you to view and download them.
You can delete conversations, history and available documents from your account area. When data is deleted from the interface, it is no longer accessible from your account. It is then deleted from the active systems as soon as possible, subject to legal retention obligations and its possible temporary persistence in technical backups.
3.4. INFORMATION RELATING TO THIRD PARTIES
When using the assistants, users are requested not to enter personal data that allows for the direct identification of a third party, except where strictly necessary and where they have a legal basis to do so.
Where the context allows, they should prefer anonymised or pseudonymised information, for example by replacing a person's name with a job title, a generic profile or a pseudonym.
In particular, users must not enter sensitive data relating to third parties, such as information concerning their health, origin, political opinions, religious beliefs, sex life or any offences or convictions.
3.5. Technical and Connection Data
Technical logs may be collected to ensure security, error diagnosis and the proper functioning of the Service. They may include technical identifiers, connection information, dates and times of use and information relating to errors encountered. Their exact content, location and retention period depend on the technical infrastructure used.
3.5. Communication Data
When you contact us outside of the contact form, for example directly by email, we collect the data you communicate to us on that occasion (name, email address, content of your message) in order to process your request and follow it up.
4. Purposes and Legal Bases of Processing
In accordance with the GDPR, each processing operation of your data is based on a specific legal basis. The information below presents, for each purpose, the data concerned and the applicable legal basis.
Waitlist management and information about the launch of the Service — email address and first name. Legal basis: consent.
Sending newsletters and commercial communications — email address, first name and communication preferences. Legal basis: consent.
Measuring the delivery and interaction with electronic communications — data relating to delivery, openings and clicks. Legal basis: consent.
Responding to contact requests — first or last name, email address and message content. Legal basis: legitimate interest of Studio Flora in responding to requests received.
Account creation and management and access rights — account data and associated products. Legal basis: performance of the contract or implementation of pre-contractual measures requested by the user.
Provision of assistants and generation of documents — prompts, responses, history and generated documents. Legal basis: performance of the contract.
Payment processing, subscription management and billing — account, transaction and billing data. Legal basis: performance of the contract and legal accounting and tax obligations.
Security, abuse prevention and error diagnosis — technical data, connection data and logs. Legal basis: legitimate interest of Studio Flora in securing and maintaining the Service.
Audience measurement and analysis of Site use via Google Analytics — navigation data and technical data. Legal basis: consent.
Compliance with legal obligations and defense of Studio Flora's rights — data necessary according to the situation. Legal basis: legal obligation or legitimate interest.
5. Use of Artificial Intelligence and Your Data
5.1. Nature of the Service
In accordance with the transparency requirements set out in the European Artificial Intelligence Act (Regulation (EU) 2024/1689, known as the "AI Act"), we expressly inform you that the Innora Lab Service is based on generative artificial intelligence systems. When you use Innora Lab's assistants, you are interacting with an artificial intelligence system, not a human being.
5.2. Underlying Technology
Innora Lab's assistants are based on artificial intelligence technology provided by Google using the Gemini API. The contents entered by the user and the generated responses are transmitted to Google to allow the assistants to function.
Studio Flora uses a paid offer of the Gemini API linked to a project for which billing is enabled. Under the contractual terms applicable to this offer, Google does not use prompts and responses to improve its products and processes them in accordance with its data processing agreement.
Google, however, retains prompts and responses for a limited period, solely for the purposes of detecting breaches of its use policy, ensuring the security of its services and satisfying its legal or regulatory obligations. This data may be stored or cached in any country where Google or its agents maintain facilities. Google also processes technical and usage information necessary for the operation, security and billing of its services.
5.3. Non-use of your data for model training
Studio Flora does not use user conversations or content to train its own artificial intelligence models. Under the terms applicable to the paid Gemini API offer used by Studio Flora, Google does not use prompts and responses to improve its products.
5.4. Absence of automated decision-making within the meaning of Article 22 of the GDPR
The Service does not implement decisions that produce legal effects concerning you or significantly affect you based on purely automated processing, within the meaning of Article 22 of the GDPR. The results generated by the assistants constitute an aid to your own decision-making and do not in themselves carry any automatic legal consequences.
5.5. Limits of Artificial Intelligence
Assistants generate responses in an automated manner and may produce inaccurate information. The terms of use of the Service specify the terms of use of the generated results.
6. Recipients and Processors
Your personal data is never sold, rented or transferred to third parties for commercial purposes. It may be accessible to authorised persons within Studio Flora as well as to the providers and recipients identified below, to the extent necessary for the purposes described in this Policy.
The main service providers likely to receive or process personal data within the framework of the Service are the following.
Brevo SAS — management of the newsletter, waitlist, contact forms, email send-outs and statistics relating to delivery, openings and clicks.
Framer B.V. — design, publication and hosting of the showcase site innoralab.ai, as well as processing of technical data necessary for its display, operation and security.
Thenty Pty Ltd (Australia) — management of member accounts, authentication, access rights, products associated with accounts and transactional emails. Legal contact: account@insertframe.io. Support: support@thenty.io.
Stripe Payments Europe, Ltd. — payment processing, transaction management, fraud prevention and processing of information necessary for billing.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — provision of the Google Analytics service, audience measurement, analysis of navigation and production of usage statistics, subject to user consent.
Google Cloud France SARL, 8 rue de Londres, 75009 Paris, France — provision of the Gemini API and processing of prompts, responses and technical data necessary for the operation of the assistants.
Zapier, Inc. (United States) — automation of data transmission entered in the Site's forms to Brevo.
Not all providers necessarily act in the same role for all processing operations. Some of them, including Stripe, may act as a processor for certain operations and as a separate data controller for others, particularly in respect of fraud prevention and their regulatory obligations.
Studio Flora selects service providers that offer appropriate guarantees regarding data protection and structures its relationships with them in accordance with applicable requirements. We may also be required to communicate your data to administrative or judicial authorities when required by law, or to assert, exercise or defend our rights.
7. TRANSFERS OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
Studio Flora prefers, where possible, service providers established or having infrastructure within the European Economic Area. However, some providers may process data from countries located outside the European Economic Area or use processors established in these countries.
The transfers likely to occur are as follows: account and authentication data processed by Thenty Pty Ltd, a company established in Australia — according to information published by the provider, European data is created in a European region and remains stored in Europe, although some access or processing may nevertheless be carried out from a country located outside the European Economic Area; data transmitted to Zapier, established in the United States; prompts and responses transmitted to Google under the Gemini API, which may be stored or cached in any country where Google has facilities. Framer and Stripe may also use processors established outside the European Economic Area.
Depending on the service provider and the transfer concerned, the applicable guarantees may notably rely on an adequacy decision, on the EU-US Data Privacy Framework or on standard contractual clauses adopted by the European Commission.
You can obtain additional information on transfers and applicable guarantees by writing to contact@innoralab.ai.
8. Deletion of Your Account and Your Data
You can request the deletion of your account and exercise your rights by writing to contact@innoralab.ai. Studio Flora responds to these requests within one month, unless an extension is authorised by regulations.
Where the right to erasure applies, the data concerned is deleted from active systems as soon as possible. Some information may, however, be retained where this retention is necessary for compliance with a legal obligation, for the establishment, exercise or defense of legal claims, or for the duration of the technical persistence of backups.
8.1. End of Subscription
After the end of the subscription, account data is kept for thirty (30) days to allow the user to recover their documents or reactivate their account. At the end of this period, data is deleted from active systems or archived where its retention remains legally necessary.
9. Retention Periods
We retain your data for the period strictly necessary for the purposes for which they are processed.
Account data: during the entire life of the account, then for thirty (30) days after its closure.
Conversations: as long as the account is active or until deleted by the user.
Generated documents (PDF): as long as the account is active or until deleted by the user.
Billing data: ten (10) years from the end of the relevant financial year, in accordance with French accounting and tax obligations.
Newsletter and waitlist: until consent is withdrawn and, in the absence of withdrawal, for a maximum period of three (3) years from the last active contact.
Contact requests, regardless of the channel used: deleted following the processing of the request, and at most three (3) years from the last contact.
Technical logs: for a period proportionate to security, error diagnosis and Service maintenance needs, determined according to the technical infrastructure used.
Backups: data deleted from active systems may persist temporarily in technical backups until overwritten as part of the usual backup rotation cycle.
Google Analytics: event and usage data is retained for the period configured in the Google Analytics property, determined according to audience measurement needs.
Opening and click data for electronic communications: for the duration necessary to analyze campaigns and at most for the duration of contact retention.
10. Your Rights
In accordance with applicable regulations, you have the following rights over your personal data:
Right of access: obtain confirmation of whether or not your data is being processed, and receive a copy of it.
Right to rectification: have inaccurate data corrected or incomplete data completed.
Right to erasure: obtain the erasure of your data in the cases provided for by the regulations.
Right to restriction: request the restriction of the processing of your data in certain cases.
Right to object: object at any time to the processing of your data based on legitimate interest or intended for commercial prospecting.
Right to portability: in the cases provided for by the GDPR, receive the data you have provided to Studio Flora in a structured, commonly used and machine-readable format, and request its transmission to another controller where technically possible.
Right to withdraw consent: where processing is based on your consent, you can withdraw it at any time.
Right not to be subject to an automated decision, in accordance with Article 22 of the GDPR.
Right relating to the outcome of data after your death: you can define general or specific directives regarding the storage, erasure and communication of your data after your death.
You can exercise these rights by sending a request to contact@innoralab.ai. We may ask you for proof of identity in case of reasonable doubt about your identity. We commit to responding to your request within one (1) month from its receipt, which may be extended by an additional two (2) months in case of complex or numerous requests.
11. Supervisory Authorities
If you feel, after contacting us, that your rights are not being respected, you have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
Where applicable, you can also contact the competent supervisory authority of your place of residence or work.
12. Cookies and Trackers
12.1. What is a cookie?
A cookie is a small text file placed on your terminal (computer, tablet, smartphone) when you visit the Site. In particular, it ensures the proper functioning of the Site, memorises your preferences, or measures its audience.
12.2. Cookies used on the Site
Strictly necessary cookies: essential for the functioning of the Site (session management, security, storage of consent preferences). They do not require your consent, in accordance with Article 82 of the Data Protection Act.
Audience measurement cookies: subject to your consent, we use Google Analytics to measure Site traffic, understand visitor navigation, identify visited pages and improve the functioning of the Site. Google Analytics can process, in particular, a navigation identifier, visited pages, triggered events, device and browser type, operating system and an approximate geographical location. Google Analytics notably uses the _ga cookie to distinguish users and their sessions when Analytics storage is authorised. Google Analytics uses cookies and identifiers subject to your consent. Their retention period depends on the configuration applied to the Site and is limited to what is necessary for audience measurement.
12.3. Gathering and Withdrawal of Consent
On your first visit to the Site, an information banner allows you to accept, refuse or customise the placement of non-strictly necessary cookies. Refusing cookies is as simple as accepting them, and has no impact on accessing the Site.
No non-strictly necessary cookie is placed before your consent has been gathered.
Your choice is kept for a maximum of six (6) months, after which your consent will be requested again. You can change your preferences at any time by clicking on the "Manage my cookies" link in the footer of the Site.
12.4. Browser Settings
You can also configure your browser to refuse all or part of the cookies. Configuration procedures are specific to each browser and accessible via their respective help menus. Refusing certain cookies may, however, affect the proper functioning of the Site.
13. Protection of Minors
The Service is exclusively intended for adults, aged at least eighteen (18) years, acting in a personal or professional capacity within the framework of an entrepreneurial activity or in preparation for such an activity. Studio Flora does not knowingly collect personal data relating to minors. If we learn that a minor has transmitted personal data to us, we will delete it as soon as possible.
14. Security and Incident Notification
Studio Flora implements technical and organisational measures adapted to risks in order to preserve the confidentiality, integrity and availability of personal data. These measures are adapted according to the nature of the data processed, the features of the Service and the technical infrastructure used.
However, no data transmission over the Internet can be guaranteed to be completely secure. We therefore invite you to be cautious in the nature of the information you communicate during your exchanges with the Service.
In accordance with Articles 33 and 34 of the GDPR, in the event of a personal data breach presenting a risk to your rights and freedoms, Studio Flora undertakes to notify the competent supervisory authority within the required timeframe, and to inform you as soon as possible when this breach is likely to result in a high risk to your rights and freedoms.
15. Amendments to this Policy
This Privacy Policy may be modified to take account of legal, regulatory or technical developments, or developments in the Service. The applicable version is the one in force and accessible on the Site at the time of your visit.
In the event of a substantial modification affecting the nature of the processing or the rights of users, Studio Flora informs the persons concerned by an appropriate method, where required by regulations.
16. Contact
For any questions relating to this Privacy Policy, the processing of your personal data, or to exercise your rights, you can contact Studio Flora electronically at contact@innoralab.ai or by post at the following address: Studio Flora, 60 rue François 1er, 75008 Paris (France).
Studio Flora, the publisher of the Innora Lab service, considers the protection of the privacy and personal data of its users to be of fundamental importance. The purpose of this Privacy Policy is to inform you, in a clear, transparent and accessible manner, about the nature of the data we collect, the purposes for which we process it, its retention period, the recipients of this data and your rights.
This Policy applies to all processing carried out within the framework of using the innoralab.ai website and the Innora Lab application (hereinafter, together, the "Service"). It complies with Regulation (EU) 2016/679 of 27 April 2016 on data protection (hereinafter the "GDPR") and Act No. 78-17 of 6 January 1978 as amended, known as the "Data Protection Act".
As of the publication date of this Policy, the Innora Lab application is offered in a beta phase to a limited number of users who have an account. Processing relating to account creation, the use of assistants, the retention of exchanges and the generation of documents is carried out within this framework.
1. Data Controller
The controller for the processing of personal data is Studio Flora, a single-member simplified joint-stock company with a share capital of 100 euros, whose registered office is located at 60 rue François 1er, 75008 Paris (France), registered in the Paris Trade and Companies Register under number 999 649 635.
For any questions relating to this Policy or the processing of your personal data, you can contact Studio Flora at contact@innoralab.ai.
2. Scope
The Service is accessible to users located in France and internationally. The processing of personal data carried out by Studio Flora in the course of its business is mainly subject to the General Data Protection Regulation and the French Data Protection Act, as Studio Flora is established in the European Union.
Where mandatory local provisions are applicable to users located outside the European Union, they may supplement this framework. Any questions relating to the application of these provisions can be sent to contact@innoralab.ai.
3. Data We Collect
We only collect data necessary for the operation, security and delivery of the Service.
3.1. Data collected via the website
When you interact with the innoralab.ai website outside of creating an application account, we may collect the following data via our provider Brevo.
Newsletter subscription: your email address and first name, collected with your consent.
Contact form: your first or last name, your email address and the content of your message.
Waitlist: your email address and first name.
Data relating to electronic communications: information relating to the delivery of messages, their opening, clicks on links, unsubscribes and associated statistics.
3.2. Account and Subscription Data
When you create an account, we collect your first name or display name and your email address. Information relating to the products, subscriptions or access rights associated with your account may also be recorded, including the product concerned, its type, its status and the date of its last update.
The management of member accounts, authentication and access rights is provided by our partner Thenty.
Complete data relating to the payment method, including the full credit card number, is collected and processed directly by Stripe. Studio Flora and Thenty do not have access to the full card number.
Studio Flora may nevertheless receive information necessary for payment and subscription management, including the customer's email address, the amount and currency, the date and status of the payment or refund, the type and brand of payment method, as well as the last four digits of the card.
3.3. Data from your use of assistants
When you interact with Innora Lab's assistants, the content of your exchanges is recorded and linked to your account to allow you to view your history and find your previous work.
When a session is closed, its content remains viewable in read-only mode, but the conversation can no longer be continued. To continue using an assistant, you must open a new session.
The documents generated at the end of a session are also saved and linked to your account to allow you to view and download them.
You can delete conversations, history and available documents from your account area. When data is deleted from the interface, it is no longer accessible from your account. It is then deleted from the active systems as soon as possible, subject to legal retention obligations and its possible temporary persistence in technical backups.
3.4. INFORMATION RELATING TO THIRD PARTIES
When using the assistants, users are requested not to enter personal data that allows for the direct identification of a third party, except where strictly necessary and where they have a legal basis to do so.
Where the context allows, they should prefer anonymised or pseudonymised information, for example by replacing a person's name with a job title, a generic profile or a pseudonym.
In particular, users must not enter sensitive data relating to third parties, such as information concerning their health, origin, political opinions, religious beliefs, sex life or any offences or convictions.
3.5. Technical and Connection Data
Technical logs may be collected to ensure security, error diagnosis and the proper functioning of the Service. They may include technical identifiers, connection information, dates and times of use and information relating to errors encountered. Their exact content, location and retention period depend on the technical infrastructure used.
3.5. Communication Data
When you contact us outside of the contact form, for example directly by email, we collect the data you communicate to us on that occasion (name, email address, content of your message) in order to process your request and follow it up.
4. Purposes and Legal Bases of Processing
In accordance with the GDPR, each processing operation of your data is based on a specific legal basis. The information below presents, for each purpose, the data concerned and the applicable legal basis.
Waitlist management and information about the launch of the Service — email address and first name. Legal basis: consent.
Sending newsletters and commercial communications — email address, first name and communication preferences. Legal basis: consent.
Measuring the delivery and interaction with electronic communications — data relating to delivery, openings and clicks. Legal basis: consent.
Responding to contact requests — first or last name, email address and message content. Legal basis: legitimate interest of Studio Flora in responding to requests received.
Account creation and management and access rights — account data and associated products. Legal basis: performance of the contract or implementation of pre-contractual measures requested by the user.
Provision of assistants and generation of documents — prompts, responses, history and generated documents. Legal basis: performance of the contract.
Payment processing, subscription management and billing — account, transaction and billing data. Legal basis: performance of the contract and legal accounting and tax obligations.
Security, abuse prevention and error diagnosis — technical data, connection data and logs. Legal basis: legitimate interest of Studio Flora in securing and maintaining the Service.
Audience measurement and analysis of Site use via Google Analytics — navigation data and technical data. Legal basis: consent.
Compliance with legal obligations and defense of Studio Flora's rights — data necessary according to the situation. Legal basis: legal obligation or legitimate interest.
5. Use of Artificial Intelligence and Your Data
5.1. Nature of the Service
In accordance with the transparency requirements set out in the European Artificial Intelligence Act (Regulation (EU) 2024/1689, known as the "AI Act"), we expressly inform you that the Innora Lab Service is based on generative artificial intelligence systems. When you use Innora Lab's assistants, you are interacting with an artificial intelligence system, not a human being.
5.2. Underlying Technology
Innora Lab's assistants are based on artificial intelligence technology provided by Google using the Gemini API. The contents entered by the user and the generated responses are transmitted to Google to allow the assistants to function.
Studio Flora uses a paid offer of the Gemini API linked to a project for which billing is enabled. Under the contractual terms applicable to this offer, Google does not use prompts and responses to improve its products and processes them in accordance with its data processing agreement.
Google, however, retains prompts and responses for a limited period, solely for the purposes of detecting breaches of its use policy, ensuring the security of its services and satisfying its legal or regulatory obligations. This data may be stored or cached in any country where Google or its agents maintain facilities. Google also processes technical and usage information necessary for the operation, security and billing of its services.
5.3. Non-use of your data for model training
Studio Flora does not use user conversations or content to train its own artificial intelligence models. Under the terms applicable to the paid Gemini API offer used by Studio Flora, Google does not use prompts and responses to improve its products.
5.4. Absence of automated decision-making within the meaning of Article 22 of the GDPR
The Service does not implement decisions that produce legal effects concerning you or significantly affect you based on purely automated processing, within the meaning of Article 22 of the GDPR. The results generated by the assistants constitute an aid to your own decision-making and do not in themselves carry any automatic legal consequences.
5.5. Limits of Artificial Intelligence
Assistants generate responses in an automated manner and may produce inaccurate information. The terms of use of the Service specify the terms of use of the generated results.
6. Recipients and Processors
Your personal data is never sold, rented or transferred to third parties for commercial purposes. It may be accessible to authorised persons within Studio Flora as well as to the providers and recipients identified below, to the extent necessary for the purposes described in this Policy.
The main service providers likely to receive or process personal data within the framework of the Service are the following.
Brevo SAS — management of the newsletter, waitlist, contact forms, email send-outs and statistics relating to delivery, openings and clicks.
Framer B.V. — design, publication and hosting of the showcase site innoralab.ai, as well as processing of technical data necessary for its display, operation and security.
Thenty Pty Ltd (Australia) — management of member accounts, authentication, access rights, products associated with accounts and transactional emails. Legal contact: account@insertframe.io. Support: support@thenty.io.
Stripe Payments Europe, Ltd. — payment processing, transaction management, fraud prevention and processing of information necessary for billing.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — provision of the Google Analytics service, audience measurement, analysis of navigation and production of usage statistics, subject to user consent.
Google Cloud France SARL, 8 rue de Londres, 75009 Paris, France — provision of the Gemini API and processing of prompts, responses and technical data necessary for the operation of the assistants.
Zapier, Inc. (United States) — automation of data transmission entered in the Site's forms to Brevo.
Not all providers necessarily act in the same role for all processing operations. Some of them, including Stripe, may act as a processor for certain operations and as a separate data controller for others, particularly in respect of fraud prevention and their regulatory obligations.
Studio Flora selects service providers that offer appropriate guarantees regarding data protection and structures its relationships with them in accordance with applicable requirements. We may also be required to communicate your data to administrative or judicial authorities when required by law, or to assert, exercise or defend our rights.
7. TRANSFERS OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA
Studio Flora prefers, where possible, service providers established or having infrastructure within the European Economic Area. However, some providers may process data from countries located outside the European Economic Area or use processors established in these countries.
The transfers likely to occur are as follows: account and authentication data processed by Thenty Pty Ltd, a company established in Australia — according to information published by the provider, European data is created in a European region and remains stored in Europe, although some access or processing may nevertheless be carried out from a country located outside the European Economic Area; data transmitted to Zapier, established in the United States; prompts and responses transmitted to Google under the Gemini API, which may be stored or cached in any country where Google has facilities. Framer and Stripe may also use processors established outside the European Economic Area.
Depending on the service provider and the transfer concerned, the applicable guarantees may notably rely on an adequacy decision, on the EU-US Data Privacy Framework or on standard contractual clauses adopted by the European Commission.
You can obtain additional information on transfers and applicable guarantees by writing to contact@innoralab.ai.
8. Deletion of Your Account and Your Data
You can request the deletion of your account and exercise your rights by writing to contact@innoralab.ai. Studio Flora responds to these requests within one month, unless an extension is authorised by regulations.
Where the right to erasure applies, the data concerned is deleted from active systems as soon as possible. Some information may, however, be retained where this retention is necessary for compliance with a legal obligation, for the establishment, exercise or defense of legal claims, or for the duration of the technical persistence of backups.
8.1. End of Subscription
After the end of the subscription, account data is kept for thirty (30) days to allow the user to recover their documents or reactivate their account. At the end of this period, data is deleted from active systems or archived where its retention remains legally necessary.
9. Retention Periods
We retain your data for the period strictly necessary for the purposes for which they are processed.
Account data: during the entire life of the account, then for thirty (30) days after its closure.
Conversations: as long as the account is active or until deleted by the user.
Generated documents (PDF): as long as the account is active or until deleted by the user.
Billing data: ten (10) years from the end of the relevant financial year, in accordance with French accounting and tax obligations.
Newsletter and waitlist: until consent is withdrawn and, in the absence of withdrawal, for a maximum period of three (3) years from the last active contact.
Contact requests, regardless of the channel used: deleted following the processing of the request, and at most three (3) years from the last contact.
Technical logs: for a period proportionate to security, error diagnosis and Service maintenance needs, determined according to the technical infrastructure used.
Backups: data deleted from active systems may persist temporarily in technical backups until overwritten as part of the usual backup rotation cycle.
Google Analytics: event and usage data is retained for the period configured in the Google Analytics property, determined according to audience measurement needs.
Opening and click data for electronic communications: for the duration necessary to analyze campaigns and at most for the duration of contact retention.
10. Your Rights
In accordance with applicable regulations, you have the following rights over your personal data:
Right of access: obtain confirmation of whether or not your data is being processed, and receive a copy of it.
Right to rectification: have inaccurate data corrected or incomplete data completed.
Right to erasure: obtain the erasure of your data in the cases provided for by the regulations.
Right to restriction: request the restriction of the processing of your data in certain cases.
Right to object: object at any time to the processing of your data based on legitimate interest or intended for commercial prospecting.
Right to portability: in the cases provided for by the GDPR, receive the data you have provided to Studio Flora in a structured, commonly used and machine-readable format, and request its transmission to another controller where technically possible.
Right to withdraw consent: where processing is based on your consent, you can withdraw it at any time.
Right not to be subject to an automated decision, in accordance with Article 22 of the GDPR.
Right relating to the outcome of data after your death: you can define general or specific directives regarding the storage, erasure and communication of your data after your death.
You can exercise these rights by sending a request to contact@innoralab.ai. We may ask you for proof of identity in case of reasonable doubt about your identity. We commit to responding to your request within one (1) month from its receipt, which may be extended by an additional two (2) months in case of complex or numerous requests.
11. Supervisory Authorities
If you feel, after contacting us, that your rights are not being respected, you have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.
Where applicable, you can also contact the competent supervisory authority of your place of residence or work.
12. Cookies and Trackers
12.1. What is a cookie?
A cookie is a small text file placed on your terminal (computer, tablet, smartphone) when you visit the Site. In particular, it ensures the proper functioning of the Site, memorises your preferences, or measures its audience.
12.2. Cookies used on the Site
Strictly necessary cookies: essential for the functioning of the Site (session management, security, storage of consent preferences). They do not require your consent, in accordance with Article 82 of the Data Protection Act.
Audience measurement cookies: subject to your consent, we use Google Analytics to measure Site traffic, understand visitor navigation, identify visited pages and improve the functioning of the Site. Google Analytics can process, in particular, a navigation identifier, visited pages, triggered events, device and browser type, operating system and an approximate geographical location. Google Analytics notably uses the _ga cookie to distinguish users and their sessions when Analytics storage is authorised. Google Analytics uses cookies and identifiers subject to your consent. Their retention period depends on the configuration applied to the Site and is limited to what is necessary for audience measurement.
12.3. Gathering and Withdrawal of Consent
On your first visit to the Site, an information banner allows you to accept, refuse or customise the placement of non-strictly necessary cookies. Refusing cookies is as simple as accepting them, and has no impact on accessing the Site.
No non-strictly necessary cookie is placed before your consent has been gathered.
Your choice is kept for a maximum of six (6) months, after which your consent will be requested again. You can change your preferences at any time by clicking on the "Manage my cookies" link in the footer of the Site.
12.4. Browser Settings
You can also configure your browser to refuse all or part of the cookies. Configuration procedures are specific to each browser and accessible via their respective help menus. Refusing certain cookies may, however, affect the proper functioning of the Site.
13. Protection of Minors
The Service is exclusively intended for adults, aged at least eighteen (18) years, acting in a personal or professional capacity within the framework of an entrepreneurial activity or in preparation for such an activity. Studio Flora does not knowingly collect personal data relating to minors. If we learn that a minor has transmitted personal data to us, we will delete it as soon as possible.
14. Security and Incident Notification
Studio Flora implements technical and organisational measures adapted to risks in order to preserve the confidentiality, integrity and availability of personal data. These measures are adapted according to the nature of the data processed, the features of the Service and the technical infrastructure used.
However, no data transmission over the Internet can be guaranteed to be completely secure. We therefore invite you to be cautious in the nature of the information you communicate during your exchanges with the Service.
In accordance with Articles 33 and 34 of the GDPR, in the event of a personal data breach presenting a risk to your rights and freedoms, Studio Flora undertakes to notify the competent supervisory authority within the required timeframe, and to inform you as soon as possible when this breach is likely to result in a high risk to your rights and freedoms.
15. Amendments to this Policy
This Privacy Policy may be modified to take account of legal, regulatory or technical developments, or developments in the Service. The applicable version is the one in force and accessible on the Site at the time of your visit.
In the event of a substantial modification affecting the nature of the processing or the rights of users, Studio Flora informs the persons concerned by an appropriate method, where required by regulations.
16. Contact
For any questions relating to this Privacy Policy, the processing of your personal data, or to exercise your rights, you can contact Studio Flora electronically at contact@innoralab.ai or by post at the following address: Studio Flora, 60 rue François 1er, 75008 Paris (France).
Last updated: 4 August2026
Privacy Policy
Privacy
policy
Structure what you carry, with rigour and presence.
POWERED BY GEMINI · GOOGLE DEEPMIND
CONTACT & LEGAL NOTICE
© 2026 INNORA LAB
HOSTED IN EUROPE · GDPR COMPLIANT
GEMINI IS A TRADEMARK OF GOOGLE LLC · INNORA LAB IS NOT AFFILIATED WITH GOOGLE
Structure what you carry, with rigour and presence.
POWERED BY GEMINI · GOOGLE DEEPMIND
CONTACT & LEGAL NOTICE
© 2026 INNORA LAB
HOSTED IN EUROPE · GDPR COMPLIANT
GEMINI IS A TRADEMARK OF GOOGLE LLC · INNORA LAB IS NOT AFFILIATED WITH GOOGLE
Structure what you carry, with rigour and presence.
POWERED BY GEMINI · GOOGLE DEEPMIND
CONTACT & LEGAL NOTICE
© 2026 INNORA LAB
HOSTED IN EUROPE · GDPR COMPLIANT
GEMINI IS A TRADEMARK OF GOOGLE LLC · INNORA LAB IS NOT AFFILIATED WITH GOOGLE