Privacy Policy

AICE Technology Limited (we) are committed to protecting your personal data and respecting your privacy. We know that users are becoming increasingly concerned about what happens to their data. We have invested a significant amount of time and money to ensure that the amount of personal data we collect and store is at a minimum.

Introduction

This policy applies where you contact us either directly or through our Website.

This policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

Important Information and Who We Are

AICE Technology Limited is the controller and is responsible for your personal data (collectively referred to as "AICE", "we", "us" or "our" in this policy).

We have appointed a data privacy manager. If you have any questions about this privacy policy, please contact them using the details set out below.

Contact Details

Our full details are:

• Full name of legal entity: AICE Technology Limited
• Email address: dpo@aicetechnology.com
• Postal address: AICE Technology Limited, The Carriage House, Mill Street, Maidstone, ME15 6YE
• Website: https://www.flero.ai

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues, or another competent supervisory authority of an EU member state if the App is downloaded outside the UK. For further information please visit https://ico.org.uk/make-a-complaint/.

Changes to This Privacy Policy

We keep our privacy policy under regular review.

This version was last updated on 13 July 2026. It may change and if it does, the new version will be posted on this page and, if we choose, by email.

It is important that any personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during our relationship with you.

Third Party Links

Our Website may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. Please note that these websites and any services that may be accessible through them have their own privacy policies and that we do not accept any responsibility or liability for these policies or for any personal data that may be collected through these websites or services, such as Contact and Location Data. Please check these policies before you submit any personal data to these websites or use these services.

The Data We Collect About You

If you contact us via our Website, or directly by email, you may choose to provide us with contact details such as your name and email address (Communication Data). We will only use the details to communicate with you, as appropriate.

We may also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

How Is Your Personal Data Collected?

We will collect and process the following data about you:

Information you give us directly. This is information you consent to giving us about you by corresponding with us (for example, by email) or by filling in your contact details on a web-based form, so we can send you a link to the App or contact you for product announcement.

How We Use Your Personal Data

We will only use your personal data when the law allows us to do so. Most commonly we will use your personal data in the following circumstances:

• Where you have consented before the processing.
• Where we need to perform a contract we are about to enter or have entered with you.
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.

Third-Party Connectors and Your Data

Flero is a workflow automation platform. It allows you to connect third-party services, such as Google (including Gmail, Drive, Calendar, Sheets and Docs), Slack, Salesforce and many others, and to build automated workflows that move and process data between them.

We act only on your instructions. Flero does not access, collect or retrieve any data from a connected service on its own initiative. When you connect a service and build a workflow, you authorise Flero to access only the specific data that your workflow requires, and only when that workflow runs, or when you are configuring it. The data a workflow can access is determined entirely by you, through the workflow you design and the permissions you grant.

What we access. Depending on the services you connect and the workflows you build, this may include, for example, email messages and attachments (Gmail), files and their contents (Drive), calendar events, spreadsheets, documents, contacts and messages held in the services you connect. We only ever access the items your workflow operates on.

Configuration-time lookups. When you are setting up a connector step, Flero may fetch lists of items from the connected service, such as your Gmail labels, Drive folders or Slack channels, so you can choose from them. These lookups use the access you have granted and happen only while you are editing the step. The lists are shown to you only to make a selection: they are not stored, and only the option you choose is saved as part of your workflow.

How we use it. Connector data is used for one purpose only: to execute the workflows you have designed. We do not use it for any other purpose. In particular, we do not sell connector data, we do not share it with third parties for their own purposes, and we do not use it for advertising of any kind.

AI features are under your control. Flero includes optional AI features (such as an AI Agent step and an embeddings step). Flero never sends your connector data to any AI service on its own. Your connector data is sent to an AI service only if you explicitly build a workflow that does so, for example, by including that data in a prompt, or by connecting it as a tool the AI step may use, and only to the AI provider you have chosen and configured. Our AI workflow-building assistant, which helps you design workflows, is never given access to your connector data.

Automated and triggered workflows. You can set a workflow to run automatically, on a schedule, or when an external service sends data to the workflow's webhook address. In these cases the workflow runs without you being present, but only because, and exactly as, you configured it. Where a workflow is triggered by an incoming webhook, the data sent to that address (including the request body and headers) is received and stored as part of that workflow's execution record, in the same way as other execution data. You can secure a webhook with a shared secret so that only authorised senders can trigger it.

Where your data is stored. We currently operate a dedicated, isolated Flero instance for each customer on Google Cloud Platform. Your connector data, credentials and workflow-execution records are stored only on your own instance and are not shared with, or accessible to, other customers. Connection credentials (such as access tokens) are stored encrypted at rest, and all data is transmitted over encrypted connections (TLS/HTTPS). Access tokens are not retained within stored workflow-execution records.

Minimum permissions. We request only the permissions each connector needs to perform the actions you ask of it, and we request them in context when you connect a service. Where a provider offers narrower (for example, read-only) permissions, you may choose those instead.

Retention. Records of workflow executions, which may include content fetched from the services you have connected, are retained for a configurable period, after which they are deleted. You or your administrator can adjust this period.

Withdrawing access. You can disconnect any connected service at any time from within Flero, which deletes the stored credentials for that connection. You can also revoke Flero's access directly with the provider, for Google, at https://myaccount.google.com/permissions. You may also ask us to delete your workflow-execution data; see Your Legal Rights below.

Changes to how we use connector data. If we change the way Flero uses data from a connected service, we will update this policy and ask you to re-authorise the connection before the new use takes effect.

Google User Data and Limited Use

Where you connect a Google service to Flero, our access to and use of data obtained through Google APIs is also governed by this section.

Flero's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In particular, data obtained from Google APIs (and any data derived from it):

• is used only to provide and improve the user-facing features of Flero that you have configured;
• is not sold, and is not transferred to third parties such as advertising platforms, data brokers or information resellers;
• is not used for serving advertising of any kind, including personalised, retargeted or interest-based advertising;
• is not used to determine credit-worthiness or for lending purposes;
• is not used to train generalised artificial intelligence or machine-learning models; and
• is not read by humans, unless: (a) you have given your explicit consent to read specific messages, files or other data; (b) it is necessary for security purposes, such as investigating a bug or abuse; (c) it is necessary to comply with applicable law; or (d) the data has been aggregated and anonymised, and is used for internal operations in accordance with applicable privacy and other legal requirements.

You can review and revoke Flero's access to your Google account at any time at https://myaccount.google.com/permissions.

Cookies

We use cookies and/or other tracking technologies to distinguish you from other users of the App and to remember your preferences and your progress and past usage of the App. This helps us to provide you with a good experience when you use the App and also allows us to improve the App. Your Device will create a store of Usage Data, Profile Data and Social Profile Data as part of its core functionality.

On our Website we use the Apollo website tracker for company-level analytics. It identifies the organisation a visit comes from, not the individual, and we load it on a legitimate-interest basis. You can opt out at any time from the cookie banner or our Cookie Policy.

reCAPTCHA

We use Google's reCAPTCHA v3 service on our website to protect against spam and abuse. reCAPTCHA works by collecting hardware and software information, and sending it to Google for analysis. This information includes device and application data, and the results of the integrity check. Your use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Use.

Disclosures of Your Personal Data

When you consent to providing us with your personal data, we will also ask you for your consent to share your personal data with the third parties set out below for the purposes set out in the list below:

• Third parties to whom we have outsourced some aspects of the App and the associated services, such as the helpdesk, hosting of the App, warehousing of data and marketing activities. For details on our providers please contact us at dpo@aicetechnology.com.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

After you place an order on our Website you will need to make payment for the goods or services you have ordered. In order to process your payment we use Stripe, a third party payment processor.

Stripe's services in Europe are provided by a Stripe affiliate, Stripe Payments Europe Limited ("Stripe Payments Europe"), an entity located in Ireland. In providing Stripe Services, Stripe Payments Europe transfers personal data to Stripe, Inc. in the US.

For further information about the safeguards used when your information is transferred outside the European Economic Area, see International Transfers below.

AICE Technology Limited does not have any access to payment information, so we do not collect or store it.

International Transfers

Some of our external third parties are based outside the UK so their processing of your personal data will involve a transfer of data outside the UK.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries.
• Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see European Commission: Model contracts for the transfer of personal data to third countries.
• Where we use providers based in the US, we may transfer data to them if they are part of the Data Privacy Framework which requires them to provide similar protection to personal data shared between Europe and the US. For further details, see the European Commission's EU-US data transfers page.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

Data Security

All information you provide to us is stored on our secure servers.

Once we have received your information, we will use strict procedures and security features to try to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way.

We will collect and store personal data on your Device using application data caches and other technology.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator when we are legally required to do so.

Data Retention

If we do hold any of your personal data, including Login Data, we will retain your personal data for a period of up to 3 years after you have stopped using the App or the login, save in the case of Contact Data, as long as you remain a Flero user. The Usage Data that is not linked with any of your personal data (and is therefore anonymous) will remain on our systems, and we will continue to use it to develop our App and understand the use of it by subscribers. You agree that we have the right to depersonalise any data for these purposes. In some circumstances you can ask us to delete your data: see Your Legal Rights below for further information.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

In the event that you do not use the App for a period of three years then we will treat the account as expired and your personal data may be deleted.

Glossary

The lawful bases we may rely on when processing your personal data are defined below.

Your Legal Rights

Under certain circumstances you have the following rights under data protection laws in relation to your personal data. You can exercise any of these rights at any time by contacting us at dpo@aicetechnology.com.

You have the right to:

• Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
  • If you want us to establish the data's accuracy.
  • Where our use of the data is unlawful but you do not want us to erase it.
  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you consider that our processing of your personal information infringes data protection laws, you have a legal right to lodge a complaint with a supervisory authority responsible for data protection. For more information on these rights, please visit https://ico.org.uk/for-the-public/.

These terms are written in English, and are intended to be interpreted according to the rules of English. If these terms are translated into any other language, that version is for convenience only, and if there is any difference between the meaning of the English version and any other language version, the English language version will prevail.