Privacy Policy

Last updated: 30 September 2026

This Privacy Policy explains how Flow Leap SASU ("FlowLeap", "we", "us") collects, uses, shares, and protects personal data when you use the FlowLeap desktop application, website at flowleap.co, dashboard, API, and related services (the "Service").

We are committed to protecting your privacy and the confidentiality of your patent work. We do not use your content to train AI models (see Section 5).

This policy is written for the European Union General Data Protection Regulation (GDPR) and French data-protection law, overseen by the CNIL.

1. Who is responsible for your data

For personal data processed through the Service, the data controller is:

Flow Leap SASU — registered in the French National Business Register (RNE) under SIREN 988 064 721, with head-office SIRET 988 064 721 00018, VAT number FR81 988 064 721, and registered office at 47 rue Marcel Bonnet, 94230 Cachan, France.

Privacy contact: contact@flowleap.co

Where we process personal data on behalf of an Organization (for example, content submitted by an Organization's members in the course of their work), we generally act as a data processor for that Organization, which is the controller of that data. In that case, our Data Processing Agreement governs that processing, and you should also consult your Organization's own privacy notice.

2. Scope

This policy covers personal data of account holders, Organization members, website visitors, and people who contact us. It does not cover third-party websites or services we link to, or the Model Provider and agent harness accounts you choose to connect (for example ChatGPT or Claude, when you add FlowLeap to them as a connector), which have their own policies.

3. What data we collect

Data you provide:

Identity and account data — name, email address, and authentication details (managed via our identity provider, Clerk).
Organization data — Organization name, your role, membership, and settings.
Billing data — subscription plan, billing details, and invoices (payments are handled by our payment provider, Stripe; we do not store full card numbers).
Stored patent-data keys — if you choose to store them, your EPO OPS key and secret and your USPTO ODP key, with the dates each was stored, last verified, replaced, or deleted, and the surface used (see Section 7).
Your Content — the Inputs you submit (prompts, instructions, documents, prior-art references, drafts, claims) and the Outputs generated for you.
Support and communications — messages you send us and related details.

Data collected automatically:

Technical data — IP address, device and browser information, and application version.
Usage data — feature usage, request counts, tool activity, diagnostics, and activity/audit events.
Cookies and similar technologies — as described in Section 11.

We do not intentionally collect special-category personal data, and you should avoid submitting it as Input unless necessary and lawful.

4. How and why we use your data (purposes and lawful bases)

Purpose	Examples	Lawful basis (GDPR Art. 6)
Provide the Service	Authenticate you, run AI features and patent-data tools, return Outputs, and manage Organizations	Performance of a contract
Billing and payments	Process subscriptions, invoices, taxes	Contract; legal obligation
Security and abuse prevention	Protect accounts, detect and prevent fraud and misuse, maintain audit logs	Legitimate interests; legal obligation
Support	Respond to your requests	Contract; legitimate interests
Service improvement (aggregated)	Anonymous/aggregated statistics and diagnostics — not model training	Legitimate interests
Communications	Service and security notices	Contract / legitimate interests
Marketing (if any)	Product news, newsletters	Consent (you can opt out anytime)
Legal compliance and disputes	Comply with law, enforce our Terms, establish or defend legal claims	Legal obligation; legitimate interests

Where we rely on legitimate interests, we balance them against your rights and have concluded our interests do not override them; you may object (see Section 12).

5. Your Content: our commitments

5.1 We do not train on your content. We do not use your Inputs or Outputs to train, fine-tune, or improve any AI models, and our agreements with AI Service Providers prohibit them from using your content to train their models. For trial model access, FlowLeap's OpenRouter account settings exclude providers that train on prompts (Section 5.4). Your chosen Model Provider processes primary inference under its own terms.

5.2 Confidentiality. We treat Your Content as confidential. Access is limited to personnel and sub-processors who need it to provide the Service, under confidentiality obligations.

5.3 Primary model inference. Primary model inference uses the Model Provider account, credentials, or agent harness you select. FlowLeap does not proxy that model usage, and pays for it only during the trial (see "Trial model access" in Section 5.4). Your selected provider processes those requests under your separate agreement with it, including its privacy, retention, and training terms.

The same applies when you connect FlowLeap to ChatGPT, Claude, or another MCP client as a connector. You sign in to FlowLeap through our identity provider (Clerk). The results of the FlowLeap tools you call, such as patent data and PATSTAT figures, are returned to that client, and its vendor processes them under your agreement with it. FlowLeap runs no model for that connection.

5.4 FlowLeap-managed AI tools. Three features run on FlowLeap's own AI Service Provider accounts rather than on the Model Provider account you select:

Document OCR — the document you submit is sent to Mistral AI to be converted to text.
Analyst narration — on FlowLeap's patent-analytics pages, the patent or applicant you asked about, together with the analytics already displayed, is sent to Anthropic to produce the written commentary. The charts themselves are computed from patent-statistics data and involve no AI Service Provider.
Public Try Agent — a question submitted to the home-page demonstration, together with the PATSTAT results needed to answer it, is sent to DeepSeek V4 Pro through Vercel AI Gateway. This demonstration is separate from the desktop product and must not be used for confidential or unfiled inventions.

Each sends only the content that feature needs, to the providers listed in Section 7, which process it under FlowLeap's instructions.

Trial model access. During the 7-day trial, FlowLeap also pays for the models your agent uses until you add your own Model Provider key. The desktop app receives an OpenRouter key that FlowLeap creates on its own OpenRouter account, with a hard daily spending limit. The app sends your prompts, and whatever you attach to them, directly to OpenRouter, which routes each request to a provider of the trial model you use. FlowLeap's servers do not receive or store that content. FlowLeap has set its OpenRouter account to use only providers that do not train on prompts and do not retain them. The key is revoked when the trial ends. You can add your own Model Provider key at any time, including on the first day; from then on, your requests go to your provider instead.

Apart from these three features and trial model access, no other feature sends Your Content to a model FlowLeap pays for.

Separately, our legal-reference search converts your search text into a numerical representation to rank results. That conversion runs on FlowLeap's own servers, so no AI Service Provider receives that text.

Until August 2026, FlowLeap-managed query building and claim analysis also ran on our AI Service Provider accounts. Those features were withdrawn from our servers and now run on the Model Provider account you select. Our public data-handling page records what leaves your machine, feature by feature, and is updated whenever that changes.

5.5 You stay in control. You can access, export, and delete Your Content from the Service, subject to limited backup and legal-retention periods (Section 9).

6. We do not sell your data

We do not sell your personal data, and we do not use Your Content for advertising or to build advertising profiles.

Your chosen Model Provider or agent harness processes primary inference under your separate relationship with it. User-selected BYOK providers are therefore not included in FlowLeap's subprocessor table for primary inference. If FlowLeap separately engages the same company for a FlowLeap-managed feature, that separate processing relationship appears below.

We share personal data only as needed to run FlowLeap-managed parts of the Service, with providers bound by data-protection terms, and with authorities where required by law. Our key sub-processors are:

Sub-processor	Purpose	Location	Notes
Mistral AI	Document OCR	EU (France)	No training under FlowLeap's provider terms
Anthropic	Analyst narration on the patent-analytics pages	USA	No training under FlowLeap's provider terms
DeepSeek, routed through Vercel AI Gateway	Public home-page Try Agent	Provider infrastructure	PATSTAT-only demonstration; do not submit confidential material
OpenRouter	Trial model access during the 7-day trial: routes the desktop app's model requests to the trial model providers	USA (OpenRouter); the model provider's infrastructure	Sent directly from the desktop app; FlowLeap's OpenRouter account is set to providers that do not train on or retain prompts
Clerk	Authentication and account management	USA	—
Stripe	Payments and billing	USA	Card data handled by the payment provider
Hetzner	Hosting of the backend API server and the PATSTAT patent-statistics database	EU (Germany)	—
Supabase	Hosting of the backend database: account, subscription, activity, and stored patent-data key records	Provider infrastructure	Stored patent-data keys are encrypted before they reach the database
Vercel	Website and dashboard hosting and delivery	USA	—
Resend	Transactional and trial emails	EU (sending region)	Email address and name only; every trial email has an unsubscribe link

We may also share data with professional advisers, and with authorities, courts, or regulators (including the CNIL) where legally required, and in connection with a merger, acquisition, or sale of assets (with notice where required).

Patent-data queries are transmitted to the data services needed to fulfil your request, including EPO OPS and USPTO ODP. You can supply your own patent-data credentials for these services in two ways:

Sent with each request. A client on your machine, such as the FlowLeap CLI, the VS Code extension, or an MCP client with a header field, sends the credentials with each request. FlowLeap forwards them to the relevant service for authentication and does not store or log them.
Stored with FlowLeap, at your choice. You can store your EPO OPS key and secret or your USPTO ODP key on the "Patent-data keys" page of your dashboard. FlowLeap first checks the key with that service and stores nothing if the service refuses it. A stored key is encrypted at rest and used only to authenticate your own requests to that service when a request does not carry credentials of its own. FlowLeap never shows the value again, on any page or in any response, and never writes it to a log. You can replace or delete a stored key on the same page at any time, and a deletion takes effect on your next request. When you replace a key, the earlier value stays encrypted in our records until you delete the key for that service. A deletion clears every stored value for that service and keeps only an audit record of the dates, the service concerned, and the surface used, never the key.

When a request carries credentials and you also have a stored key for the same service, the credentials sent with the request are used.

We keep an up-to-date list of sub-processors and will update this policy when it changes. Our data-handling page sets out the same facts feature by feature, including what is retained and for how long.

8. International data transfers

Some of our sub-processors are located outside the European Economic Area (notably in the United States). Where we transfer personal data outside the EEA, we rely on appropriate safeguards under the GDPR, primarily the European Commission's Standard Contractual Clauses, together with supplementary measures where appropriate. You can request more information about these safeguards using the contact details below.

9. Data retention

We keep personal data only as long as necessary for the purposes above, then delete or anonymize it. Indicative periods:

Your Content — until you delete it or your Account/Organization is terminated, subject to limited backups.
Stored patent-data keys — until you delete them on the "Patent-data keys" page or your Account is deleted. Account deletion also clears them. The audit record of each save, replacement, and deletion holds the dates, the service concerned, and the surface used, never the key.
Account data — for the life of your Account, then deleted or anonymized within a reasonable period after closure.
Technical/usage logs — a limited rolling period for security and diagnostics.
Billing records and invoices — as required by French law (typically up to 10 years).
Support records — for a limited period after the matter is resolved.

10. Security

We use technical and organizational measures appropriate to the risk, including encryption in transit, encryption at rest of stored patent-data keys (AES-256-GCM, with the encryption key held in the server environment, never in the database), access controls, and least-privilege access to Your Content. No system is perfectly secure, but we work to protect your data and will notify you and the relevant authority of a personal-data breach where the law requires.

11. Cookies

We use strictly necessary cookies to operate the Service and, with your consent where required, limited analytics. You can manage non-essential cookies through our cookie controls.

12. Your rights

Under the GDPR, you have the right to: access your data; rectify inaccurate data; erase data; restrict or object to processing (including processing based on legitimate interests); data portability; and to withdraw consent at any time where processing is based on consent. You also have the right not to be subject to solely automated decisions producing legal or similarly significant effects; we do not make such decisions about you.

To exercise your rights, contact us at contact@flowleap.co. We will respond within the time limits required by law. If your data is processed on behalf of an Organization, we may direct your request to that Organization as controller.

You also have the right to lodge a complaint with a supervisory authority — in France, the Commission Nationale de l'Informatique et des Libertés (CNIL), www.cnil.fr.