Studio Flora, editor of the Innora Lab service, attaches fundamental importance to the protection of privacy and personal data of its users. This Privacy Policy is intended to inform you, in a clear, transparent and accessible manner, about the nature of the data we collect, the purposes for which we process it, its retention period, the recipients of this data and the rights available to you.

This Policy applies to all processing carried out as part of the use of the innoralab.ai website and the Innora Lab application (hereinafter, together, the "Service"). It complies with Regulation (EU) 2016/679 of 27 April 2016 on data protection (hereinafter the "GDPR") and with Law No. 78-17 of 6 January 1978 as amended, known as the "Data Protection Act".

1. Data Controller

The data controller for personal data is Studio Flora, a single-member simplified joint-stock company with a capital of 100 euros, whose registered office is located at 60 rue François 1er, 75008 Paris (France), registered in the Paris Trade and Companies Register under number 999 649 635.

For any questions regarding this Policy or the processing of your personal data, you can contact Studio Flora at contact@innoralab.ai.

2. International Scope

The Service is accessible to users located in France and internationally. The processing of personal data carried out by Studio Flora as part of its activity is mainly subject to the General Data Protection Regulation and the French Data Protection Act, as Studio Flora is established in the European Union.

Where mandatory local provisions apply to users located outside the European Union, they may complement this framework. Any questions regarding the application of these provisions can be addressed to contact@innoralab.ai.

3. Data We Collect

We only collect data necessary for the operation, security and provision of the Service.

3.1. Data collected via the website

When you interact with the innoralab.ai website outside of creating an application account, we may collect the following data via our service provider Brevo.

Newsletter subscription: your email address and first name, collected with your consent.

Contact form: your first or last name, your email address and the content of your message.

Waiting list: your email address and your first name.

Data relating to electronic communications: information relating to the delivery of messages, their opening, clicks on links, unsubscribes and associated statistics.

3.2. Account and subscription data

When you create an account, we collect your first name or display name as well as your email address. We record the information necessary to manage your subscription and your access rights, in particular the subscription plan, its status and associated deadlines.

We also process the data necessary to monitor your credits: monthly consumption, renewal date, purchased top-ups and available credit balance.

The management of member accounts, authentication and access rights is handled by our service provider Thenty.

Full details of payment methods, including the complete credit card number, are collected and processed directly by Stripe. Studio Flora and Thenty do not have access to the full card number.

Studio Flora may receive the information necessary to manage subscription payments and top-ups, including the customer's email address, the amount and currency, the date and status of the payment or refund, the type and brand of the payment method, as well as the last four digits of the card.

3.3. Data from your use of the assistants

When you interact with Innora Lab assistants, the content of your exchanges is recorded and linked to your account to allow you to view your history and find your previous work.

When a session is closed, its content remains viewable in read-only mode, but the conversation cannot be continued. To continue using an assistant, you must open a new session.

PDF documents are generated on demand, at the moment you download them, based on the content of your exchanges. They are not stored as files by Studio Flora.

You can delete your conversations from your personal area. A deleted conversation is erased immediately from the active database, then disappears from technical backups within a maximum of eight (8) days.

3.4. Information relating to third parties

When using the assistants, users are requested not to enter personal data that directly identifies a third party, unless this is strictly necessary and they have a legal basis to do so.

When the context permits, they must give preference to anonymised or pseudonymised information, for example by replacing a person's name with a job title, a generic profile or a pseudonym.

In particular, users must not enter sensitive data relating to third parties, such as information concerning their health, origin, political opinions, religious beliefs, sex life or any offences or convictions.

3.5. Technical and connection data

Technical logs are collected in order to ensure security, error diagnosis and the proper functioning of the Service. They only contain technical session identifiers, the nature and description of errors encountered, as well as the date and time of the events. They do not contain the content of your exchanges and are kept for fourteen (14) days.

3.6. Communication data

When you contact us outside of the contact form, for example directly by email, we collect the data you provide to us on that occasion (name, email address, content of your message) in order to process and follow up on your request.

4. Purposes and Legal Bases of Processing

In accordance with the GDPR, each processing of your data is based on a specific legal basis. The information below presents, for each purpose, the data concerned and the applicable legal basis.

Waiting list management and information on the launch of the Service — email address and first name. Legal basis: consent.

Sending newsletters and commercial communications — email address, first name and communication preferences. Legal basis: consent.

Measurement of delivery and interaction with electronic communications — data relating to delivery, openings and clicks. Legal basis: consent.

Response to contact requests — first or last name, email address and message content. Legal basis: legitimate interest of Studio Flora to respond to requests received.

Account creation and management and access rights — account data and associated products. Legal basis: performance of the contract or implementation of pre-contractual measures requested by the user.

Provision of assistants and document generation — prompts, responses, history and generated documents. Legal basis: performance of the contract.

Payment processing, subscription management and billing — account, transaction and billing data. Legal basis: performance of the contract and legal accounting and tax obligations.

Security, abuse prevention and error diagnostics — technical data, connection data and logs. Legal basis: legitimate interest of Studio Flora to secure and maintain the Service.

Audience measurement and analysis of Site use using Google Analytics — browsing data and technical data. Legal basis: consent.

Compliance with legal obligations and defense of Studio Flora's rights — necessary data depending on the situation. Legal basis: legal obligation or legitimate interest.

5. Use of Artificial Intelligence and Your Data

5.1. Nature of the Service

In accordance with the transparency requirements provided for by the European Artificial Intelligence Act (Regulation (EU) 2024/1689, known as the "AI Act"), we expressly inform you that the Innora Lab Service is based on generative artificial intelligence systems. When you use Innora Lab assistants, you are interacting with an artificial intelligence system, not a human being.

5.2. Underlying Technology

Innora Lab's assistants are based on artificial intelligence technology provided by Google using the Gemini API. In order to allow the operation of the assistants, instructions specific to each assistant, the exchanges of the current session, the summary data necessary for the continuity of your work, as well as a technical account identifier are transmitted to Google. Your email address is never transmitted to Google.

Studio Flora uses a paid offer of the Gemini API linked to a project for which billing is enabled. According to the contract terms applicable to this offer, Google does not use prompts and responses to improve its products and processes them in accordance with its data processing agreement.

However, Google retains prompts and responses for a limited period, solely for the purposes of detecting breaches of its usage policy, ensuring the security of its services, and complying with the legal or regulatory obligations to which it is subject. This data may be stored or cached in any country where Google or its agents maintain facilities. Google also processes technical and usage information necessary for the operation, security and billing of its services.

5.3. Non-use of your data for model training

Studio Flora does not use users' conversations or content to train its own artificial intelligence models. According to the conditions applicable to the paid offer of the Gemini API used by Studio Flora, Google does not use prompts and responses to improve its products.

5.4. Absence of automated decision-making within the meaning of Article 22 of the GDPR

The Service does not implement decisions producing legal effects concerning you or significantly affecting you based on exclusively automated processing, within the meaning of Article 22 of the GDPR. The results generated by the assistants constitute an aid to your own decision-making and do not in themselves carry any automatic legal consequences.

5.5. Limits of Artificial Intelligence

Assistants generate responses in an automated manner and may produce inaccurate information. The terms of use of the Service specify the terms of use of the generated results.

6. Recipients and Subcontractors

Your personal data is never sold, rented or transferred to third parties for commercial purposes. They may be accessible to authorised persons within Studio Flora as well as to the service providers and recipients identified below, to the extent necessary for the purposes described in this Policy.

The main service providers likely to receive or process personal data in connection with the Service are as follows.

Brevo SAS — management of the newsletter, waiting list, contact forms, sending emails and statistics relating to delivery, openings and clicks.

Framer B.V. — design, publication and hosting of the innoralab.ai showcase site, as well as processing of technical data necessary for its display, operation and security.

HOSTINGER INTERNATIONAL LIMITED (Cyprus) — hosting the backend and database of the front.innoralab.ai application, as well as backups and technical logs. The server is located in the United Kingdom. The database particularly stores conversations and data allowing the generation of PDF documents; the PDFs themselves are not stored as files.

Thenty Pty Ltd (Australia) — management of member accounts, authentication, access rights, products associated with accounts and transactional emails. Legal contact: account@insertframe.io. Support: support@thenty.io.

Stripe Payments Europe, Ltd. — payment processing, transaction management, fraud prevention and processing of information necessary for billing.

Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland — provision of the Google Analytics service, audience measurement, navigation analysis and production of usage statistics, subject to user consent.

Google Cloud France SARL, 8 rue de Londres, 75009 Paris, France — provision of the Gemini API and processing of prompts, responses and technical data necessary for the functioning of the assistants.

All service providers do not necessarily act in the same role for all processing operations. Some of them, notably Stripe, may act as a subcontractor for certain operations and as a separate data controller for others, particularly for fraud prevention and their regulatory obligations.

Studio Flora selects service providers offering appropriate guarantees regarding data protection and structures its relationships with them in accordance with applicable requirements. We may also be required to communicate your data to administrative or judicial authorities when required by law, or to assert, exercise or defend our rights.

7. TRANSFERS OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

Studio Flora prefers, where possible, service providers established or with infrastructure within the European Economic Area. Some service providers may nevertheless process data from countries outside the European Economic Area or use subcontractors established in these countries.

Transfers likely to occur concern in particular:

• Data hosted on the Hostinger server located in the United Kingdom, including conversations, data used to generate PDF documents, backups and technical logs. The United Kingdom benefits from an adequacy decision by the European Commission under the GDPR.

• Account and authentication data processed by Thenty Pty Ltd, a company established in Australia. According to information published by the provider, European data is created in a European region and remains stored in Europe, although some access or processing may nevertheless be carried out from a country located outside the European Economic Area.

• Prompts and responses transmitted to Google under the Gemini API, which may be stored or cached in countries where Google or its agents maintain facilities.

Framer and Stripe may also use subcontractors established outside the European Economic Area.

Depending on the provider and transfer involved, applicable guarantees may rely in particular on an adequacy decision, the EU-US Data Privacy Framework, or standard contractual clauses adopted by the European Commission.

You can obtain additional information on transfers and applicable guarantees by writing to contact@innoralab.ai.

8. Deletion of Your Account and Data

You can request the deletion of your account and exercise your rights by writing to contact@innoralab.ai. Studio Flora responds to these requests within one month, unless an extension is authorised by regulations.

When the right to erasure is applicable, the relevant data is deleted from active systems as soon as possible. Some information may, however, be retained when this retention is necessary for compliance with a legal obligation, for the establishment, exercise or defense of legal claims, or for the duration of technical persistence of backups.

8.1. End of subscription

Upon the effective end of the subscription, access to the assistants, history and downloading of PDF documents ceases. You are invited to download the documents you wish to keep before this date.

Your account and conversations are kept for thirty (30) days to allow their recovery in the Service in case of a new subscription during this period. This retention does not extend your access to the Service.

At the expiry of this period, this data is deleted in accordance with the terms of this Policy, subject to information whose retention remains legally necessary.

You can continue to exercise your rights on your personal data with contact@innoralab.ai. When the law provides for a free return of your data or content, this is not conditioned on subscribing to a new subscription.

9. Retention Periods

We keep your data for the period strictly necessary for the purposes for which they are processed.

Account data: throughout the duration of the subscription, then thirty (30) days after its end.

Conversations: throughout the duration of the subscription, then thirty (30) days after its end, unless deleted earlier by the user.

Generated documents (PDF): not stored. They are generated on demand from conversations.

Billing data: ten (10) years from the closing of the relevant financial year, in accordance with French accounting and tax obligations.

Newsletter and waiting list: until withdrawal of consent and, in the absence of withdrawal, for a maximum period of three (3) years from the last active contact.

Contact requests, regardless of the channel used: deleted following the processing of the request, and at most three (3) years from the last contact.

Technical logs: fourteen (14) days.

Backups: deleted data may persist in technical backups for a maximum of eight (8) days.

Google Analytics: event and usage data is retained for the duration configured in the Google Analytics property, determined based on audience measurement needs.

Open and click data of electronic communications: for the duration necessary for the analysis of campaigns and at most for the duration of the contact retention.

10. Your Rights

In accordance with the applicable regulations, you have the following rights over your personal data:

Right of access: obtain confirmation of whether or not your data is being processed, and receive a copy thereof.

Right to rectification: have inaccurate data corrected or incomplete data completed.

Right to erasure: obtain the erasure of your data in cases provided for by regulations.

Right to restriction: request the restriction of the processing of your data in certain cases.

Right to object: object at any time to the processing of your data based on legitimate interest or intended for commercial prospecting.

Right to portability: in cases provided for by the GDPR, receive the data you have provided to Studio Flora in a structured, commonly used and machine-readable format, and request its transmission to another data controller when technically possible.

Right to withdraw your consent: when the processing is based on your consent, you can withdraw it at any time.

Right not to be subject to an automated decision, in accordance with Article 22 of the GDPR.

Right relating to the fate of data after your death: you can define general or specific directives relating to the preservation, erasure and communication of your data after your death.

You can exercise these rights by sending a request to the address contact@innoralab.ai. We may ask you for proof of identity in case of reasonable doubt about your identity. We commit to responding to your request within one (1) month from its receipt, a period which may be extended by an additional two (2) months in case of complex or numerous requests.

11. Supervisory Authorities

If you feel, after contacting us, that your rights are not being respected, you have the right to lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

Where applicable, you may also contact the competent supervisory authority in your place of residence or work.

12. Cookies and Trackers

12.1. What is a cookie?

A cookie is a small text file placed on your device (computer, tablet, smartphone) when you visit the Site. In particular, it ensures the proper functioning of the Site, remembers your preferences, or measures its audience.

12.2. Cookies used on the Site

Strictly necessary cookies: essential for the functioning of the Site (session management, security, memorisation of consent preferences). They do not require your consent, in accordance with Article 82 of the Data Protection Act.

Audience measurement cookies: subject to your consent, we use Google Analytics to measure Site traffic, understand visitor navigation, identify visited pages and improve the functioning of the Site. Google Analytics can process in particular a browsing identifier, pages viewed, events triggered, the type of device and browser, the operating system and an approximate geographic location. Google Analytics notably uses the _ga cookie to distinguish users and their sessions when Analytics storage is authorised. Google Analytics uses cookies and identifiers subject to your consent. Their retention period depends on the configuration applied to the Site and is limited to what is necessary for audience measurement.

12.3. Collection and withdrawal of consent

Upon your first visit to the Site, an information banner allows you to accept, refuse or customise the placement of non-strictly necessary cookies. Refusing cookies is as simple as accepting them, and has no consequences on access to the Site.

No non-strictly necessary cookie is placed before collecting your consent.

Your choice is kept for a maximum period of six (6) months, at the end of which your consent will be requested again. You can modify your preferences at any time by clicking on the "Manage my cookies" link in the footer of the Site.

12.4. Browser settings

You can also configure your browser to refuse all or part of the cookies. Configuration procedures are specific to each browser and accessible via their respective help menus. Refusing certain cookies is, however, likely to affect the proper functioning of the Site.

13. Protection of Minors

The Service is exclusively intended for adults, aged at least eighteen (18) years, acting in a personal or professional capacity within the framework of an entrepreneurial activity or in preparation for such an activity. Studio Flora does not knowingly collect personal data relating to minors. If we learn that a minor has transmitted personal data to us, we would proceed with their deletion as soon as possible.

14. Security and Incident Notification

Studio Flora implements technical and organisational measures adapted to the risks in order to preserve the confidentiality, integrity and availability of personal data. These measures are adapted based on the nature of the data processed, the functionalities of the Service and the technical infrastructure used. Exchanges between your browser and the Service are encrypted (HTTPS protocol).

No data transmission over the Internet can, however, be guaranteed to be completely secure. We consequently invite you to exercise caution regarding the nature of the information you communicate during your exchanges with the Service.

In accordance with Articles 33 and 34 of the GDPR, in the event of a personal data breach presenting a risk to your rights and freedoms, Studio Flora undertakes to notify the competent supervisory authority within the required timeframes, and to inform you as soon as possible when this breach is likely to result in a high risk to your rights and freedoms.

15. Changes to This Policy

This Privacy Policy may be modified to take into account legal, regulatory or technical developments, or developments in the Service. The applicable version is the one in force and accessible on the Site at the time of your consultation.

In the event of a material change affecting the nature of the processing or the rights of users, Studio Flora informs the persons concerned by an appropriate method, where required by regulations.

16. Contact

For any questions regarding this Privacy Policy, the processing of your personal data, or to exercise your rights, you can contact Studio Flora electronically at contact@innoralab.ai or by post at the following address: Studio Flora, 60 rue François 1er, 75008 Paris (France).