Privacy Policy

This policy explains what personal data Floriva AI (“Floriva”, “we”) collects when you use our platform, why we collect it, who we share it with, and the rights you have over it. It covers the Floriva web application, API and mobile apps.

Who we are

Floriva AI provides a social media operations platform: content creation, scheduling, publishing and analytics. For the purposes of the UK GDPR and EU GDPR we are the data controller for account and billing data, and a data processor for the content and connected-account data you bring into a workspace.

Data we collect

• Account data — name, email address, password hash, organisation and workspace membership, role, and authentication sessions.
• Billing data — subscription tier, invoices, and payment status. Card details are handled by Stripe and never reach our servers.
• Content and media — the posts, images, videos, captions and campaign material you create or upload.
• Connected social accounts — access tokens and the account identifiers needed to publish on your behalf, for the platforms you choose to connect.
• Usage and diagnostics — product analytics events and error reports, used to operate and improve the service.
• Consent records — which policy version you accepted and when, retained as evidence of consent.

Why we use it

• To provide the service you asked for — performance of a contract.
• To take payment and meet accounting obligations — contract and legal obligation.
• To keep the platform secure and diagnose faults — legitimate interests.
• To send product and marketing email — consent, withdrawable at any time.

AI processing

Floriva uses third-party language and image models to generate and assist with content. Material you submit to an AI feature — prompts, briefs, reference text and images — is sent to the model provider processing that request. We do not permit providers to train their models on your content. AI-generated output should be reviewed before publication; it can be inaccurate.

Who we share data with

We use the following processors. Each handles only the data needed for its function, under contract, and none of them sell personal data.

• Stripe — payments, subscriptions and invoicing.
• Amazon S3, MinIO and Cloudflare R2 — media and file storage.
• Cloudflare — content delivery and network protection.
• OpenAI and Anthropic — language and content generation models.
• Listmonk and SendGrid — transactional and campaign email.
• PostHog and Google Analytics — product and web analytics.
• Sentry — error monitoring and crash diagnostics.
• The social platforms you connect — content you publish is transmitted to those platforms and is then governed by their own policies.

We also disclose data where the law requires it, and to a successor entity in the event of a merger or acquisition, in which case you will be told beforehand.

International transfers

Our infrastructure is hosted in the European Union. Some processors above operate outside the EEA and the UK. Where data is transferred, it is done under Standard Contractual Clauses or an equivalent approved safeguard.

How long we keep it

• Account data — for the life of the account, then deleted within 90 days of closure.
• Billing records — retained as long as tax and accounting law requires, typically six years.
• Content and media — until you delete it, or the account closes.
• Connected-account tokens — until you disconnect that account or revoke access at the platform.
• Diagnostics — up to 90 days.

Your rights

You may request access to your data, correction, deletion, a portable copy, restriction of processing, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting processing already carried out. You also have the right to complain to your data protection authority — in the UK, the Information Commissioner’s Office.

Requests can be made from your account settings or by email to the address below. We respond within one month.

Cookies

We use cookies that are strictly necessary for signing in and keeping your session secure, and — only with your consent — analytics cookies that help us understand how the product is used. You can change your choice at any time through the cookie settings in the application.

Security

Data is encrypted in transit. Workspace data is isolated at the database level using row-level security, so one organisation cannot read another’s records. Access to production systems is restricted and logged. No system is perfectly secure, and we will notify you and the relevant authority of a qualifying breach without undue delay.

Children

Floriva is a business product and is not directed at children under 16. We do not knowingly collect their data.

Changes and contact

Material changes will be notified in the product before they take effect, and the date at the top of this page will change. For any privacy question or to exercise a right, contact privacy@florivaai.com.

This policy describes the processing the platform actually performs and names the processors it integrates. It is not legal advice. Before relying on it, have it reviewed against your registered entity details, your appointed DPO or representative, and your retention commitments.